diff --git a/.github/workflows/v11-deployment-pipeline.yml b/.github/workflows/v11-deployment-pipeline.yml
index 8ac8a5e94..65d09e245 100644
--- a/.github/workflows/v11-deployment-pipeline.yml
+++ b/.github/workflows/v11-deployment-pipeline.yml
@@ -522,7 +522,7 @@ jobs:
-H "Content-Type: application/json" \
-H "id: $auth_id" \
-H "key: $auth_key" \
- -d "{\"instance_id\": \"$instance_id\", \"version\": \"$TAG\"}")
+ -d "{\"instances_ids\": [\"$instance_id\"], \"version\": \"$TAG\"}")
http_code=$(echo "$response" | tail -n1)
body=$(echo "$response" | sed '$d')
diff --git a/README.md b/README.md
index 3020fdfd9..553f1624f 100644
--- a/README.md
+++ b/README.md
@@ -1,27 +1,32 @@
-
-
- 
-
+# UTMStack
-
-
-
-
-
-
+
+
+
-Enterprise-ready SIEM and XDR powered by Real-Time correlation and Threat Intelligence
+[](https://github.com/utmstack/UTMStack/graphs/contributors)
+[](https://github.com/utmstack/UTMStack/releases/)
+[](https://github.com/utmstack/UTMStack/issues)
+[](https://github.com/utmstack/UTMStack/commits/main)
+[](https://github.com/utmstack/UTMStack/blob/master/LICENSE)
+[](https://discord.gg/ZznvZ8xcHh)
-## Introduction
+#### Enterprise-ready SIEM and XDR powered by Real-Time correlation and Threat Intelligence
-Welcome to the UTMStack open-source project! UTMStack is a unified threat management platform that merges SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) technologies. Our unique approach allows real-time correlation of log data, threat intelligence, and malware activity patterns from multiple sources, enabling the identification and halting of complex threats that use stealthy techniques. Visit an [online demo here.](https://utmstack.com/demo)
+## Introduction
-We have a [dedicated repository](https://github.com/utmstack/rules) for correlation rules, contributors are welcome to submit a pull request.
+Welcome to the UTMStack open-source project! UTMStack is a unified threat management platform that merges SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) technologies. Our unique approach allows real-time correlation of log data, threat intelligence, and malware activity patterns from multiple sources, enabling the identification and halting of complex threats that use stealthy techniques. Visit an [online demo here.](https://utmstack.com/demo)
-
-
+
+
+
+
+
+
+
+
## Features
@@ -33,7 +38,6 @@ We have a [dedicated repository](https://github.com/utmstack/rules) for correla
- SOC AI-Powered Analysis
- Security Compliance
-
## Why UTMStack?
UTMStack stands out in threat prevention by surpassing the boundaries of traditional systems. Our software platform can swiftly analyze log data to identify and halt threats at their source in real-time, even if the threat was not directly detected on the server itself. This seamless integration of SIEM and XDR capabilities sets UTMStack apart from competitors, providing organizations with an effective, holistic cybersecurity suite that enhances threat detection, response, and remediation across clients’ valuable digital infrastructure. Correlation happens before data ingestion, reducing workload and improving response times.
@@ -80,7 +84,7 @@ Definitions:
- Cold log storage: archived data that should be restored before accessing it.
- Data source: any individual source of logs, for example, devices, agents, SaaS integrations.
-Resources needed for one month of hot log storage.
+Required resources for one month of hot log storage.
- For 50 data sources (120 GB) of hot log storage you will need 4 Cores, 16 GB RAM, 150 GB Disk Space
- For 120 data sources (250 GB) of hot log storage you will need 8 Cores, 16 GB RAM, 250 GB Disk Space
- For 240 data sources (500 GB) of hot log storage you will need 16 Cores, 32 GB RAM, 500 GB Disk Space
@@ -109,16 +113,16 @@ Once UTMStack is installed, use admin as the user and the password generated dur
Note: Use HTTPS in front of your server name or IP to access the login page.
### Required ports
-- 22/TCP Secure Shell (We recommend to create a firewall rule to allow it only from admin workstation)
-- 80/TCP UTMStack Web-based Graphical User Interface Redirector (We recommend to create a firewall rule to allow it only from admin and security analyst workstations)
-- 443/TCP UTMStack Web-based Graphical User Interface (We recommend to create a firewall rule to allow it only from admin and security analyst workstations)
-- 9090/TCP Cockpit Web-based Graphical Interface for Servers (We recommend to create a firewall rule to allow it only from admin workstation)
-- Others ports will be required during the configuration of UTMStack's integrations in order to receive logs. (Please follow the security recommendations given on the integration guide if exists)
+- 22/TCP Secure Shell (We recommend creating a firewall rule to allow it only from admins workstations)
+- 80/TCP UTMStack Web-based Graphical User Interface Redirector (We recommend creating a firewall rule to allow it only from admin and security analyst workstations)
+- 443/TCP UTMStack Web-based Graphical User Interface (We recommend creating a firewall rule to allow it only from admin and security analyst workstations)
+- 9090/TCP Cockpit Web-based Graphical Interface for Servers (We recommend creating a firewall rule to allow it only from admin workstation)
+- Others ports will be required during the configuration of UTMStack's integrations to receive logs. (Please follow the security recommendations given on the integration guide if exists)
# FAQ
- Is this based on Grafana, Kibana, or a similar reporting tool?
Answer: It is not. UTMStack has been built from the ground up to be a simple and intuitive SIEM/XDR.
- Does UTMStack use ELK for log correlation?
Answer: It does not. UTMStack correlation engine was built from scratch to analyze data before ingestion and maximize real-time correlation.
-- What is the difference between the Open Source and Enterprise version?
+- What is the difference between the Open Source and Enterprise versions?
The enterprise version includes features that would typically benefit enterprises and MSPs. For example, support, faster correlation, frequent threat intelligence updates, and Artificial Intelligence.
diff --git a/agent/updater/utils/download.go b/agent/updater/utils/download.go
index abc0fd120..b8c223447 100644
--- a/agent/updater/utils/download.go
+++ b/agent/updater/utils/download.go
@@ -18,11 +18,12 @@ func DownloadFile(url string, headers map[string]string, fileName string, path s
req.Header.Add(key, value)
}
- client := &http.Client{}
- client.Transport = &http.Transport{
+ tr := &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: skipTlsVerification},
DisableCompression: true,
}
+ client := &http.Client{Transport: tr}
+ defer tr.CloseIdleConnections()
resp, err := client.Do(req)
if err != nil {
diff --git a/agent/utils/download.go b/agent/utils/download.go
index db558f2b7..b8c223447 100644
--- a/agent/utils/download.go
+++ b/agent/utils/download.go
@@ -18,11 +18,12 @@ func DownloadFile(url string, headers map[string]string, fileName string, path s
req.Header.Add(key, value)
}
- client := &http.Client{}
- client.Transport = &http.Transport{
- TLSClientConfig: &tls.Config{InsecureSkipVerify: skipTlsVerification},
+ tr := &http.Transport{
+ TLSClientConfig: &tls.Config{InsecureSkipVerify: skipTlsVerification},
DisableCompression: true,
}
+ client := &http.Client{Transport: tr}
+ defer tr.CloseIdleConnections()
resp, err := client.Do(req)
if err != nil {
diff --git a/agent/utils/req.go b/agent/utils/req.go
index d0ed278dd..a7d0dfa5d 100644
--- a/agent/utils/req.go
+++ b/agent/utils/req.go
@@ -21,10 +21,11 @@ func DoReq[response any](url string, data []byte, method string, headers map[str
req.Header.Add(k, v)
}
- client := &http.Client{}
- client.Transport = &http.Transport{
+ tr := &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: skipTlsVerification},
}
+ client := &http.Client{Transport: tr}
+ defer tr.CloseIdleConnections()
resp, err := client.Do(req)
if err != nil {
diff --git a/agent/version.json b/agent/version.json
index 6bbff213a..685be4c14 100644
--- a/agent/version.json
+++ b/agent/version.json
@@ -1,4 +1,4 @@
{
- "version": "11.1.1",
- "updater_version": "1.0.0"
+ "version": "11.1.3",
+ "updater_version": "1.0.2"
}
diff --git a/backend/src/main/java/com/park/utmstack/config/OpenApiConfiguration.java b/backend/src/main/java/com/park/utmstack/config/OpenApiConfiguration.java
index dd1414d6d..f3fcba61e 100644
--- a/backend/src/main/java/com/park/utmstack/config/OpenApiConfiguration.java
+++ b/backend/src/main/java/com/park/utmstack/config/OpenApiConfiguration.java
@@ -34,7 +34,7 @@ public OpenAPI customOpenAPI() {
.addList(securitySchemeApiInternalKey)
.addList(securitySchemeApiKey))
.components(new Components()
- .addSecuritySchemes(securitySchemeBearer,
+ /*.addSecuritySchemes(securitySchemeBearer,
new SecurityScheme()
.name(securitySchemeBearer)
.type(SecurityScheme.Type.HTTP)
@@ -43,7 +43,7 @@ public OpenAPI customOpenAPI() {
.addSecuritySchemes(securitySchemeApiInternalKey, new SecurityScheme()
.name("Utm-Internal-Key")
.type(SecurityScheme.Type.APIKEY)
- .in(SecurityScheme.In.HEADER))
+ .in(SecurityScheme.In.HEADER))*/
.addSecuritySchemes(securitySchemeApiKey, new SecurityScheme()
.name(Constants.API_KEY_HEADER)
.type(SecurityScheme.Type.APIKEY)
diff --git a/backend/src/main/java/com/park/utmstack/config/RestTemplateConfiguration.java b/backend/src/main/java/com/park/utmstack/config/RestTemplateConfiguration.java
index 5af8523ff..b08dc1764 100644
--- a/backend/src/main/java/com/park/utmstack/config/RestTemplateConfiguration.java
+++ b/backend/src/main/java/com/park/utmstack/config/RestTemplateConfiguration.java
@@ -5,6 +5,7 @@
import org.apache.http.conn.ssl.TrustStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
+import org.jetbrains.annotations.NotNull;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.annotation.Bean;
@@ -44,7 +45,7 @@ public RestTemplate rawRestTemplate() {
RestTemplate rest = new RestTemplate();
rest.setErrorHandler(new DefaultResponseErrorHandler() {
@Override
- public boolean hasError(ClientHttpResponse response) {
+ public boolean hasError(@NotNull ClientHttpResponse response) {
return false;
}
});
diff --git a/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/impl/ModuleConfigurationValidator.java b/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/impl/ModuleConfigurationValidator.java
index 63811ffdd..7efc54cb9 100644
--- a/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/impl/ModuleConfigurationValidator.java
+++ b/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/impl/ModuleConfigurationValidator.java
@@ -32,7 +32,7 @@ public boolean isValid(GroupConfigurationDTO dto, ConstraintValidatorContext con
return module.validateConfiguration(utmModule, dto.getKeys());
} catch (Exception e) {
context.disableDefaultConstraintViolation();
- context.buildConstraintViolationWithTemplate("Invalid configuration for selected module.")
+ context.buildConstraintViolationWithTemplate(e.getMessage())
.addPropertyNode("keys")
.addConstraintViolation();
return false;
diff --git a/backend/src/main/java/com/park/utmstack/repository/datainput_ingestion/UtmDataInputStatusRepository.java b/backend/src/main/java/com/park/utmstack/repository/datainput_ingestion/UtmDataInputStatusRepository.java
index 4cf0c3c0f..47be50866 100644
--- a/backend/src/main/java/com/park/utmstack/repository/datainput_ingestion/UtmDataInputStatusRepository.java
+++ b/backend/src/main/java/com/park/utmstack/repository/datainput_ingestion/UtmDataInputStatusRepository.java
@@ -47,9 +47,19 @@ public interface UtmDataInputStatusRepository extends JpaRepository findDataSourcesToConfigure(@Param("dataType") String dataType);
+
+
Optional findByDataType(String dataType);
Optional findBySourceAndDataType(String source, String dataType);
diff --git a/backend/src/main/java/com/park/utmstack/service/UtmDataInputStatusService.java b/backend/src/main/java/com/park/utmstack/service/UtmDataInputStatusService.java
index f21e5a1c9..7bbd975f6 100644
--- a/backend/src/main/java/com/park/utmstack/service/UtmDataInputStatusService.java
+++ b/backend/src/main/java/com/park/utmstack/service/UtmDataInputStatusService.java
@@ -485,14 +485,14 @@ private Map getLatestStatisticsByDataSource() {
}
});
- Instant lastTimestamp = result.values().stream()
+ Optional maybeLastTimestamp = result.values().stream()
.map(doc -> Instant.parse(doc.getTimestamp()))
- .max(Instant::compareTo)
- .orElse(Instant.now());
+ .max(Instant::compareTo);
- checkpoint.setLastProcessedTimestamp(lastTimestamp);
-
- this.checkpointRepository.save(checkpoint);
+ if (maybeLastTimestamp.isPresent()) {
+ checkpoint.setLastProcessedTimestamp(maybeLastTimestamp.get());
+ this.checkpointRepository.save(checkpoint);
+ }
return result;
}
diff --git a/backend/src/main/java/com/park/utmstack/service/application_modules/UtmModuleGroupConfigurationService.java b/backend/src/main/java/com/park/utmstack/service/application_modules/UtmModuleGroupConfigurationService.java
index 1311b5f4d..d8d00387c 100644
--- a/backend/src/main/java/com/park/utmstack/service/application_modules/UtmModuleGroupConfigurationService.java
+++ b/backend/src/main/java/com/park/utmstack/service/application_modules/UtmModuleGroupConfigurationService.java
@@ -62,7 +62,7 @@ public UtmModule updateConfigurationKeys(Long moduleId, List 0) || (activationStatus && moduleInstancesActives > 1))
return;
- filters.forEach(filter -> filter.setActive(activationStatus));
+ filters.forEach(filter -> {
+ filter.setActive(activationStatus);
+ filter.setUpdatedAt(Instant.now());
+ });
logstashFilterService.saveAll(filters);
} else {
return;
diff --git a/backend/src/main/java/com/park/utmstack/service/application_modules/connectors/ModuleConfigurationValidationService.java b/backend/src/main/java/com/park/utmstack/service/application_modules/connectors/ModuleConfigurationValidationService.java
index 9c9ca1124..c34c15cbc 100644
--- a/backend/src/main/java/com/park/utmstack/service/application_modules/connectors/ModuleConfigurationValidationService.java
+++ b/backend/src/main/java/com/park/utmstack/service/application_modules/connectors/ModuleConfigurationValidationService.java
@@ -1,6 +1,9 @@
package com.park.utmstack.service.application_modules.connectors;
+import com.fasterxml.jackson.databind.JsonNode;
import com.park.utmstack.config.Constants;
+import com.park.utmstack.service.dto.application_modules.ModuleConfigValidationErrorMapper;
+import com.park.utmstack.service.dto.application_modules.ModuleConfigValidationErrorResponse;
import com.park.utmstack.service.dto.application_modules.UtmModuleGroupConfWrapperDTO;
import com.park.utmstack.service.web_clients.rest_template.RestTemplateService;
import com.park.utmstack.util.exceptions.ApiException;
@@ -24,44 +27,61 @@ public class ModuleConfigurationValidationService {
public boolean validateModuleConfiguration(String module, UtmModuleGroupConfWrapperDTO configurations) {
final String ctx = CLASSNAME + ".ModuleConfigurationValidationService";
+
HttpHeaders headers = new HttpHeaders();
headers.add("Content-Type", "application/json");
headers.add("Accept", "*/*");
headers.set(Constants.EVENT_PROCESSOR_INTERNAL_KEY_HEADER, System.getenv(Constants.ENV_INTERNAL_KEY));
- String baseUrl = "http://" + System.getenv(Constants.ENV_EVENT_PROCESSOR_HOST) + ":" + System.getenv(Constants.ENV_EVENT_PROCESSOR_PORT);
+ String baseUrl = "http://" + System.getenv(Constants.ENV_EVENT_PROCESSOR_HOST) + ":" + System.getenv(Constants.ENV_EVENT_PROCESSOR_PORT);
String endPoint = baseUrl + "/api/v1/modules-config/validate?nameShort=" + module;
- try{
- ResponseEntity response = restTemplateService.post(
- endPoint,
- configurations,
- String.class,
- headers
- );
-
- if (!response.getStatusCode().is2xxSuccessful()) {
- List errors = response.getHeaders().get("X-UtmStack-error");
- String errorMessage = (errors != null && !errors.isEmpty())
- ? String.join(", ", errors)
- : "Unknown error occurred during module configuration validation.";
-
- log.error("{}: Module configuration validation failed for module: {} with status: {}. Cause: {}",
- ctx, module, response.getStatusCode(), errorMessage);
- throw new ApiException(
- String.format("Module configuration validation failed for module: %s. Cause: %s", module, errorMessage),
- response.getStatusCode()
- );
+
+ ResponseEntity response = restTemplateService.postRaw(
+ endPoint,
+ configurations,
+ JsonNode.class,
+ headers
+ );
+
+ JsonNode body = response.getBody();
+
+ if (response.getStatusCode().is2xxSuccessful() && body != null && body.has("status")) {
+ return true;
+ }
+
+ if (body != null && body.has("error")) {
+ String errorText = body.get("error").asText();
+
+ if (errorText.contains("{\"meta\"")) {
+ ModuleConfigValidationErrorResponse structured = ModuleConfigValidationErrorMapper.parse(errorText);
+
+ if (structured != null) {
+ String traceId = structured.getMeta().getTraceId();
+ String message = structured.getErrors().get(0).getMessage();
+
+ log.error("{}: External provider validation failed for module {}. TraceId: {}. Message: {}",
+ ctx, module, traceId, message);
+
+ throw new ApiException(
+ "External provider validation failed: " + message + " (traceId=" + traceId + ")",
+ HttpStatus.UNAUTHORIZED
+ );
+ }
}
- return true;
+ log.error("{}: Module configuration validation failed for module {}. Cause: {}",
+ ctx, module, errorText);
- } catch (ApiException e) {
- throw e;
- } catch (Exception e) {
- log.error("{}: An error occurred while validating module configuration for module: {}. Cause: {}",
- ctx, module, e.getMessage(), e);
- throw new ApiException("An error occurred while validating module configuration", HttpStatus.INTERNAL_SERVER_ERROR);
+ throw new ApiException(errorText, HttpStatus.BAD_REQUEST);
}
+
+ log.error("{}: Unexpected response validating module {}.", ctx, module);
+ throw new ApiException(
+ String.format("%s: Unexpected response validating module %s.", ctx, module),
+ HttpStatus.INTERNAL_SERVER_ERROR
+ );
}
+
+
}
diff --git a/backend/src/main/java/com/park/utmstack/service/compliance/ComplianceFileResponse.java b/backend/src/main/java/com/park/utmstack/service/compliance/ComplianceFileResponse.java
deleted file mode 100644
index 0beccfa66..000000000
--- a/backend/src/main/java/com/park/utmstack/service/compliance/ComplianceFileResponse.java
+++ /dev/null
@@ -1,17 +0,0 @@
-package com.park.utmstack.service.compliance;
-
-import lombok.Builder;
-import lombok.Data;
-
-@Data
-@Builder
-public class ComplianceFileResponse {
- // Success fields
- private byte[] pdfBytes;
-
- // Error fields
- private boolean error;
- private String message;
- private String details;
-}
-
diff --git a/backend/src/main/java/com/park/utmstack/service/compliance/ComplianceMailService.java b/backend/src/main/java/com/park/utmstack/service/compliance/ComplianceMailService.java
index b553d14ba..4567fc274 100644
--- a/backend/src/main/java/com/park/utmstack/service/compliance/ComplianceMailService.java
+++ b/backend/src/main/java/com/park/utmstack/service/compliance/ComplianceMailService.java
@@ -1,46 +1,56 @@
package com.park.utmstack.service.compliance;
import com.park.utmstack.service.MailService;
+import com.park.utmstack.service.dto.web_pdf.PdfServiceResponse;
import com.park.utmstack.service.util.PdfService;
+import lombok.RequiredArgsConstructor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
import java.time.Clock;
import java.time.Instant;
-/**
- * Service Implementation for managing Compliance PDF Delivery.
- */
@Service
-@Transactional
+@RequiredArgsConstructor
public class ComplianceMailService {
- private final Logger log = LoggerFactory.getLogger(ComplianceMailService.class);
+
+ private static final Logger log = LoggerFactory.getLogger(ComplianceMailService.class);
private static final String CLASSNAME = "ComplianceMailService";
+
private final MailService mailService;
private final PdfService pdfService;
- public ComplianceMailService(MailService mailService,
- PdfService pdfService) {
- this.mailService = mailService;
- this.pdfService = pdfService;
- }
-
- /**
- * Method to generate dashboard in PDF format and send via email
- */
- public void sendComplianceByMail(String url, String userEmail) throws Exception {
+ public void sendComplianceByMail(String url, String userEmail) {
final String ctx = CLASSNAME + ".sendComplianceByMail";
String accessKey = System.getenv("INTERNAL_KEY");
- byte[] pdfInBytes = pdfService.getPdf(url, accessKey,PdfService.PdfAccessTypes.PDF_TYPE_INTERNAL.get());
- if (pdfInBytes != null && pdfInBytes.length > 0) {
- mailService.sendComplianceReportEmail(userEmail, "UTMStack Compliance Report Delivery"
- , "This is a scheduled email delivery of a Compliance Report, please do not answer this email. ",
- "Compliance_Report_" + Instant.now(Clock.systemUTC()) + ".pdf", pdfInBytes);
- } else {
- log.error(ctx + ": We couldn't send the email, reason: No data returned from PDF service");
+
+ if (accessKey == null || accessKey.isBlank()) {
+ log.error("{}: INTERNAL_KEY environment variable is missing", ctx);
+ return;
}
+
+ PdfServiceResponse response =
+ pdfService.downloadPdf(url, accessKey, PdfService.PdfAccessTypes.PDF_TYPE_INTERNAL.get());
+
+ if (response.getPdfBytes() == null || response.getPdfBytes().length == 0) {
+ log.error("{}: PDF service returned empty content for URL {}", ctx, url);
+ return;
+ }
+
+ String filename = "Compliance_Report_" + Instant.now(Clock.systemUTC()) + ".pdf";
+
+ mailService.sendComplianceReportEmail(
+ userEmail,
+ "UTMStack Compliance Report Delivery",
+ "This is a scheduled email delivery of a Compliance Report, please do not answer this email.",
+ filename,
+ response.getPdfBytes()
+ );
+
+ log.info("{}: Email successfully sent to {}", ctx, userEmail);
+
}
}
+
diff --git a/backend/src/main/java/com/park/utmstack/service/compliance/UtmComplianceReportScheduleService.java b/backend/src/main/java/com/park/utmstack/service/compliance/UtmComplianceReportScheduleService.java
index 9e98a4cd3..67a09fd7e 100644
--- a/backend/src/main/java/com/park/utmstack/service/compliance/UtmComplianceReportScheduleService.java
+++ b/backend/src/main/java/com/park/utmstack/service/compliance/UtmComplianceReportScheduleService.java
@@ -11,12 +11,14 @@
import com.park.utmstack.service.UserService;
import com.park.utmstack.service.application_events.ApplicationEventService;
import com.park.utmstack.service.dto.compliance.UtmComplianceReportScheduleCriteria;
+import com.park.utmstack.util.exceptions.ApiException;
import com.park.utmstack.web.rest.errors.BadRequestAlertException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.data.domain.Page;
import org.springframework.data.domain.Pageable;
import org.springframework.data.jpa.domain.Specification;
+import org.springframework.http.HttpStatus;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.scheduling.support.CronExpression;
import org.springframework.stereotype.Service;
@@ -128,7 +130,7 @@ public Optional findByComplianceReportValues(UtmCom
log.debug("Request to get UtmComplianceReportSchedule : {}", reportSchedule);
User user = userService.getCurrentUserLogin();
return utmComplianceReportScheduleRepository.findFirstByUserIdAndComplianceIdAndScheduleString(user.getId(),
- reportSchedule.getComplianceId(),reportSchedule.getScheduleString());
+ reportSchedule.getComplianceId(), reportSchedule.getScheduleString());
}
/**
@@ -144,31 +146,43 @@ public void delete(Long id) {
/**
* Scheduled method to execute the compliance report pdf generation and email delivery
- * */
+ *
+ */
@Scheduled(fixedDelay = 5000, initialDelay = 30000)
public void scheduleComplianceReport() {
- final String ctx = CLASSNAME + ".scheduleComplianceReport";
List schedulesList = findAll();
+ schedulesList.forEach(this::processSchedule);
+
+ }
+
+ private void processSchedule(UtmComplianceReportSchedule schedule) {
+
+ Optional userOpt = userService.getUserWithAuthorities(schedule.getUserId());
+
+ if (userOpt.isEmpty()) {
+ log.error("Schedule {} skipped: user {} not found", schedule.getId(), schedule.getUserId());
+ return;
+ }
+
+ User user = userOpt.get();
+
+ Instant now = Instant.now(Clock.systemUTC());
+ Instant next = getNext(schedule.getScheduleString(), schedule.getLastExecutionTime(), now);
+
+ if (!isTimeToExecute(next, now)) {
+ return;
+ }
+
+ complianceMailService.sendComplianceByMail(schedule.getUrlWithParams(), user.getEmail());
+ markExecuted(schedule, next);
- schedulesList.forEach(current -> {
- Optional user = userService.getUserWithAuthorities(current.getUserId());
- try {
- Instant currentDate = Instant.now(Clock.systemUTC());
- Instant next = getNext(current.getScheduleString(), current.getLastExecutionTime(), currentDate);
- if (isTimeToExecute(next, currentDate)) {
- // Set the next execution time (Base time seed)
- current.setLastExecutionTime(next);
- utmComplianceReportScheduleRepository.save(current);
- complianceMailService.sendComplianceByMail(current.getUrlWithParams(), user.get().getEmail());
- }
-
- } catch (Exception e) {
- String msg = ctx + ": " + e.getLocalizedMessage();
- log.error(msg);
- applicationEventService.createEvent(msg, ApplicationEventType.ERROR);
- }
- });
+ }
+
+ @Transactional
+ public void markExecuted(UtmComplianceReportSchedule schedule, Instant next) {
+ schedule.setLastExecutionTime(next);
+ utmComplianceReportScheduleRepository.save(schedule);
}
/***
@@ -180,7 +194,8 @@ private boolean isTimeToExecute(Instant next, Instant currentDate) {
/**
* Method to know the next valid Instant to execute the task, even if the system was shut down for a while
- * */
+ *
+ */
private Instant getNext(String cronExpresion, Instant lastExecution, Instant currentDate) {
CronExpression parse = CronExpression.parse(cronExpresion);
Instant possibleNext = Objects.requireNonNull(parse.next(lastExecution.atZone(ZoneOffset.UTC))).toInstant();
@@ -194,7 +209,7 @@ private Instant getNext(String cronExpresion, Instant lastExecution, Instant cur
// near next execution to avoid extra executions, because the general scheduler that calls these methods,
// is every 5 seconds
Long diffBetweenCurrentAndPossibleNext = currentSecs - possibleNext.getEpochSecond();
- Integer rate = Long.valueOf(diffBetweenCurrentAndPossibleNext/diffBetweenLastAndNext).intValue();
+ Integer rate = Long.valueOf(diffBetweenCurrentAndPossibleNext / diffBetweenLastAndNext).intValue();
Instant resultNext = lastExecution.atZone(ZoneOffset.UTC).toInstant().plusSeconds(diffBetweenLastAndNext * rate);
return resultNext.atZone(ZoneOffset.UTC).toInstant();
}
@@ -205,7 +220,7 @@ private Specification createSpecification(UtmCompli
User user = userService.getCurrentUserLogin();
Specification specification = Specification.where((root, query, criteriaBuilder) ->
- criteriaBuilder.equal(root.get("userId"), user.getId()));
+ criteriaBuilder.equal(root.get("userId"), user.getId()));
if (criteria != null) {
if (criteria.getName() != null) {
specification = specification.and(buildSpecification(criteria.getName(),
diff --git a/backend/src/main/java/com/park/utmstack/service/correlation/rules/UtmCorrelationRulesService.java b/backend/src/main/java/com/park/utmstack/service/correlation/rules/UtmCorrelationRulesService.java
index 6ae4c80b6..97033db62 100644
--- a/backend/src/main/java/com/park/utmstack/service/correlation/rules/UtmCorrelationRulesService.java
+++ b/backend/src/main/java/com/park/utmstack/service/correlation/rules/UtmCorrelationRulesService.java
@@ -125,6 +125,7 @@ public void setRuleActivation(Long ruleId, boolean setActive) throws Exception {
.orElseThrow(() -> new RuntimeException(ctx + ": The rule you're trying to activate or deactivate is not present in database."));
try {
rule.setRuleActive(setActive);
+ rule.setRuleLastUpdate(Instant.now());
this.utmCorrelationRulesRepository.save(rule);
} catch (Exception ex) {
throw new RuntimeException(ctx + ": An error occurred while adding a rule.", ex);
diff --git a/backend/src/main/java/com/park/utmstack/service/dto/application_modules/CSError.java b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/CSError.java
new file mode 100644
index 000000000..901eab291
--- /dev/null
+++ b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/CSError.java
@@ -0,0 +1,9 @@
+package com.park.utmstack.service.dto.application_modules;
+
+import lombok.Data;
+
+@Data
+public class CSError {
+ private int code;
+ private String message;
+}
diff --git a/backend/src/main/java/com/park/utmstack/service/dto/application_modules/Meta.java b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/Meta.java
new file mode 100644
index 000000000..940645656
--- /dev/null
+++ b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/Meta.java
@@ -0,0 +1,9 @@
+package com.park.utmstack.service.dto.application_modules;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import lombok.Data;
+
+@Data
+public class Meta {
+ @JsonProperty("trace_id") private String traceId;
+}
diff --git a/backend/src/main/java/com/park/utmstack/service/dto/application_modules/ModuleConfigValidationErrorMapper.java b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/ModuleConfigValidationErrorMapper.java
new file mode 100644
index 000000000..9ec10ea1d
--- /dev/null
+++ b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/ModuleConfigValidationErrorMapper.java
@@ -0,0 +1,25 @@
+package com.park.utmstack.service.dto.application_modules;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+public class ModuleConfigValidationErrorMapper {
+
+ private static final ObjectMapper mapper = new ObjectMapper();
+
+ public static ModuleConfigValidationErrorResponse parse(String errorText) {
+ try {
+ ObjectMapper mapper = new ObjectMapper();
+
+ int start = errorText.indexOf("{\"meta\"");
+ if (start == -1) return null;
+
+ String innerJson = errorText.substring(start);
+
+ return mapper.readValue(innerJson, ModuleConfigValidationErrorResponse.class);
+
+ } catch (Exception e) {
+ return null;
+ }
+ }
+
+}
diff --git a/backend/src/main/java/com/park/utmstack/service/dto/application_modules/ModuleConfigValidationErrorResponse.java b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/ModuleConfigValidationErrorResponse.java
new file mode 100644
index 000000000..eb7fa8604
--- /dev/null
+++ b/backend/src/main/java/com/park/utmstack/service/dto/application_modules/ModuleConfigValidationErrorResponse.java
@@ -0,0 +1,13 @@
+package com.park.utmstack.service.dto.application_modules;
+
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+public class ModuleConfigValidationErrorResponse {
+ private Meta meta;
+ private List errors;
+}
+
+
diff --git a/backend/src/main/java/com/park/utmstack/service/logstash_filter/UtmLogstashFilterService.java b/backend/src/main/java/com/park/utmstack/service/logstash_filter/UtmLogstashFilterService.java
index f3d7e5b67..4afb5dd94 100644
--- a/backend/src/main/java/com/park/utmstack/service/logstash_filter/UtmLogstashFilterService.java
+++ b/backend/src/main/java/com/park/utmstack/service/logstash_filter/UtmLogstashFilterService.java
@@ -6,6 +6,7 @@
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
+import java.time.Instant;
import java.util.List;
import java.util.Optional;
@@ -36,6 +37,7 @@ public UtmLogstashFilterService(UtmLogstashFilterRepository logstashFilterReposi
public UtmLogstashFilter save(UtmLogstashFilter logstashFilter) {
final String ctx = CLASSNAME + ".save";
try {
+ logstashFilter.setUpdatedAt(Instant.now());
logstashFilter.setSystemOwner(false);
return logstashFilterRepository.save(logstashFilter);
} catch (Exception e) {
diff --git a/backend/src/main/java/com/park/utmstack/service/util/PdfService.java b/backend/src/main/java/com/park/utmstack/service/util/PdfService.java
index 5441694b0..758ef9d5f 100644
--- a/backend/src/main/java/com/park/utmstack/service/util/PdfService.java
+++ b/backend/src/main/java/com/park/utmstack/service/util/PdfService.java
@@ -1,11 +1,10 @@
package com.park.utmstack.service.util;
import com.park.utmstack.config.Constants;
-import com.park.utmstack.service.compliance.ComplianceFileResponse;
import com.park.utmstack.service.dto.web_pdf.PdfServiceResponse;
-import com.park.utmstack.service.federation_service.UtmFederationServiceClientService;
import com.park.utmstack.service.web_clients.rest_template.RestTemplateService;
import com.park.utmstack.util.exceptions.ApiException;
+import lombok.RequiredArgsConstructor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
@@ -14,66 +13,17 @@
import org.springframework.transaction.annotation.Transactional;
import org.springframework.web.util.UriComponentsBuilder;
-import java.util.Objects;
-
/**
* Service Implementation for PDF generation.
*/
@Service
+@RequiredArgsConstructor
@Transactional
public class PdfService {
private final Logger log = LoggerFactory.getLogger(PdfService.class);
private static final String CLASSNAME = "PdfService";
- private final UtmFederationServiceClientService fsService;
private final RestTemplateService restTemplateService;
- private final String COMPLIANCE_EXPORT_URL = "/dashboard/export-compliance/";
-
- public PdfService(UtmFederationServiceClientService fsService,
- RestTemplateService restTemplateService) {
- this.fsService = fsService;
- this.restTemplateService = restTemplateService;
- }
-
- /**
- * Get pdf report in bytes array.
- *
- * @param url the url of the compliance report.
- * @return the pdf report in bytes array.
- */
- @Transactional(readOnly = true)
- public ResponseEntity getPdfReportByUrlInBytes(String url, String accessKey, String accessType) throws Exception{
- log.debug("Request to get UtmComplianceReportSchedule : {}", url);
- return ResponseEntity.ok().body(getPdf(Constants.FRONT_BASE_URL + url, accessKey, accessType));
- }
-
- /**
- * Method to get pdf in bytes
- */
- public byte[] getPdf(String url, String accessKey, String accessType) throws Exception {
- final String ctx = CLASSNAME + ".getPdf";
-
- String urlService = UriComponentsBuilder.fromUriString(Constants.PDF_SERVICE_URL)
- .queryParam("baseUrl", Constants.FRONT_BASE_URL)
- .queryParam("url", url)
- .queryParam("accessKey", accessKey)
- .queryParam("accessType", accessType)
- .build().toUriString();
-
- ResponseEntity rs = restTemplateService.get(urlService, ComplianceFileResponse.class);
- log.info("Requesting PDF creation to URL : {}", Constants.PDF_SERVICE_URL + "?url=" + url);
- if (!rs.getStatusCode().is2xxSuccessful()) {
- log.error(ctx + ": {}", restTemplateService.extractErrorMessage(rs));
- } else {
- byte[] pdfInBytes = Objects.requireNonNull(rs.getBody()).getPdfBytes();
- if (pdfInBytes != null && pdfInBytes.length > 0) {
- return pdfInBytes;
- } else {
- log.error(ctx + ": We couldn't generate the pdf, reason: No data returned from PDF service");
- }
- }
- return null;
- }
public PdfServiceResponse downloadPdf(String url, String accessKey, String accessType) {
final String ctx = CLASSNAME + ".getPdf";
diff --git a/backend/src/main/java/com/park/utmstack/service/web_clients/rest_template/RestTemplateService.java b/backend/src/main/java/com/park/utmstack/service/web_clients/rest_template/RestTemplateService.java
index 3cdbfa5be..233249c3b 100644
--- a/backend/src/main/java/com/park/utmstack/service/web_clients/rest_template/RestTemplateService.java
+++ b/backend/src/main/java/com/park/utmstack/service/web_clients/rest_template/RestTemplateService.java
@@ -54,6 +54,10 @@ public ResponseEntity getRaw(String url, Class type) {
return rawRestTemplate.exchange(url, HttpMethod.GET, requestEntity, type);
}
+ public ResponseEntity postRaw(String url, T body, Class type, HttpHeaders headers) {
+ HttpEntity requestEntity = new HttpEntity<>(body, headers);
+ return rawRestTemplate.exchange(url, HttpMethod.POST, requestEntity, type);
+ }
public ResponseEntity get(String url, Class type, HttpHeaders headers) throws Exception {
final String ctx = CLASSNAME + ".get";
diff --git a/backend/src/main/java/com/park/utmstack/web/rest/logstash_filter/UtmFilterResource.java b/backend/src/main/java/com/park/utmstack/web/rest/logstash_filter/UtmFilterResource.java
index b43929aa7..12060773c 100644
--- a/backend/src/main/java/com/park/utmstack/web/rest/logstash_filter/UtmFilterResource.java
+++ b/backend/src/main/java/com/park/utmstack/web/rest/logstash_filter/UtmFilterResource.java
@@ -72,7 +72,7 @@ public ResponseEntity createLogstashFilter(@Valid @RequestBod
// If you provide a pipelineId we create relation, otherwise only create the filter
if (pipelineId!=null) {
Optional pipeline = pipelineService.findOne(pipelineId);
- if (!pipeline.isPresent()) {
+ if (pipeline.isEmpty()) {
throw new Exception("The pipeline with ID (" + pipelineId + ") not exists");
}
UtmLogstashFilter filter = logstashFilterService.save(logstashFilter);
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260129002_update_filter_pfsense.xml b/backend/src/main/resources/config/liquibase/changelog/20260129002_update_filter_pfsense.xml
new file mode 100644
index 000000000..9316b44d6
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260129002_update_filter_pfsense.xml
@@ -0,0 +1,372 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.deviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}{{.iso8601Timezone}}'
+ - fieldName: log.syslogHost
+ pattern: '{{.hostname}}'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: raw
+ where: regexMatch("raw", "\\d{4}-\\d{2}-\\d{2}")
+
+ # Parsing syslog format date (OPNsense/pfSense)
+ - grok:
+ patterns:
+ - fieldName: log.priority
+ pattern: '\<{{.integer}}\>'
+ - fieldName: log.deviceTime
+ pattern: '{{.monthName}}{{.space}}{{.monthDay}}{{.space}}{{.time}}{{.space}}'
+ - fieldName: log.syslogHost
+ pattern: '{{.hostname}}{{.space}}'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: raw
+ where: regexMatch("raw", "<\\d+>[A-Z][a-z]{2}\\s+\\d{1,2}\\s+\\d{2}")
+
+ #......................................................................#
+ # Removing unnecessary characters of the syslogHeader
+ #......................................................................#
+ - trim:
+ function: prefix
+ substring: "<"
+ fields:
+ - log.priority
+ - trim:
+ function: suffix
+ substring: ">"
+ fields:
+ - log.priority
+
+ #......................................................................#
+ # Checking that the msgAll field exists
+ #......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.eventType
+ pattern: '{{.word}}'
+ - fieldName: log.pid
+ pattern: '(\[)?({{.integer}}?)(\])?(- -|:)'
+ - fieldName: log.csvMsg
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+
+ #......................................................................#
+ # Removing unnecessary characters
+ #......................................................................#
+ - trim:
+ function: prefix
+ substring: "["
+ fields:
+ - log.pid
+ - trim:
+ function: suffix
+ substring: "]:"
+ fields:
+ - log.pid
+
+ # ..........................................................................#
+ # Remove issues fileds
+ # ..........................................................................#
+ - delete:
+ fields:
+ - log.msgAll
+
+ #......................................................................#
+ # Using csv to parse the message
+ #......................................................................#
+ - csv:
+ source: log.csvMsg
+ separator: ","
+ headers:
+ - log.ruleNumber
+ - log.subRuleNumber
+ - log.anchor
+ - log.tracker
+ - log.realInterface
+ - log.reason
+ - log.action
+ - log.direction
+ - log.ipVersion
+ - log.ipv4Tos
+ - log.ipv4Ecn
+ - log.ipv4Ttl
+ - log.ipv4Id
+ - log.ipv4Offset
+ - log.ipv4Flags
+ - log.ipv4ProtocolId
+ - log.proto
+ - log.ipLength
+ - log.srcIp
+ - log.dstIp
+ - log.srcPort
+ - log.dstPort
+ - log.dataLength
+ - log.tcpFlags
+ - log.sequenceNumber
+ - log.ackNumber
+ - log.tcpWindow
+ - log.urg
+ - log.tcpOptions
+ where: regexMatch("log.csvMsg", "(.+),(\\s)?(match|\\w+),(block|pass),(in|out),(4|6),(.+)(tcp|TCP|Tcp)")
+
+ # .......................................................................#
+ - csv:
+ source: log.csvMsg
+ separator: ","
+ headers:
+ - log.ruleNumber
+ - log.subRuleNumber
+ - log.anchor
+ - log.tracker
+ - log.realInterface
+ - log.reason
+ - log.action
+ - log.direction
+ - log.ipVersion
+ - log.ipv4Tos
+ - log.ipv4Ecn
+ - log.ipv4Ttl
+ - log.ipv4Id
+ - log.ipv4Offset
+ - log.ipv4Flags
+ - log.ipv4ProtocolId
+ - log.proto
+ - log.ipLength
+ - log.srcIp
+ - log.dstIp
+ - log.srcPort
+ - log.dstPort
+ - log.dataLength
+ where: regexMatch("log.csvMsg", "(.+),(\\s)?(match|\\w+),(block|pass),(in|out),(4|6),(.+)(udp|UDP|Udp)")
+
+ #......................................................................#
+ - csv:
+ source: log.csvMsg
+ separator: ","
+ headers:
+ - log.ruleNumber
+ - log.subRuleNumber
+ - log.anchor
+ - log.tracker
+ - log.realInterface
+ - log.reason
+ - log.action
+ - log.direction
+ - log.ipVersion
+ - log.ipv4Tos
+ - log.ipv4Ecn
+ - log.ipv4Ttl
+ - log.ipv4Id
+ - log.ipv4Offset
+ - log.ipv4Flags
+ - log.ipv4ProtocolId
+ - log.proto
+ - log.ipLength
+ - log.srcIp
+ - log.dstIp
+ - log.icmpType
+ - log.icmpData1
+ - log.icmpData2
+ - log.icmpData3
+ - log.icmpData4
+ - log.icmpData5
+ where: regexMatch("log.csvMsg", "(.+),(\\s)?(match|\\w+),(block|pass),(in|out),(4|6),(.+)(icmp|ICMP|Icmp)")
+
+ #......................................................................#
+ - csv:
+ source: log.csvMsg
+ separator: ","
+ headers:
+ - log.ruleNumber
+ - log.subRuleNumber
+ - log.anchor
+ - log.tracker
+ - log.realInterface
+ - log.reason
+ - log.action
+ - log.direction
+ - log.ipVersion
+ - log.ipv6Class
+ - log.ipv6FlowLabel
+ - log.ipv6HopLimit
+ - log.proto
+ - log.ipv6ProtocolId
+ - log.ipLength
+ - log.srcIp
+ - log.dstIp
+ - log.srcPort
+ - log.dstPort
+ - log.dataLength
+ - log.tcpFlags
+ - log.sequenceNumber
+ - log.ackNumber
+ - log.tcpWindow
+ - log.urg
+ - log.tcpOptions
+ where: regexMatch("log.csvMsg", "(.+),(\\s)?(match|\\w+),(block|pass),(in|out),(6|17),(.+)(tcp|TCP|Tcp)")
+
+ #......................................................................#
+ - csv:
+ source: log.csvMsg
+ separator: ","
+ headers:
+ - log.ruleNumber
+ - log.subRuleNumber
+ - log.anchor
+ - log.tracker
+ - log.realInterface
+ - log.reason
+ - log.action
+ - log.direction
+ - log.ipVersion
+ - log.ipv6Class
+ - log.ipv6FlowLabel
+ - log.ipv6HopLimit
+ - log.proto
+ - log.ipv6ProtocolId
+ - log.ipLength
+ - log.srcIp
+ - log.dstIp
+ - log.srcPort
+ - log.dstPort
+ - log.dataLength
+ where: regexMatch("log.csvMsg", "(.+),(match|\\w+),(block|pass),(in|out),6,(.+)(udp|UDP|Udp)")
+
+ #......................................................................#
+ - csv:
+ source: log.csvMsg
+ separator: ","
+ headers:
+ - log.ruleNumber
+ - log.subRuleNumber
+ - log.anchor
+ - log.tracker
+ - log.realInterface
+ - log.reason
+ - log.action
+ - log.direction
+ - log.ipVersion
+ - log.ipv6Class
+ - log.ipv6FlowLabel
+ - log.ipv6HopLimit
+ - log.proto
+ - log.ipv6ProtocolId
+ - log.ipLength
+ - log.srcIp
+ - log.dstIp
+ - log.icmpType
+ - log.icmpData1
+ - log.icmpData2
+ - log.icmpData3
+ - log.icmpData4
+ - log.icmpData5
+ where: regexMatch("log.csvMsg", "(.+),(match|\\w+),(block|pass),(in|out),(6|17),(.+)(icmp|ICMP|Icmp)")
+
+ # ................................................#
+ # Rename fields
+ # ................................................#
+ - rename:
+ from:
+ - log.action
+ to: action
+
+ - rename:
+ from:
+ - log.proto
+ to: protocol
+
+ - rename:
+ from:
+ - log.srcIp
+ to: origin.ip
+
+ - rename:
+ from:
+ - log.dstIp
+ to: target.ip
+
+ - rename:
+ from:
+ - log.srcPort
+ to: origin.port
+
+ - rename:
+ from:
+ - log.dstPort
+ to: target.port
+
+ # ................................................#
+ # Fileds conversions
+ # ................................................#
+ - cast:
+ fields:
+ - origin.port
+ - target.port
+ to: int
+
+ # Adding geolocation to origin.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+
+ # Adding geolocation to target.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+
+ # ..........................................................................#
+ # Remove issues fileds
+ # ..........................................................................#
+ - delete:
+ fields:
+ - log.csvMsg
+
+$$
+ WHERE id=1522;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260202001_update_linux_auditing_module.xml b/backend/src/main/resources/config/liquibase/changelog/20260202001_update_linux_auditing_module.xml
new file mode 100644
index 000000000..f9c0a6b3a
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260202001_update_linux_auditing_module.xml
@@ -0,0 +1,16 @@
+
+
+
+
+
+
+
+
+ module_name = 'AUDITD'
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260202002_update_filter_crowdstrike.xml b/backend/src/main/resources/config/liquibase/changelog/20260202002_update_filter_crowdstrike.xml
new file mode 100644
index 000000000..57f700bf3
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260202002_update_filter_crowdstrike.xml
@@ -0,0 +1,330 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260204001_update_filter_o35_integration.xml b/backend/src/main/resources/config/liquibase/changelog/20260204001_update_filter_o35_integration.xml
new file mode 100644
index 000000000..a2041510d
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260204001_update_filter_o35_integration.xml
@@ -0,0 +1,125 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260204002_update_filter_sonic_wall_integration.xml b/backend/src/main/resources/config/liquibase/changelog/20260204002_update_filter_sonic_wall_integration.xml
new file mode 100644
index 000000000..dfa6f5070
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260204002_update_filter_sonic_wall_integration.xml
@@ -0,0 +1,549 @@
+
+
+
+
+
+ '
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.dvcTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}'
+ - fieldName: log.syslogHost
+ pattern: '{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.word}}\='
+ - fieldName: log.id
+ pattern: '{{.integer}}'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.dvcTime
+ pattern: '{{.monthName}}{{.space}}{{.monthDay}}{{.space}}{{.time}}'
+ - fieldName: log.srcIp
+ pattern: '{{.ipv4}}'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.priority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\='
+ - fieldName: log.device
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant1
+ pattern: '{{.data}}\='
+ - fieldName: log.sn
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant2
+ pattern: '{{.data}}\"'
+ - fieldName: log.dvcTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}'
+ - fieldName: log.irrelevant3
+ pattern: '{{.data}}\='
+ - fieldName: log.srcIp
+ pattern: '{{.ipv4}}'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: raw
+
+ # ......................................................................#
+ # Checking if the log is in CEF format
+ #......................................................................#
+ # Using grok to parse syslogHeader of the message
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.priority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.dvcTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}'
+ - fieldName: log.syslogHost
+ pattern: '{{.hostname}}'
+ - fieldName: log.formatType
+ pattern: '(CEF:)'
+ - fieldName: log.formatVersion
+ pattern: '(\s)?{{.integer}}'
+ - fieldName: log.cefMsgAll
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+ where: contains("log.msgAll", "CEF:")
+
+ - grok:
+ patterns:
+ - fieldName: log.dvcTime
+ pattern: '((?i)\b(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?:y)?|aug(?:ust)?|sep(?:tember)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)\b){{.space}}{{.monthDay}}{{.space}}{{.year}}{{.space}}{{.time}}'
+ - fieldName: log.sn
+ pattern: '{{.word}}'
+ - fieldName: log.formatType
+ pattern: '(CEF:)'
+ - fieldName: log.formatVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.cefMsgAll
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+ where: contains("log.msgAll", "CEF:")
+
+ #......................................................................#
+ # Removing unnecessary characters of the syslogHeader
+ #......................................................................#
+ - trim:
+ function: prefix
+ substring: "<"
+ fields:
+ - log.priority
+ - trim:
+ function: suffix
+ substring: ">"
+ fields:
+ - log.priority
+ - trim:
+ function: suffix
+ substring: ":"
+ fields:
+ - log.formatType
+
+ #......................................................................#
+ # Using grok to parse CEF fields
+ #......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.dvcVendor
+ pattern: '\|{{.data}}\|'
+ - fieldName: log.dvcProduct
+ pattern: '{{.data}}\|'
+ - fieldName: log.dvcVersion
+ pattern: '{{.data}}\|'
+ - fieldName: log.eventId
+ pattern: '{{.data}}\|'
+ - fieldName: log.eventName
+ pattern: '{{.data}}\|'
+ - fieldName: log.severity
+ pattern: '{{.data}}\|'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: log.cefMsgAll
+
+ - trim:
+ function: prefix
+ substring: "|"
+ fields:
+ - log.dvcVendor
+
+ - trim:
+ function: suffix
+ substring: "|"
+ fields:
+ - log.dvcVendor
+ - log.dvcProduct
+ - log.dvcVersion
+ - log.eventId
+ - log.eventName
+ - log.severity
+
+ # Using grok to extract values with spaces in fields
+ - grok:
+ patterns:
+ - fieldName: log.trash
+ pattern: '{{.data}}msg='
+ - fieldName: log.message
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.trash2
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.trash1
+ pattern: '{{.data}}ipscat='
+ - fieldName: log.ipscat1
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.trash3
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.trash4
+ pattern: '{{.data}}cs6='
+ - fieldName: log.cs61
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.trash5
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.trash6
+ pattern: '{{.data}}rule='
+ - fieldName: log.rule1
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.trash7
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.trash8
+ pattern: '{{.data}}Category='
+ - fieldName: log.category1
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.trash9
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.trash10
+ pattern: '{{.data}}note='
+ - fieldName: log.note1
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.trash11
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - log.message
+ - log.note1
+ - log.ipscat1
+ - log.cs61
+ - log.rule1
+ - log.category1
+ - log.fwaction
+
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - log.message
+ - log.note1
+ - log.ipscat1
+ - log.cs61
+ - log.rule1
+ - log.category1
+ - log.fwaction
+
+ #......................................................................#
+ # Using kv to parse msgAll components from syslog format only
+ #......................................................................#
+ - kv:
+ fieldSplit: " "
+ valueSplit: "="
+ source: log.msgAll
+
+ # ................................................#
+ # Rename fields
+ # ................................................#
+ - rename:
+ from:
+ - log.dst
+ to: target.ip
+ - rename:
+ from:
+ - log.dstname
+ to: target.host
+ - rename:
+ from:
+ - log.proto
+ to: protocol
+ - rename:
+ from:
+ - log.src
+ to: origin.ip
+ - rename:
+ from:
+ - log.fwaction
+ to: action
+ - rename:
+ from:
+ - log.dstMac
+ to: target.mac
+ - rename:
+ from:
+ - log.srcMac
+ to: origin.mac
+ - rename:
+ from:
+ - log.dmac
+ to: target.mac
+ - rename:
+ from:
+ - log.smac
+ to: origin.mac
+ - rename:
+ from:
+ - log.message
+ to: log.msg
+ - rename:
+ from:
+ - log.note1
+ to: log.note
+ - rename:
+ from:
+ - log.ipscat1
+ to: log.ipscat
+ - rename:
+ from:
+ - log.cs61
+ to: log.cs6
+ - rename:
+ from:
+ - log.rule1
+ to: log.rule
+ - rename:
+ from:
+ - log.category1
+ to: log.category
+
+ # .......................................................................#
+ # Fields conversions
+ # .......................................................................#
+ - cast:
+ fields:
+ - log.gcat
+ to: string
+
+ #......................................................................#
+ # Define Syslog Group Category (gcat) Values
+ #......................................................................#
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'System'
+ where: equals("log.gcat", "1")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Log'
+ where: equals("log.gcat", "2")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Security Services'
+ where: equals("log.gcat", "3")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Users'
+ where: equals("log.gcat", "4")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Firewall Settings'
+ where: equals("log.gcat", "5")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Network'
+ where: equals("log.gcat", "6")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'VPN'
+ where: equals("log.gcat", "7")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'High Availability'
+ where: equals("log.gcat", "8")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: '3G/4G, Modem, and Module'
+ where: equals("log.gcat", "9")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Firewall'
+ where: equals("log.gcat", "10")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Wireless'
+ where: equals("log.gcat", "11")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'VoIP'
+ where: equals("log.gcat", "12")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'SSL VPN'
+ where: equals("log.gcat", "13")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Anti-Spam'
+ where: equals("log.gcat", "14")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'WAN Acceleration'
+ where: equals("log.gcat", "15")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'SD-WAN'
+ where: equals("log.gcat", "16")
+
+ - add:
+ function: 'string'
+ params:
+ key: log.groupCategory
+ value: 'Multi-Tenancy'
+ where: equals("log.gcat", "17")
+
+ # Adding geolocation to origin.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+
+ # Adding geolocation to target.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+
+ # .......................................................................#
+ # Adding severity based on log.pri
+ # .......................................................................#
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.pri", ["0", "1", "2", "3"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: equals("log.pri", "4")
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.pri", ["5", "6", "7"])
+
+ # ..........................................................................#
+ # Removing unnuse fields
+ #.........................................................................#
+ - delete:
+ fields:
+ - log.irrelevant
+ - log.irrelevant1
+ - log.irrelevant2
+ - log.irrelevant3
+ - log.msgAll
+ - log.cefMsgAll
+ - log.pri
+ - log.gcat
+ - log.message
+ - log.note1
+ - log.ipscat1
+ - log.cs61
+ - log.rule1
+ - log.category1
+ - log.trash
+ - log.trash1
+ - log.trash2
+ - log.trash3
+ - log.trash4
+ - log.trash5
+ - log.trash6
+ - log.trash7
+ - log.trash8
+ - log.trash9
+ - log.trash10
+ - log.trash11
+
+$$
+
+ WHERE id=1511
+
+ ]]>
+
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260206001_update_filter_vmware_integration.xml b/backend/src/main/resources/config/liquibase/changelog/20260206001_update_filter_vmware_integration.xml
new file mode 100644
index 000000000..795c8363c
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260206001_update_filter_vmware_integration.xml
@@ -0,0 +1,153 @@
+
+
+
+
+
+ '
+ - fieldName: log.deviceTime
+ pattern: '{{.year}}(-){{.monthNumber}}(-){{.monthDay}}(T){{.time}}(Z)'
+ - fieldName: origin.hostname
+ pattern: '{{.hostname}}'
+ - fieldName: log.process
+ pattern: '{{.hostname}}(\:)'
+ - fieldName: severity
+ pattern: '{{.word}}'
+ - fieldName: log.processName
+ pattern: '{{.hostname}}'
+ - fieldName: log.pid
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.eventInfo
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+
+ - grok:
+ patterns:
+ - fieldName: log.priority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.deviceTime
+ pattern: '{{.year}}(-){{.monthNumber}}(-){{.monthDay}}(T){{.time}}(Z)'
+ - fieldName: origin.hostname
+ pattern: '{{.hostname}}'
+ - fieldName: log.process
+ pattern: '{{.hostname}}'
+ - fieldName: log.pid
+ pattern: '\[{{.data}}\]:'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+
+ - grok:
+ patterns:
+ - fieldName: log.priority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.deviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}T{{.time}}Z'
+ - fieldName: origin.hostname
+ pattern: '{{.hostname}}'
+ - fieldName: log.process
+ pattern: '{{.hostname}}'
+ - fieldName: log.pid
+ pattern: '\[{{.data}}\]:'
+ - fieldName: log.originIdComponent
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+
+ - grok:
+ patterns:
+ - fieldName: log.moduleIdentifier
+ pattern: '\[{{.data}}\@'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\='
+ - fieldName: log.subModuleIdentifier
+ pattern: '{{.word}}\]'
+ source: log.originIdComponent
+
+ # Removing unused caracters
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - log.priority
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.pid
+ - log.eventInfo
+ - log.moduleIdentifier
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.message
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - log.priority
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.pid
+ - log.process
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.pid
+ - log.eventInfo
+ - log.subModuleIdentifier
+ - trim:
+ function: suffix
+ substring: '-'
+ fields:
+ - log.message
+ - trim:
+ function: suffix
+ substring: '@'
+ fields:
+ - log.moduleIdentifier
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.processName
+ - log.irrelevant
+
+$$
+
+ WHERE id = 1001
+
+ ]]>
+
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260206002_update_filter_netflow_integration.xml b/backend/src/main/resources/config/liquibase/changelog/20260206002_update_filter_netflow_integration.xml
new file mode 100644
index 000000000..16de1655f
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260206002_update_filter_netflow_integration.xml
@@ -0,0 +1,297 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209001_update_filter_antivirus_esmc_eset.xml b/backend/src/main/resources/config/liquibase/changelog/20260209001_update_filter_antivirus_esmc_eset.xml
new file mode 100644
index 000000000..0ce039e32
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209001_update_filter_antivirus_esmc_eset.xml
@@ -0,0 +1,148 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.msgType
+ pattern: '{{.integer}}'
+ - fieldName: log.deviceTime
+ pattern: '{{.year}}(-){{.monthNumber}}(-){{.monthDay}}(T){{.time}}(Z)'
+ - fieldName: log.headHostname
+ pattern: '{{.hostname}}'
+ - fieldName: log.serviceName
+ pattern: '{{.hostname}}'
+ - fieldName: log.pid
+ pattern: '{{.integer}}'
+ - fieldName: log.restHead
+ pattern: '\-{{.data}}\-'
+ - fieldName: log.jsonMessage
+ pattern: '{{.greedy}}'
+
+ # Remove inecesarie caracters
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - log.priority
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - log.priority
+
+ # Parsing jsonMessage field log
+ - json:
+ source: log.jsonMessage
+
+ - rename:
+ from:
+ - log.ipv4
+ to: target.ip
+ - rename:
+ from:
+ - log.hostname
+ to: target.host
+ - rename:
+ from:
+ - log.action
+ to: action
+ - rename:
+ from:
+ - log.event
+ to: actionResult
+ - rename:
+ from:
+ - log.sourceaddress
+ to: origin.ip
+ - rename:
+ from:
+ - log.protocol
+ to: protocol
+ - rename:
+ from:
+ - log.sourceport
+ to: origin.port
+ - rename:
+ from:
+ - log.targetaddress
+ to: target.ip
+ - rename:
+ from:
+ - log.targetport
+ to: target.port
+
+ # Adding severity field based on log.severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severity", ["INFO", "Info"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: oneOf("log.severity", ["WARNING", "Warning"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severity", ["ERROR", "Error"])
+
+ # Adding geolocation to origin.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+
+ # Adding geolocation to target.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.jsonMessage
+ - log.severity$$
+ WHERE id=1501;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209002_update_filter_apache.xml b/backend/src/main/resources/config/liquibase/changelog/20260209002_update_filter_apache.xml
new file mode 100644
index 000000000..811ee863a
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209002_update_filter_apache.xml
@@ -0,0 +1,249 @@
+
+
+
+
+
+
+ fileset: datatype
+# access: plain text
+# 1. Parsing the json from beats
+# 2. Parsing the message field containing the apache log
+pipeline:
+ - dataTypes:
+ - apache
+ steps:
+ - json:
+ source: raw
+ - rename:
+ from:
+ - log.url
+ to: origin.url
+ - rename:
+ from:
+ - log.log.file.path
+ to: origin.file
+ - rename:
+ from:
+ - log.host.ip
+ to: log.local.ips
+ - rename:
+ from:
+ - log.host.mac
+ to: log.local.macs
+ - rename:
+ from:
+ - log.host.hostname
+ to: origin.host
+ - rename:
+ from:
+ - log.event.dataset
+ to: action
+ - rename:
+ from:
+ - log.agent.version
+ to: log.agentVersion
+ - rename:
+ from:
+ - log.host.os.kernel
+ to: log.osVersion
+ - rename:
+ from:
+ - log.host.os.type
+ to: log.osType
+ - rename:
+ from:
+ - log.host.architecture
+ to: log.cpuArchitecture
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.ips
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.macs
+ # Common apache log parsing
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}'
+ - fieldName: log.userIdent
+ pattern: '{{.word}}|(-)'
+ - fieldName: origin.user
+ pattern: '{{.word}}|(-)'
+ - fieldName: deviceTime
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.request
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.statusCode
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.message
+ # Parsing Common and Combined end of apache log
+ # Common
+ - grok:
+ patterns:
+ - fieldName: origin.bytesReceived
+ pattern: '{{.integer}}|(-)'
+ source: log.rest
+ # Combined
+ - grok:
+ patterns:
+ - fieldName: origin.bytesReceived
+ pattern: '{{.integer}}|(-)'
+ - fieldName: log.referer
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.userAgent
+ pattern: '\"(.*)\"'
+ source: log.rest
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - deviceTime
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - deviceTime
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - log.request
+ - log.referer
+ - log.userAgent
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - log.request
+ - log.referer
+ - log.userAgent
+ # Extracting request parts
+ - grok:
+ patterns:
+ - fieldName: log.method
+ pattern: '{{.word}}'
+ - fieldName: "origin.path"
+ pattern: '(.*)\s+'
+ - fieldName: protocol
+ pattern: '{{.greedy}}'
+ source: log.request
+ # Extracting protocol version
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.data}}/'
+ - fieldName: log.protoVersion
+ pattern: '{{.greedy}}'
+ source: protocol
+ where: exists("protocol")
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - protocol
+ where: exists("protocol")
+ # Adding geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ # Normalizing request method and renaming to action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'get'
+ where: equals("log.method", "GET")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'post'
+ where: equals("log.method", "POST")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'put'
+ where: equals("log.method", "PUT")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'delete'
+ where: equals("log.method", "DELETE")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'patch'
+ where: equals("log.method", "PATCH")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'request'
+ where: equals("log.method", "REQUEST")
+ # Removing log.method if action was set
+ - delete:
+ fields:
+ - log.method
+ where: exists("action")
+ # Reformat and field conversions
+ - cast:
+ fields:
+ - log.statusCode
+ - origin.bytesReceived
+ to: float
+ - reformat:
+ fields:
+ - deviceTime
+ function: time
+ fromFormat: '14/Feb/2022:15:40:53 -0500'
+ toFormat: '2024-09-23T15:57:40.338364445Z'
+ # Adding actionResult
+ # denied by default
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: (greaterOrEqual("log.statusCode", 200) && lessOrEqual("log.statusCode", 299)) || (greaterOrEqual("log.statusCode", 300) && lessOrEqual("log.statusCode", 399) && greaterThan("origin.bytesReceived", 0))
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.service
+ - log.metadata
+ - log.agent
+ - log.host
+ - log.event
+ - log.ecs
+ - log.log
+ - log.rest
+ - log.fileset$$
+ WHERE id=1412;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209003_update_filter_azure.xml b/backend/src/main/resources/config/liquibase/changelog/20260209003_update_filter_azure.xml
new file mode 100644
index 000000000..775f8beeb
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209003_update_filter_azure.xml
@@ -0,0 +1,738 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209004_update_filter_cisco_asa.xml b/backend/src/main/resources/config/liquibase/changelog/20260209004_update_filter_cisco_asa.xml
new file mode 100644
index 000000000..b644c4055
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209004_update_filter_cisco_asa.xml
@@ -0,0 +1,5936 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field containing the Cisco ASA log
+pipeline:
+ - dataTypes:
+ - firewall-cisco-asa
+ steps:
+ # Common ASA fields
+ - grok:
+ patterns:
+ - fieldName: log.syslogPri
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '({{.day}}\s)?{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.asaHeader
+ pattern: '{{.data}}ASA-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '({{.day}}\s)?{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.asaHeader
+ pattern: '{{.data}}ASA-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ #......................................................................#
+ # Adding log.localIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localIp
+ destination: log.localIp.geolocation
+ where: exists("log.localIp")
+ # Removing unwanted prefixes
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.messageId
+ # Field conversions
+ - cast:
+ fields:
+ - log.messageId
+ to: int
+ # Begining specific message parsing
+ #......................................................................#
+ # ASA-2-106001
+ - grok:
+ patterns:
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'flags'
+ - fieldName: log.flags
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106001
+
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==106001
+
+ #......................................................................#
+ #ASA-2-106017
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sdue\sto'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ source: log.msg
+ where: log.messageId==106017
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId==106017
+ #......................................................................#
+ # ASA-1-106021
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106021
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId==106021
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==106021
+ #......................................................................#
+ # ASA-2-106101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Number of cached deny-flows for ACL log has reached limit'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106101
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Number of cached'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==106101
+ # Parsing the limit number
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.numFlows
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==106101
+ # Field conversions
+ - cast:
+ fields:
+ - log.numFlows
+ to: int
+ where: log.messageId==106101
+
+ #......................................................................#
+ # ASA-6-106102,106103
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106102 || log.messageId==106103
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==106102 || log.messageId==106103
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("actionResult", "Permitted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && !equalsIgnoreCase("actionResult", "Permitted")
+ #......................................................................#
+ # ASA-4-109017
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'User at'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'exceeded auth proxy connection limit'
+ - fieldName: log.limit
+ pattern: '\({{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109017
+
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.limit
+ where: log.messageId==109017
+ - cast:
+ fields:
+ - log.limit
+ to: int
+ where: log.messageId==109017
+ #......................................................................#
+ # ASA-6-109101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA disconnect request'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with\saudit-session-id:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109101
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==109101
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: log.messageId==109101
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==109101
+ #......................................................................#
+ # ASA-4-109102
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ', but cannot find named session'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109102
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==109102
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==109102
+ #......................................................................#
+ # ASA-3-109103
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'failed for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with session ID:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109103
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==109103
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: log.messageId==109103
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==109103
+ #......................................................................#
+ # ASA-109201 to 109213
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'UAUTH(:)? Session(\s|=)'
+ - fieldName: log.session
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'User(\s|=)'
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Assigned IP(\s|=)'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId>=109201 && log.messageId<=109213
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.session
+ - origin.user
+ where: log.messageId>=109201 && log.messageId<=109213
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId>=109201 && log.messageId<=109213
+ #......................................................................#
+ # ASA-6-113004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user {{.word}} Successful'
+ - fieldName: log.irrelevant
+ pattern: '\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113004
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user {{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113004
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - target.ip
+ where: log.messageId==113004
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - target.ip
+ where: log.messageId==113004
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113004
+ #......................................................................#
+ # ASA-6-113005
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(server|Server)(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113005
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113005
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: log.messageId==113005
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113005
+ #......................................................................#
+ # ASA-6-113008
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA transaction status ACCEPT(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113008
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113008
+ #......................................................................#
+ # ASA-6-113009
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113009
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: log.messageId==113009
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: log.messageId==113009
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113009
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: log.messageId==113009
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113009
+ #......................................................................#
+ # ASA-6-113010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA challenge received for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}) from server'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113010
+ - trim:
+ function: suffix
+ substring: 'from server'
+ fields:
+ - origin.user
+ where: log.messageId==113010
+ #......................................................................#
+ # ASA-6-113011
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113011
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: log.messageId==113011
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: log.messageId==113011
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113011
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: log.messageId==113011
+ #......................................................................#
+ # ASA-6-113012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Successful(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?local database(\s)?:(\s)?user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113012
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113012
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113012
+ #......................................................................#
+ # ASA-6-113013
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA unable to complete the request'
+ - fieldName: log.irrelevant
+ pattern: 'Error(\s)?:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}\:'
+ - fieldName: log.irrelevant
+ pattern: 'user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113013
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ where: log.messageId==113013
+ #......................................................................#
+ # ASA-6-113014
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA authentication server not accessible(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113014
+ #......................................................................#
+ # ASA-6-113015, 113017
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(AAA user authentication|AAA credentials)\s(R|r)ejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'local database(\s)?:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113015 || log.messageId==113017
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - origin.user
+ where: log.messageId==113015 || log.messageId==113017
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(AAA user authentication|AAA credentials)\s'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113015 || log.messageId==113017
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113015 || log.messageId==113017
+ #......................................................................#
+ # ASA-6-113016
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA credentials rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113016
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: log.messageId==113016
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA credentials'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113016
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113016
+ #......................................................................#
+ # ASA-4-113019
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?=(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)sername(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: action
+ pattern: '(\s)?Session disconnected\.'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Session Type:(\s)?'
+ - fieldName: log.sessionType
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Duration:(\s)?'
+ - fieldName: log.duration
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes xmt:(\s)?'
+ - fieldName: origin.bytesSent
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes rcv:(\s)?'
+ - fieldName: origin.bytesReceived
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Reason:(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113019
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ - log.sessionType
+ - log.duration
+ - origin.bytesSent
+ - origin.bytesReceived
+ where: log.messageId==113019
+ - cast:
+ fields:
+ - origin.bytesSent
+ - origin.bytesReceived
+ to: int
+ where: log.messageId==113019
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113019
+ #......................................................................#
+ # ASA-113031,113032,113033
+ # Common fields
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ # Specific fields
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.filter
+ pattern: '{{.data}}\sis'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'is'
+ fields:
+ - log.filter
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ #......................................................................#
+ # ASA-113034,113035,113036,113038,113039
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '(\<)?{{.data}}(\>)?\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|(\<)?{{.data}}(\>)?)(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113035 || log.messageId==113038
+ #......................................................................#
+ # ASA-4-113042
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA: Non-HTTP connection from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: log.remoteUser
+ pattern: '(''{{.data}}''|{{.data}})(\s)?at'
+ - fieldName: log.remoteIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: 'at'
+ fields:
+ - log.remoteUser
+ where: log.messageId==113042
+ #......................................................................#
+ # ASA-2-201003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit exceeded'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.globalIp
+ pattern: '\({{.data}}\)'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.dstInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==201003
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.globalIp
+ where: log.messageId==201003
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.globalIp
+ where: log.messageId==201003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==201003
+ #......................................................................#
+ # ASA-4-209003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Fragment database limit of'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'exceeded:(\s)?src(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'dest(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'proto(\s)?=(\s)?'
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'id(\s)?=(\s)?'
+ - fieldName: log.id
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==209003
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.ip
+ - target.ip
+ - protocol
+ where: log.messageId==209003
+ - cast:
+ fields:
+ - log.limit
+ to: int
+ where: log.messageId==209003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==209003
+ #......................................................................#
+ # ASA-3-316001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Denied new tunnel'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==316001
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==316001
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==316001
+ #......................................................................#
+ # ASA-3-316002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'VPN Handle error'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?protocol='
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'src\s'
+ - fieldName: log.inIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?dst'
+ - fieldName: log.outIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==316002
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - protocol
+ where: log.messageId==316002
+ - cast:
+ fields:
+ - log.inIfNum
+ - log.outIfNum
+ to: int
+ where: log.messageId==316002
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==316002
+ #......................................................................#
+ # ASA-302003,302004
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.irrelevant
+ pattern: '(to\s)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: log.messageId==302003 || log.messageId==302004
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: log.messageId==302003 || log.messageId==302004
+ # Parsing from/to ip and port
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpToip
+ where: log.messageId==302003 || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpToip
+ where: log.messageId==302003 || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '{{.greedy}}'
+ source: log.tmpFromip
+ where: log.messageId==302003 || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpFromip
+ where: log.messageId==302003 || log.messageId==302004
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==302003 || log.messageId==302004
+ # Removing temp fields
+ - delete:
+ fields:
+ - log.tmpFromip
+ - log.tmpToip
+ where: log.messageId==302003 || log.messageId==302004
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302003 || log.messageId==302004
+ #......................................................................#
+ # ASA-6-302012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Pre-allocate H225 Call Signalling Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '/(\s)?{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to laddr'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302012
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ where: log.messageId==302012
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302012
+ #......................................................................#
+ # ASA-6-302013
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302013
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: log.messageId==302013
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302013
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302013
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302013
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302013
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: log.messageId==302013
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302013
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302013
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302013
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302013
+ #......................................................................#
+ # ASA-6-302014
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302014
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302014
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302014
+ # Parsing AAA user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302014
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302014
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302014
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302014
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302014
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302014
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302014
+ #......................................................................#
+ # ASA-6-302015
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302015
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: log.messageId==302015
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302015
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302015
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302015
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302015
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: log.messageId==302015
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302015
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302015
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302015
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302015
+ #......................................................................#
+ # ASA-6-302016
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302016
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302016
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302016
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: log.messageId==302016
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302016
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302016
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302016
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302016
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302016
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302016
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302016
+ #......................................................................#
+ # ASA-6-302017
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302017
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302017
+ # Parsing translatedCid and, firewall user to and AAA user if present
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpUserInfo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==302017
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302017
+ # FW user and AAA user
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ - fieldName: target.user
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: log.messageId==302017
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: log.messageId==302017
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - target.user
+ - log.translatedCid
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ - target.user
+ where: log.messageId==302017
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpUserInfo
+ where: log.messageId==302017
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302017
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302017
+ #......................................................................#
+ # ASA-6-302018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302018
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302018
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302018
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: log.messageId==302018
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302018
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.translatedCid
+ where: log.messageId==302018
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302018
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ where: log.messageId==302018
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302018
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: log.messageId==302018
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302018
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302018
+ #......................................................................#
+ # ASA-6-302020, 302021
+ # 302020
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302020
+ # 302021
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302021
+ # Common parsing for 302020 and 302021
+ # For parsing faddr and fwuser from (Begin with ip/port), or icmpSeqNum
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # icmpSeqNum variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Cleaning icmpSeqNum
+ - trim:
+ function: suffix
+ substring: 'gaddr'
+ fields:
+ - log.icmpSeqNum
+ where: log.messageId==302020 || log.messageId==302021
+ # Continue with firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302020 || log.messageId==302021
+ # For parsing gaddr and global fwuser (Begin with ip/port), or icmpType
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.globalPort
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # icmpType variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Cleaning icmpType
+ - trim:
+ function: suffix
+ substring: 'laddr'
+ fields:
+ - log.icmpType
+ where: log.messageId==302020 || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: 'code'
+ fields:
+ - log.icmpType
+ where: log.messageId==302020 || log.messageId==302021
+ # Continue with global firewall
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.globalFirewallUser
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserGlobal
+ where: log.messageId==302020 || log.messageId==302021
+ # For parsing laddr and fwuser to (Begin with ip/port)
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Continue with firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302020 || log.messageId==302021
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - origin.ip
+ where: log.messageId==302020 || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - log.globalFirewallUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpFwUserGlobal
+ - log.tmpFaddrAndFwUser
+ - log.tmpGaddrAndFwUser
+ - log.tmpLaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302020 || log.messageId==302021
+ #......................................................................#
+ # ASA-6-302022, 302024, 302026
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.role
+ pattern: '({{.data}})stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortTo
+ pattern: '\({{.data}}\)'
+ source: log.msg
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port to, from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'stub'
+ fields:
+ - log.role
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpMappedIpPortFrom
+ - log.tmpMappedIpPortTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ #......................................................................#
+ # ASA-6-302023, 302025, 302027
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ #......................................................................#
+ # ASA-302033,302034
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Pre-allocated|Unable to pre-allocate) H323 GUP Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.tmpPortFrom
+ pattern: '{{.data}}to laddr'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.tmpIpPortTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302033 || log.messageId==302034
+ # Parsing optional ports from y to
+ - grok:
+ patterns:
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpPortFrom
+ where: log.messageId==302033 || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpIpPortTo
+ where: log.messageId==302033 || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ source: log.tmpIpPortTo
+ where: log.messageId==302033 || log.messageId==302034
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302033 || log.messageId==302034
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302033 || log.messageId==302034
+ # Remove tmp fields
+ - delete:
+ fields:
+ - log.tmpPortFrom
+ - log.tmpIpPortTo
+ where: log.messageId==302033 || log.messageId==302034
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302033
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==302034
+ #......................................................................#
+ #ASA-6-302035
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}\s{{.word}}\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302035
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: log.messageId==302035
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302035
+ # Parsing port to, firewall user to, and, from user
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==302035
+ # Without user info
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.rest
+ where: log.messageId==302035
+ # Parsing firewall user to
+ # With origin.user
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302035
+ # Without origin.user
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302035
+
+ # Decoding outside and inside sg_info
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserFrom
+ where: log.messageId==302035
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserTo
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.insideSgInfo
+ - log.outsideSgInfo
+ where: log.messageId==302035
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302035
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302035
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302035
+ #......................................................................#
+ # ASA-6-302036
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302036
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302036
+ # Decoding outside and inside firewall user, and sg_info
+ # Side from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302036
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302036
+ # Side to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302036
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302036
+ # Parsing origin.user from log.reason field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.reason
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302036
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302036
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302036
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302036
+ #......................................................................#
+ # ASA-6-302303
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302303
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302303
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302303
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302303
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302303
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302303
+ #......................................................................#
+ # ASA-6-302304
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302304
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302304
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302304
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302304
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302304
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302304
+ #......................................................................#
+ # ASA-6-302305
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302305
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302305
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302305
+ # Parsing port to, firewall user to, and, from user
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==302305
+ # Without user info
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.rest
+ where: log.messageId==302305
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302305
+
+ # Decoding outside and inside sg_info
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserFrom
+ where: log.messageId==302305
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserTo
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.insideSgInfo
+ - log.outsideSgInfo
+ where: log.messageId==302305
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302305
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302305
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302305
+ #......................................................................#
+ # ASA-6-302306
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302306
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302306
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302306
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302306
+
+ # Decoding outside and inside sg_info
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserFrom
+ where: log.messageId==302306
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserTo
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - log.insideSgInfo
+ - log.outsideSgInfo
+ where: log.messageId==302306
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302306
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302306
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302306
+ #......................................................................#
+ # ASA-6-305009
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.mappedIpTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==305009
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305009
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305009
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305009
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: log.messageId==305009
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: log.messageId==305009
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305009
+ #......................................................................#
+ # ASA-6-305010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: log.messageId==305010
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305010
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: log.messageId==305010
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305010
+ #......................................................................#
+ # ASA-6-305011
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: log.messageId==305011
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305011
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==305011
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: log.messageId==305011
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ where: log.messageId==305011
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305011
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==305011
+ #......................................................................#
+ # ASA-6-305012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: log.messageId==305012
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305012
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==305012
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305012
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305012
+ # Parsing srcInterface from himself to avoid parsing issues
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.srcInterface
+ where: log.messageId==305012
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: log.messageId==305012
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ where: log.messageId==305012
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305012
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: log.messageId==305012
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==305012
+ #......................................................................#
+ # ASA-3-322001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sMAC\saddress'
+ - fieldName: log.localMac
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.reason
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==322001
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==322001
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.localMac
+ where: log.messageId==322001
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - log.reason
+ where: log.messageId==322001
+ #......................................................................#
+ # ASA-3-322002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.boudSrcMac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==322002
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: log.messageId==322002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: log.messageId==322002
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: log.messageId==322002
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: log.messageId==322002
+ #......................................................................#
+ # ASA-3-322003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==322003
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: log.messageId==322003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: log.messageId==322003
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: log.messageId==322003
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: log.messageId==322003
+ #......................................................................#
+ # ASA-4-400000 to 400050
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPS\:(\s)?'
+ - fieldName: log.signatureId
+ pattern: '{{.integer}}'
+ - fieldName: action
+ pattern: '{{.data}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId>=400000 && log.messageId<=400050
+ # Cleaning action before extract protocol
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId>=400000 && log.messageId<=400050
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: (log.messageId>=400000 && log.messageId<=400022) || (log.messageId>=400026 && log.messageId<=400040)
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==400023 || log.messageId==400024 || log.messageId==400041
+ #......................................................................#
+ # ASA-4-402114
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402114
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402114
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402114
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ where: log.messageId==402114
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402114
+ #......................................................................#
+ # ASA-4-402115
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\sa\spacket'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'containing'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'data instead of'
+ - fieldName: log.expectedProtocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402115
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402115
+ #......................................................................#
+ # ASA-4-402116
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktDestAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktSrcAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktProto
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.localProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyPort
+ pattern: '{{.data}}and'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.remoteProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyPort
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402116
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402116
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.localProxyIpAddr
+ - log.localProxyIpMask
+ - log.localProxyProto
+ - log.remoteProxyIpAddr
+ - log.remoteProxyIpMask
+ - log.remoteProxyPort
+ - log.remoteProxyProto
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: 'and'
+ fields:
+ - log.localProxyPort
+ where: log.messageId==402116
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402116
+ #......................................................................#
+ # ASA-4-402117
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received a non-IPsec \((\s)?{{.word}}(\s)?\) packet'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402117
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received a non-IPsec \('
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402117
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402117
+ #......................................................................#
+ # ASA-4-402118
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}length'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'with offset'
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: log.messageId==402118
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402118
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402118
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402118
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402118
+ #......................................................................#
+ # ASA-4-402119, 402120
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402119 || log.messageId==402120
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402119 || log.messageId==402120
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402119 || log.messageId==402120
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402119 || log.messageId==402120
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402119 || log.messageId==402120
+ #......................................................................#
+ # ASA-5-402128
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CRYPTO\:(\s)?'
+ - fieldName: action
+ pattern: 'An attempt to allocate a large memory block'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memorySize
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memoryLimit
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: log.messageId==402128
+ #......................................................................#
+ # ASA-4-405001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received ARP (request|response) collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}with'
+ - fieldName: log.irrelevant
+ pattern: 'existing ARP entry'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.mac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==405001
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ARP'
+ where: log.messageId==405001
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==405001
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: log.messageId==405001
+ - trim:
+ function: suffix
+ substring: 'with'
+ fields:
+ - log.srcInterface
+ where: log.messageId==405001
+ #......................................................................#
+ # ASA-4-405002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received mac mismatch collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==405002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - origin.mac
+ where: log.messageId==405002
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: log.messageId==405002
+ #......................................................................#
+ # ASA-4-406001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command low port(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==406001
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: log.messageId==406001
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: log.messageId==406001
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: log.messageId==406001
+ #......................................................................#
+ # ASA-4-406002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command different address(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.connectionIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==406002
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: log.messageId==406002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: log.messageId==406002
+ #......................................................................#
+ # ASA-4-407002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit {{.data}} for through connections exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\.'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==407002
+ # Connection number and connection limit
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Embryonic limit'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==407002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==407002
+ #......................................................................#
+ # ASA-6-603109
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown PPPOE Tunnel'
+ - fieldName: log.irrelevant
+ pattern: 'at'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'tunnel-id(\s)?=(\s)?'
+ - fieldName: log.tunnelId
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'remote-peer(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==603109
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==603109
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.srcInterface
+ - log.tunnelId
+ where: log.messageId==603109
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==603109
+ #......................................................................#
+ # ASA-6-605004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Login\s{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.service
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'user'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==605004
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Login'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ source: action
+ where: log.messageId==605004
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==605004
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==605004
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.service
+ where: log.messageId==605004
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: log.messageId==605004
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - origin.user
+ where: log.messageId==605004
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - origin.user
+ where: log.messageId==605004
+ #......................................................................#
+ # ASA-6-617100
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown {{.integer}} connection(\s)?(\(s\))?'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==617100
+ # Connection number
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==617100
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==617100
+ #......................................................................#
+ # ASA-2-106018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'ICMP packet'
+ - fieldName: log.irrelevant
+ pattern: 'type'
+ - fieldName: log.icmpType
+ pattern: '{{.data}}\s'
+ - fieldName: log.ciscoResult
+ pattern: 'denied'
+ - fieldName: log.irrelevant
+ pattern: 'by'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}src'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'dest'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106018
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ICMP'
+ where: log.messageId==106018
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - log.accessList
+ where: log.messageId==106018
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==106018
+ #......................................................................#
+ # ASA-2-106020
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Deny IP teardrop fragment'
+ - fieldName: log.irrelevant
+ pattern: '\((\s)?size(\s)?='
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?offset(\s)?='
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)(\s)?from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106020
+ # Adding log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: log.ciscoResult
+ value: 'Denied'
+ where: log.messageId==106020
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==106020
+ #......................................................................#
+ # ASA-6-611301
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with no split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611301
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: log.messageId==611301
+ #......................................................................#
+ # ASA-6-611303
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611303
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: log.messageId==611303
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==611303
+ #......................................................................#
+ # ASA-6-611304
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT exemption configured for Network Extension Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611304
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: log.messageId==611304
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==611304
+ #......................................................................#
+ # ASA-6-611307
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Head end\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611307
+ # Adding action and log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'The VPN client is connected to the specified headend'
+ where: log.messageId==611307
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611307
+ #......................................................................#
+ # ASA-6-611309
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'Disconnecting from head end and uninstalling previously downloaded policy'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}End\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611309
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611309
+ #......................................................................#
+ # ASA-6-611310,611311
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'XAUTH'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?Peer(\s)?\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611310 || log.messageId==611311
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611310
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==611311
+ #......................................................................#
+ # ASA-6-611314
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Load Balancing Cluster with Virtual IP\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}server'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611314
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Load Balancing Cluster redirected the Secure Firewall'
+ where: log.messageId==611314
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611314
+ #......................................................................#
+ # ASA-6-611315
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Disconnecting from Load Balancing Cluster member(\:)?(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611315
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Disconnecting from Load Balancing Cluster'
+ where: log.messageId==611315
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611315
+ #......................................................................#
+ # ASA-6-611318
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'User Authentication Enabled'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}IP(\s)?\:'
+ - fieldName: log.authServerIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Port(\s)?\:'
+ - fieldName: log.authServerPort
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}out(\s)?\:'
+ - fieldName: log.timeOut
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611318
+ #......................................................................#
+ # ASA-3-710003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(TCP|UDP) access denied by ACL'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==710003
+ # Protocol and log.ciscoResult
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==710003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==710003
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: log.messageId==710003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==710003
+ #......................................................................#
+ # ASA-5-713252,713253
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Username(\s)?='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}available(\.)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==713252 || log.messageId==713253
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==713252 || log.messageId==713253
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==713252 || log.messageId==713253
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==713252 || log.messageId==713253
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==713252
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==713253
+ #......................................................................#
+ # ASA-6-716001,716002,716003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==716001 || log.messageId==716002
+ #......................................................................#
+ # ASA-6-716004,716005,716006,716007,716009
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==716004 || log.messageId==716007 || log.messageId==716009
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==716006
+ #......................................................................#
+ # ASA-6-716038
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716038
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==716038
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==716038
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716038
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ where: log.messageId==716038
+ #......................................................................#
+ # ASA-6-716039
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==716039
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ - origin.user
+ where: log.messageId==716039
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - origin.group
+ where: log.messageId==716039
+ #......................................................................#
+ # ASA-6-719017,719019,719020,719021,719022,719023
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==719017 || (log.messageId>=719019 && log.messageId<=719023)
+ # Adding log.ciscoResult and modifying some actions
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==719019 || log.messageId==719023
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==719020 || log.messageId==719022
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user is not checked against ACL'
+ where: log.messageId==719021
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has been authenticated'
+ where: log.messageId==719022
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has not been authenticated'
+ where: log.messageId==719023
+ # Cleaning fields
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==719017 || (log.messageId>=719019 && log.messageId<=719023)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==719017 || (log.messageId>=719019 && log.messageId<=719023)
+ #......................................................................#
+ # ASA-6-719018
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'ACL ID'
+ - fieldName: log.accessList
+ pattern: '{{.data}}not'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==719018
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==719018
+ - trim:
+ function: suffix
+ substring: 'not'
+ fields:
+ - log.accessList
+ where: log.messageId==719018
+ #......................................................................#
+ # ASA-6-719024
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Email Proxy piggyback auth fail'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.sessionPointer
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}}addr'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==719024
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - log.sessionPointer
+ where: log.messageId==719024
+ - trim:
+ function: suffix
+ substring: 'addr'
+ fields:
+ - origin.user
+ where: log.messageId==719024
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==719024
+ #......................................................................#
+ # ASA-7-609002
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown local-host'
+ - fieldName: log.zoneName
+ pattern: '{{.data}}/'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==609002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.zoneName
+ where: log.messageId==609002
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==609002
+ #......................................................................#
+ # ASA-6-611305
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient(\s)?\:'
+ - fieldName: action
+ pattern: 'DHCP Policy installed'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.primaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.secondaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.primaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.secondaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611305
+ #......................................................................#
+ # ASA-4-733100
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==733100
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: log.messageId==733100
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.data}}drop'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==733100
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'drop'
+ fields:
+ - log.dropSourceObject
+ where: log.messageId==733100
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.dropSourceObject
+ where: log.messageId==733100
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.dropSourceObject
+ where: log.messageId==733100
+ #......................................................................#
+ # ASA-4-733101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}(targeted|attacking)'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==733101
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: log.messageId==733101
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.word}}'
+ - fieldName: log.tmpIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==733101
+ # Renaming from or to ip, according to -> if (targeted|attacking)
+ - rename:
+ from:
+ - log.tmpIp
+ to: origin.ip
+ where: log.messageId==733101 && action.contains("attacking")
+ - rename:
+ from:
+ - log.tmpIp
+ to: target.ip
+ where: log.messageId==733101 && action.contains("targeted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==733101
+ #......................................................................#
+ # ASA-4-733102, 733103
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}host'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==733102 || log.messageId==733103
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection add host to shun list'
+ where: (equals("log.messageId", 733102) || equals("log.messageId", 733103)) && contains("log.msg", "add")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection removes host to shun list'
+ where: (equals("log.messageId", 733102) || equals("log.messageId", 733103)) && contains("log.msg", "removes")
+ #......................................................................#
+ # Decoding severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severity", ["1", "2", "3"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: log.severity=="4"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severity", ["5", "6", "7"])
+ #......................................................................#
+ # Adding common geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+ # Adding log.mappedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpFrom
+ destination: log.mappedIpFrom.geolocation
+ where: exists("log.mappedIpFrom")
+ # Adding log.mappedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpTo
+ destination: log.mappedIpTo.geolocation
+ where: exists("log.mappedIpTo")
+ # Adding log.translatedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpFrom
+ destination: log.translatedIpFrom.geolocation
+ where: exists("log.translatedIpFrom")
+ # Adding log.translatedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpTo
+ destination: log.translatedIpTo.geolocation
+ where: exists("log.translatedIpTo")
+ # Adding log.globalIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.globalIp
+ destination: log.globalIp.geolocation
+ where: exists("log.globalIp")
+ # Adding log.remoteIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteIp
+ destination: log.remoteIp.geolocation
+ where: exists("log.remoteIp")
+ # Adding log.mappedIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIp
+ destination: log.mappedIp.geolocation
+ where: exists("log.mappedIp")
+ # Adding log.decapsulatedPktDestAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktDestAddr
+ destination: log.decapsulatedPktDestAddr.geolocation
+ where: exists("log.decapsulatedPktDestAddr")
+ # Adding log.decapsulatedPktSrcAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktSrcAddr
+ destination: log.decapsulatedPktSrcAddr.geolocation
+ where: exists("log.decapsulatedPktSrcAddr")
+ # Adding log.localProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localProxyIpAddr
+ destination: log.localProxyIpAddr.geolocation
+ where: exists("log.localProxyIpAddr")
+ # Adding log.remoteProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteProxyIpAddr
+ destination: log.remoteProxyIpAddr.geolocation
+ where: exists("log.remoteProxyIpAddr")
+ # Adding log.primaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryDns
+ destination: log.primaryDns.geolocation
+ where: exists("log.primaryDns")
+ # Adding log.secondaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryDns
+ destination: log.secondaryDns.geolocation
+ where: exists("log.secondaryDns")
+ # Adding log.primaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryWins
+ destination: log.primaryWins.geolocation
+ where: exists("log.primaryWins")
+ # Adding log.secondaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryWins
+ destination: log.secondaryWins.geolocation
+ where: exists("log.secondaryWins")
+ #......................................................................#
+ # Common field conversions
+ - cast:
+ fields:
+ - origin.port
+ - target.port
+ to: int
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.asaHeader
+ - log.ciscoSeparator
+ - log.irrelevant
+ - log.syslogPri
+ - log.rest$$
+ WHERE id=301;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209005_update_filter_cisco_firepower.xml b/backend/src/main/resources/config/liquibase/changelog/20260209005_update_filter_cisco_firepower.xml
new file mode 100644
index 000000000..6cb812581
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209005_update_filter_cisco_firepower.xml
@@ -0,0 +1,5160 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field containing the Cisco Firepower log
+pipeline:
+ - dataTypes:
+ - firewall-cisco-firepower
+ steps:
+ # Common Firepower fields
+ - grok:
+ patterns:
+ - fieldName: log.syslogPri
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '{{.day}}\s{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.firePowerHeader
+ pattern: '{{.data}}FTD-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '{{.day}}\s{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.firePowerHeader
+ pattern: '{{.data}}FTD-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ #......................................................................#
+ # Adding log.localIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localIp
+ destination: log.localIp.geolocation
+ where: exists("log.localIp")
+ # Removing unwanted prefixes
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.messageId
+ # Field conversions
+ - cast:
+ fields:
+ - log.messageId
+ to: int
+ # Begining specific message parsing
+ #......................................................................#
+ # FTD-2-106001
+ - grok:
+ patterns:
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'flags'
+ - fieldName: log.flags
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106001)
+
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 106001)
+ #......................................................................#
+ # FTD-2-106017
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sdue\sto'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ source: log.msg
+ where: equals("log.messageId", 106017)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: equals("log.messageId", 106017)
+ #......................................................................#
+ # FTD-1-106021
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106021)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: equals("log.messageId", 106021)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 106021)
+ #......................................................................#
+ # FTD-2-106101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Number of cached deny-flows for ACL log has reached limit'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106101)
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Number of cached'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 106101)
+ # Parsing the limit number
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.numFlows
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 106101)
+ # Field conversions
+ - cast:
+ fields:
+ - log.numFlows
+ to: int
+ where: equals("log.messageId", 106101)
+ #......................................................................#
+ # FTD-6-106102,FTD-4-106103
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("actionResult", "Permitted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && !equalsIgnoreCase("actionResult", "Permitted")
+ #......................................................................#
+ # FTD-6-109101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA disconnect request'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with\saudit-session-id:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 109101)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 109101)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: equals("log.messageId", 109101)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 109101)
+ #......................................................................#
+ # FTD-4-109102
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ', but cannot find named session'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 109102)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 109102)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 109102)
+ #......................................................................#
+ # FTD-3-109103
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'failed for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with session ID:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 109103)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 109103)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: equals("log.messageId", 109103)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 109103)
+ #......................................................................#
+ # FTD-109201 to 109213
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'UAUTH(:)? Session(\s|=)'
+ - fieldName: log.session
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'User(\s|=)'
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Assigned IP(\s|=)'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: greaterOrEqual("log.messageId", 109201) && log.messageId<=109213
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.session
+ - origin.user
+ where: lgreaterOrEqual("log.messageId", 109201) && log.messageId<=109213
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: greaterOrEqual("log.messageId", 109201) && log.messageId<=109213
+ #......................................................................#
+ # FTD-6-113004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user {{.word}} Successful'
+ - fieldName: log.irrelevant
+ pattern: '\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113004)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user {{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113004)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - target.ip
+ where: equals("log.messageId", 113004)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - target.ip
+ where: equals("log.messageId", 113004)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113004)
+ #......................................................................#
+ # FTD-6-113005
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(server|Server)(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113005)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113005)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: equals("log.messageId", 113005)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113005)
+ #......................................................................#
+ # FTD-6-113008
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA transaction status ACCEPT(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113008)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113008)
+ #......................................................................#
+ # FTD-6-113009
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113009)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113009)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113009)
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113009)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113009)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113009)
+ #......................................................................#
+ # FTD-6-113010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA challenge received for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}) from server'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113010)
+ - trim:
+ function: suffix
+ substring: 'from server'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 113010)
+ #......................................................................#
+ # FTD-6-113011
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113011)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113011)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113011)
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113011)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113011)
+ #......................................................................#
+ # FTD-6-113012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Successful(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?local database(\s)?:(\s)?user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113012)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113012)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113012)
+ #......................................................................#
+ # FTD-6-113013
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA unable to complete the request'
+ - fieldName: log.irrelevant
+ pattern: 'Error(\s)?:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}\:'
+ - fieldName: log.irrelevant
+ pattern: 'user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113013)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ where: equals("log.messageId", 113013)
+ #......................................................................#
+ # FTD-6-113014
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA authentication server not accessible(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113014)
+ #......................................................................#
+ # FTD-6-113015, 113017
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(AAA user authentication|AAA credentials)\s(R|r)ejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'local database(\s)?:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - origin.user
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(AAA user authentication|AAA credentials)\s'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ #......................................................................#
+ # FTD-6-113016
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA credentials rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113016)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: equals("log.messageId", 113016)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA credentials'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113016)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113016)
+ #......................................................................#
+ # FTD-4-113019
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?=(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)sername(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: action
+ pattern: '(\s)?Session disconnected\.'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Session Type:(\s)?'
+ - fieldName: log.sessionType
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Duration:(\s)?'
+ - fieldName: log.duration
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes xmt:(\s)?'
+ - fieldName: origin.bytesSent
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes rcv:(\s)?'
+ - fieldName: origin.bytesReceived
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Reason:(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113019)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ - log.sessionType
+ - log.duration
+ - origin.bytesSent
+ - origin.bytesReceived
+ where: equals("log.messageId", 113019)
+ - cast:
+ fields:
+ - origin.bytesSent
+ - origin.bytesReceived
+ to: int
+ where: equals("log.messageId", 113019)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113019)
+ #......................................................................#
+ # FTD-113031,113032,113033
+ # Common fields
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ # Specific fields
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.filter
+ pattern: '{{.data}}\sis'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'is'
+ fields:
+ - log.filter
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ #......................................................................#
+ # FTD-113034,113035,113036,113038,113039
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '(\<)?{{.data}}(\>)?\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|(\<)?{{.data}}(\>)?)(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113039)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113035) || log.messageId==113038
+ #......................................................................#
+ # FTD-4-113042
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA: Non-HTTP connection from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: log.remoteUser
+ pattern: '(''{{.data}}''|{{.data}})(\s)?at'
+ - fieldName: log.remoteIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: 'at'
+ fields:
+ - log.remoteUser
+ where: equals("log.messageId", 113042)
+ #......................................................................#
+ # FTD-2-201003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit exceeded'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.globalIp
+ pattern: '\({{.data}}\)'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.dstInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 201003)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.globalIp
+ where: equals("log.messageId", 201003)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.globalIp
+ where: equals("log.messageId", 201003)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 201003)
+ #......................................................................#
+ # FTD-4-209003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Fragment database limit of'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'exceeded:(\s)?src(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'dest(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'proto(\s)?=(\s)?'
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'id(\s)?=(\s)?'
+ - fieldName: log.id
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 209003)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.ip
+ - target.ip
+ - protocol
+ where: equals("log.messageId", 209003)
+ - cast:
+ fields:
+ - log.limit
+ to: int
+ where: equals("log.messageId", 209003)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 209003)
+ #......................................................................#
+ # FTD-3-316001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Denied new tunnel'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 316001)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 316001)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 316001)
+ #......................................................................#
+ # FTD-3-316002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'VPN Handle error'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?protocol='
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'src\s'
+ - fieldName: log.inIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?dst'
+ - fieldName: log.outIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 316002)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - protocol
+ where: equals("log.messageId", 316002)
+ - cast:
+ fields:
+ - log.inIfNum
+ - log.outIfNum
+ to: int
+ where: equals("log.messageId", 316002)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 316002)
+ #......................................................................#
+ # FTD-6-302003,302004
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.irrelevant
+ pattern: '(to\s)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Parsing from/to ip and port
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpToip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpToip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '{{.greedy}}'
+ source: log.tmpFromip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpFromip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Removing temp fields
+ - delete:
+ fields:
+ - log.tmpFromip
+ - log.tmpToip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ #......................................................................#
+ # FTD-6-302012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Pre-allocate H225 Call Signalling Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '/(\s)?{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to laddr'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302012)
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ where: equals("log.messageId", 302012)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302012)
+ #......................................................................#
+ # FTD-6-302013
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302013)
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: equals("log.messageId", 302013)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302013)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302013)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302013)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302013)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: equals("log.messageId", 302013)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302013)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302013)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302013)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302013)
+ #......................................................................#
+ # FTD-6-302014
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302014)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302014)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302014)
+ # Parsing AAA user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302014)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302014)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: equals("log.messageId", 302014)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302014)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302014)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302014)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302014)
+ #......................................................................#
+ # FTD-6-302015
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302015)
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: equals("log.messageId", 302015)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302015)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302015)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302015)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302015)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: equals("log.messageId", 302015)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302015)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302015)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302015)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302015)
+ #......................................................................#
+ # FTD-6-302016
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302016)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302016)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302016)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: equals("log.messageId", 302016)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302016)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302016)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: equals("log.messageId", 302016)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302016)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302016)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302016)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302016)
+ #......................................................................#
+ # FTD-6-302017
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302017)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302017)
+ # Parsing translatedCid and, firewall user to and AAA user if present
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpUserInfo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 302017)
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302017)
+ # FW user and AAA user
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ - fieldName: target.user
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: equals("log.messageId", 302017)
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: equals("log.messageId", 302017)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - target.user
+ - log.translatedCid
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ - target.user
+ where: equals("log.messageId", 302017)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpUserInfo
+ where: equals("log.messageId", 302017)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302017)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302017)
+ #......................................................................#
+ # FTD-6-302018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302018)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302018)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302018)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: equals("log.messageId", 302018)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302018)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.translatedCid
+ where: equals("log.messageId", 302018)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: equals("log.messageId", 302018)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ where: equals("log.messageId", 302018)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302018)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: equals("log.messageId", 302018)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302018)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302018)
+ #......................................................................#
+ # FTD-6-302020, 302021
+ # 302020
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302020)
+ # 302021
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302021)
+ # Common parsing for 302020 and 302021
+ # For parsing faddr and fwuser from (Begin with ip/port), or icmpSeqNum
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # icmpSeqNum variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Cleaning icmpSeqNum
+ - trim:
+ function: suffix
+ substring: 'gaddr'
+ fields:
+ - log.icmpSeqNum
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Continue with firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # For parsing gaddr and global fwuser (Begin with ip/port), or icmpType
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.globalPort
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # icmpType variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Cleaning icmpType
+ - trim:
+ function: suffix
+ substring: 'laddr'
+ fields:
+ - log.icmpType
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: 'code'
+ fields:
+ - log.icmpType
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Continue with global firewall
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.globalFirewallUser
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserGlobal
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # For parsing laddr and fwuser to (Begin with ip/port)
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Continue with firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - origin.ip
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - log.globalFirewallUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpFwUserGlobal
+ - log.tmpFaddrAndFwUser
+ - log.tmpGaddrAndFwUser
+ - log.tmpLaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ #......................................................................#
+ # FTD-6-302022, 302024, 302026
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.role
+ pattern: '({{.data}})stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortTo
+ pattern: '\({{.data}}\)'
+ source: log.msg
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port to, from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'stub'
+ fields:
+ - log.role
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpMappedIpPortFrom
+ - log.tmpMappedIpPortTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ #......................................................................#
+ # FTD-6-302023, 302025, 302027
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ #......................................................................#
+ # FTD-302033,302034
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Pre-allocated|Unable to pre-allocate) H323 GUP Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.tmpPortFrom
+ pattern: '{{.data}}to laddr'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.tmpIpPortTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Parsing optional ports from y to
+ - grok:
+ patterns:
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpPortFrom
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpIpPortTo
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ source: log.tmpIpPortTo
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Remove tmp fields
+ - delete:
+ fields:
+ - log.tmpPortFrom
+ - log.tmpIpPortTo
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302033)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 302034)
+ #......................................................................#
+ # FTD-6-302303
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302303)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 302303)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302303)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302303)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302303)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302303)
+ #......................................................................#
+ # FTD-6-302304
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302304)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 302304)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302304)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302304)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302304)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302304)
+ #......................................................................#
+ # FTD-6-305009
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.mappedIpTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 305009)
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305009)
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305009)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305009)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: equals("log.messageId", 305009)
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 305009)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305009)
+ #......................................................................#
+ # FTD-6-305010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: equals("log.messageId", 305010)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305010)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: equals("log.messageId", 305010)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305010)
+ #......................................................................#
+ # FTD-6-305011
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: equals("log.messageId", 305011)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305011)
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 305011)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: equals("log.messageId", 305011)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ where: equals("log.messageId", 305011)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305011)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 305011)
+ #......................................................................#
+ # FTD-6-305012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: equals("log.messageId", 305012)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305012)
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 305012)
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305012)
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305012)
+ # Parsing srcInterface from himself to avoid parsing issues
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.srcInterface
+ where: equals("log.messageId", 305012)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: equals("log.messageId", 305012)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ where: equals("log.messageId", 305012)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305012)
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 305012)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 305012)
+ #......................................................................#
+ # FTD-3-322001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sMAC\saddress'
+ - fieldName: log.localMac
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.reason
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 322001)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 322001)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.localMac
+ where: equals("log.messageId", 322001)
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - log.reason
+ where: equals("log.messageId", 322001)
+ #......................................................................#
+ # FTD-3-322002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.boudSrcMac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 322002)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: equals("log.messageId", 322002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 322002)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: equals("log.messageId", 322002)
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 322002)
+ #......................................................................#
+ # FTD-3-322003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 322003)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: equals("log.messageId", 322003)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 322003)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: equals("log.messageId", 322003)
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 322003)
+ #......................................................................#
+ # FTD-4-402114
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402114)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402114)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402114)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ where: equals("log.messageId", 402114)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402114)
+ #......................................................................#
+ # FTD-4-402115
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\sa\spacket'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'containing'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'data instead of'
+ - fieldName: log.expectedProtocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402115)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402115)
+ #......................................................................#
+ # FTD-4-402116
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktDestAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktSrcAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktProto
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.localProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyPort
+ pattern: '{{.data}}and'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.remoteProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyPort
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402116)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402116)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.localProxyIpAddr
+ - log.localProxyIpMask
+ - log.localProxyProto
+ - log.remoteProxyIpAddr
+ - log.remoteProxyIpMask
+ - log.remoteProxyPort
+ - log.remoteProxyProto
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: 'and'
+ fields:
+ - log.localProxyPort
+ where: equals("log.messageId", 402116)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402116)
+ #......................................................................#
+ # FTD-4-402117
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received a non-IPsec \((\s)?{{.word}}(\s)?\) packet'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402117)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received a non-IPsec \('
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402117)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402117)
+ #......................................................................#
+ # FTD-4-402118
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}length'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'with offset'
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: equals("log.messageId", 402118)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402118)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402118)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402118)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402118)
+ #......................................................................#
+ # FTD-4-402119, 402120
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ #......................................................................#
+ # FTD-5-402128
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CRYPTO\:(\s)?'
+ - fieldName: action
+ pattern: 'An attempt to allocate a large memory block'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memorySize
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memoryLimit
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: equals("log.messageId", 402128)
+ #......................................................................#
+ # FTD-4-405001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received ARP (request|response) collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}with'
+ - fieldName: log.irrelevant
+ pattern: 'existing ARP entry'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.mac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 405001)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ARP'
+ where: equals("log.messageId", 405001)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 405001)
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 405001)
+ - trim:
+ function: suffix
+ substring: 'with'
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 405001)
+ #......................................................................#
+ # FTD-4-405002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received mac mismatch collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 405002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 405002)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: equals("log.messageId", 405002)
+ #......................................................................#
+ # FTD-4-406001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command low port(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 406001)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: equals("log.messageId", 406001)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: equals("log.messageId", 406001)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: equals("log.messageId", 406001)
+ #......................................................................#
+ # FTD-4-406002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command different address(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.connectionIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 406002)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: equals("log.messageId", 406002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: equals("log.messageId", 406002)
+ #......................................................................#
+ # FTD-4-407002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit {{.data}} for through connections exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\.'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 407002)
+ # Connection number and connection limit
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Embryonic limit'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 407002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 407002)
+ #......................................................................#
+ # FTD-6-605004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Login\s{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.service
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'user'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 605004)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Login'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ source: action
+ where: equals("log.messageId", 605004)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 605004)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.service
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 605004)
+ #......................................................................#
+ # FTD-2-106018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'ICMP packet'
+ - fieldName: log.irrelevant
+ pattern: 'type'
+ - fieldName: log.icmpType
+ pattern: '{{.data}}\s'
+ - fieldName: log.ciscoResult
+ pattern: 'denied'
+ - fieldName: log.irrelevant
+ pattern: 'by'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}src'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'dest'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106018)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ICMP'
+ where: equals("log.messageId", 106018)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - log.accessList
+ where: equals("log.messageId", 106018)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 106018)
+ #......................................................................#
+ # FTD-2-106020
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Deny IP teardrop fragment'
+ - fieldName: log.irrelevant
+ pattern: '\((\s)?size(\s)?='
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?offset(\s)?='
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)(\s)?from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106020)
+ # Adding log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: log.ciscoResult
+ value: 'Denied'
+ where: equals("log.messageId", 106020)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 106020)
+ #......................................................................#
+ # FTD-6-611301
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with no split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611301)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: equals("log.messageId", 611301)
+ #......................................................................#
+ # FTD-6-611303
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611303)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: equals("log.messageId", 611303)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 611303)
+ #......................................................................#
+ # FTD-6-611304
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT exemption configured for Network Extension Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611304)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: equals("log.messageId", 611304)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 611304)
+ #......................................................................#
+ # FTD-6-611307
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Head end\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611307)
+ # Adding action and log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'The VPN client is connected to the specified headend'
+ where: equals("log.messageId", 611307)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611307)
+ #......................................................................#
+ # FTD-6-611309
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'Disconnecting from head end and uninstalling previously downloaded policy'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}End\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611309)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611309)
+ #......................................................................#
+ # FTD-6-611310,611311
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'XAUTH'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?Peer(\s)?\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611310) || log.messageId==611311
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611310)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 611311)
+ #......................................................................#
+ # FTD-6-611314
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Load Balancing Cluster with Virtual IP\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}server'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611314)
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Load Balancing Cluster redirected the Secure Firewall'
+ where: equals("log.messageId", 611314)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611314)
+ #......................................................................#
+ # FTD-6-611315
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Disconnecting from Load Balancing Cluster member(\:)?(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611315)
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Disconnecting from Load Balancing Cluster'
+ where: equals("log.messageId", 611315)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611315)
+ #......................................................................#
+ # FTD-6-611318
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'User Authentication Enabled'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}IP(\s)?\:'
+ - fieldName: log.authServerIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Port(\s)?\:'
+ - fieldName: log.authServerPort
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}out(\s)?\:'
+ - fieldName: log.timeOut
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611318)
+ #......................................................................#
+ # FTD-3-710003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(TCP|UDP) access denied by ACL'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 710003)
+ # Protocol and log.ciscoResult
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 710003)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 710003)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: equals("log.messageId", 710003)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 710003)
+ #......................................................................#
+ # FTD-5-713252,713253
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Username(\s)?='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}available(\.)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 713252)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 713253)
+ #......................................................................#
+ # FTD-6-716001,716002,716003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 716001) || log.messageId==716002
+ #......................................................................#
+ # FTD-6-716004,716005,716006,716007,716009
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 716004) || log.messageId==716007 || log.messageId==716009
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 716006)
+ #......................................................................#
+ # FTD-6-716038
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716038)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 716038)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ where: equals("log.messageId", 716038)
+ #......................................................................#
+ # FTD-6-716039
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716039)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 716039)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ - origin.user
+ where: equals("log.messageId", 716039)
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716039)
+ #......................................................................#
+ # FTD-6-719017,719019,719020,719021,719022,719023
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
+ # Adding log.ciscoResult and modifying some actions
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 719019) || log.messageId==719023
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 719020) || log.messageId==719022
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user is not checked against ACL'
+ where: equals("log.messageId", 719021)
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has been authenticated'
+ where: equals("log.messageId", 719022)
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has not been authenticated'
+ where: equals("log.messageId", 719023)
+ # Cleaning fields
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
+ #......................................................................#
+ # FTD-6-719018
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'ACL ID'
+ - fieldName: log.accessList
+ pattern: '{{.data}}not'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 719018)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719018)
+ - trim:
+ function: suffix
+ substring: 'not'
+ fields:
+ - log.accessList
+ where: equals("log.messageId", 719018)
+ #......................................................................#
+ # FTD-6-719024
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Email Proxy piggyback auth fail'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.sessionPointer
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}}addr'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 719024)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - log.sessionPointer
+ where: equals("log.messageId", 719024)
+ - trim:
+ function: suffix
+ substring: 'addr'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719024)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 719024)
+ #......................................................................#
+ # FTD-7-609002
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown local-host'
+ - fieldName: log.zoneName
+ pattern: '{{.data}}/'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 609002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.zoneName
+ where: equals("log.messageId", 609002)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 609002)
+ #......................................................................#
+ # FTD-6-611305
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient(\s)?\:'
+ - fieldName: action
+ pattern: 'DHCP Policy installed'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.primaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.secondaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.primaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.secondaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611305)
+ #......................................................................#
+ # FTD-4-733100
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 733100)
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: equals("log.messageId", 733100)
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.data}}drop'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 733100)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'drop'
+ fields:
+ - log.dropSourceObject
+ where: equals("log.messageId", 733100)
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.dropSourceObject
+ where: equals("log.messageId", 733100)
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.dropSourceObject
+ where: equals("log.messageId", 733100)
+ #......................................................................#
+ # FTD-4-733101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}(targeted|attacking)'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 733101)
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: equals("log.messageId", 733101)
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.word}}'
+ - fieldName: log.tmpIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 733101)
+ # Renaming from or to ip, according to -> if (targeted|attacking)
+ - rename:
+ from:
+ - log.tmpIp
+ to: origin.ip
+ where: equals("log.messageId", 733101) && action.contains("attacking")
+ - rename:
+ from:
+ - log.tmpIp
+ to: target.ip
+ where: equals("log.messageId", 733101) && action.contains("targeted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 733101)
+ #......................................................................#
+ # FTD-4-733102, 733103
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}host'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 733102) || log.messageId==733103
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection add host to shun list'
+ where: (equals("log.messageId", 733102) || log.messageId==733103) && log.msg.contains("add")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection removes host to shun list'
+ where: (equals("log.messageId", 733102) || log.messageId==733103) && log.msg.contains("removes")
+ #......................................................................#
+ # Decoding severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: log.severity=="1" || log.severity=="2" || log.severity=="3"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: log.severity=="4"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: log.severity=="5" || log.severity=="6" || log.severity=="7"
+ #......................................................................#
+ # Adding common geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+ # Adding log.mappedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpFrom
+ destination: log.mappedIpFrom.geolocation
+ where: exists("log.mappedIpFrom")
+ # Adding log.mappedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpTo
+ destination: log.mappedIpTo.geolocation
+ where: exists("log.mappedIpTo")
+ # Adding log.translatedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpFrom
+ destination: log.translatedIpFrom.geolocation
+ where: exists("log.translatedIpFrom")
+ # Adding log.translatedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpTo
+ destination: log.translatedIpTo.geolocation
+ where: exists("log.translatedIpTo")
+ # Adding log.globalIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.globalIp
+ destination: log.globalIp.geolocation
+ where: exists("log.globalIp")
+ # Adding log.remoteIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteIp
+ destination: log.remoteIp.geolocation
+ where: exists("log.remoteIp")
+ # Adding log.mappedIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIp
+ destination: log.mappedIp.geolocation
+ where: exists("log.mappedIp")
+ # Adding log.decapsulatedPktDestAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktDestAddr
+ destination: log.decapsulatedPktDestAddr.geolocation
+ where: exists("log.decapsulatedPktDestAddr")
+ # Adding log.decapsulatedPktSrcAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktSrcAddr
+ destination: log.decapsulatedPktSrcAddr.geolocation
+ where: exists("log.decapsulatedPktSrcAddr")
+ # Adding log.localProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localProxyIpAddr
+ destination: log.localProxyIpAddr.geolocation
+ where: exists("log.localProxyIpAddr")
+ # Adding log.remoteProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteProxyIpAddr
+ destination: log.remoteProxyIpAddr.geolocation
+ where: exists("log.remoteProxyIpAddr")
+ # Adding log.primaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryDns
+ destination: log.primaryDns.geolocation
+ where: exists("log.primaryDns")
+ # Adding log.secondaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryDns
+ destination: log.secondaryDns.geolocation
+ where: exists("log.secondaryDns")
+ # Adding log.primaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryWins
+ destination: log.primaryWins.geolocation
+ where: exists("log.primaryWins")
+ # Adding log.secondaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryWins
+ destination: log.secondaryWins.geolocation
+ where: exists("log.secondaryWins")
+ #......................................................................#
+ # Common field conversions
+ - cast:
+ fields:
+ - origin.port
+ - target.port
+ to: int
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.firePowerHeader
+ - log.ciscoSeparator
+ - log.irrelevant
+ - log.syslogPri
+ - log.rest$$
+ WHERE id=303;
+ ]]>
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209006_update_filter_cisco_switch.xml b/backend/src/main/resources/config/liquibase/changelog/20260209006_update_filter_cisco_switch.xml
new file mode 100644
index 000000000..cd3afe4d9
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209006_update_filter_cisco_switch.xml
@@ -0,0 +1,180 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field
+pipeline:
+ - dataTypes:
+ - cisco-switch
+ steps:
+ # Header fields
+ - grok:
+ patterns:
+ - fieldName: log.switchHeader
+ pattern: '{{.data}}%'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.irrelevant
+ pattern: '{{.integer}}(\s)?\:'
+ - fieldName: log.ciscoTime
+ pattern: '{{.greedy}}'
+ source: log.switchHeader
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}{{.greedy}}'
+ source: log.switchHeader
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}{{.greedy}}'
+ source: log.switchHeader
+ #......................................................................#
+ # Beginning message parsing
+ # Variant -> %FACILITY-SUBFACILITY-SEVERITY-MNEMONIC: Message-text
+ - grok:
+ patterns:
+ - fieldName: log.facility
+ pattern: '{{.data}}-'
+ - fieldName: log.severity
+ pattern: '{{.data}}{{.integer}}'
+ - fieldName: log.facilityMnemonic
+ pattern: '{{.data}}\:'
+ - fieldName: log.ciscoMsg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
+ # Extracting subfacility if present
+ - grok:
+ patterns:
+ - fieldName: log.subFacility
+ pattern: '{{.greedy}}-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ source: log.severity
+ where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
+ # --------------------------
+ # Variant -> %CARD-SEVERITY-MSG:SLOT %FACILITY-SEVERITY-MNEMONIC: Message-text
+ - grok:
+ patterns:
+ - fieldName: log.card
+ pattern: '{{.data}}-'
+ - fieldName: log.irrelevant
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.slot
+ pattern: 'SLOT{{.integer}}'
+ - fieldName: log.tmpFacilityMnemonic
+ pattern: '{{.data}}\:'
+ - fieldName: log.ciscoMsg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+
+ - trim:
+ function: prefix
+ substring: '%'
+ fields:
+ - log.tmpFacilityMnemonic
+ where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+ # %FACILITY-SEVERITY-MNEMONIC
+ - grok:
+ patterns:
+ - fieldName: log.facility
+ pattern: '{{.data}}-'
+ - fieldName: log.severity
+ pattern: '{{.data}}{{.integer}}'
+ - fieldName: log.facilityMnemonic
+ pattern: '{{.data}}\:'
+ source: log.tmpFacilityMnemonic
+ where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+ # Extracting subfacility if present
+ - grok:
+ patterns:
+ - fieldName: log.subFacility
+ pattern: '{{.greedy}}-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ source: log.severity
+ where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+
+ # Cleaning common fields
+ - trim:
+ function: suffix
+ substring: '-'
+ fields:
+ - log.facility
+ - log.subFacility
+ - log.card
+ - trim:
+ function: suffix
+ substring: '%'
+ fields:
+ - log.ciscoTime
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.facilityMnemonic
+ - log.ciscoTime
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.facilityMnemonic
+ #......................................................................#
+ # Decoding severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severity", ["0", "1", "2", "3"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: log.severity=="4"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severity", ["5", "6", "7"])
+ #......................................................................#
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.switchHeader
+ - log.irrelevant
+ - log.tmpFacilityMnemonic$$
+ WHERE id=1510;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209007_update_filter_deceptive_bytes.xml b/backend/src/main/resources/config/liquibase/changelog/20260209007_update_filter_deceptive_bytes.xml
new file mode 100644
index 000000000..79b8fc579
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209007_update_filter_deceptive_bytes.xml
@@ -0,0 +1,518 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.notDefined
+ pattern: '{{.integer}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:'
+ - fieldName: log.userWithTrash
+ pattern: '{{.data}}CEF'
+ - fieldName: log.1trash
+ pattern: '\:{{.integer}}'
+ - fieldName: log.messageWithTrash
+ pattern: '{{.data}}{{.word}}\={{.data}}{{.space}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:'
+ - fieldName: log.userWithTrash
+ pattern: '{{.data}}CEF'
+ - fieldName: log.1trash
+ pattern: '\:{{.integer}}'
+ - fieldName: log.messageWithTrash
+ pattern: '{{.data}}{{.word}}\={{.data}}{{.space}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.user
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.userWithTrash
+
+ - grok:
+ patterns:
+ - fieldName: log.message
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.restMessageToKv
+ pattern: '{{.greedy}}'
+ source: log.messageWithTrash
+
+ # Parsing the common fields
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.eventTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.restMessage
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.eventTime
+ pattern: '\[{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.hour}}\:{{.minute}}\:{{.seconds}}'
+ - fieldName: log.restMessage
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.eventTime
+ pattern: '{{.monthDay}}-{{.monthNumber}}{{.space}}{{.hour}}\:{{.minute}}\:{{.seconds}}'
+ - fieldName: log.restMessage
+ pattern: '{{.greedy}}'
+ source: raw
+
+ # Parse the restMessage field from the rest of the common fields
+ - grok:
+ patterns:
+ - fieldName: log.processId
+ pattern: '\,{{.integer}}'
+ - fieldName: log.trheadId
+ pattern: '\,\-'
+ - fieldName: log.eventType
+ pattern: '\,{{.integer}}'
+ - fieldName: log.eventSource
+ pattern: '\,{{.word}}'
+ - fieldName: log.processName
+ pattern: '\,{{.integer}}'
+ - fieldName: log.processPath
+ pattern: '\,{{.word}}'
+ - fieldName: log.platform
+ pattern: '\,{{.data}}\,'
+ - fieldName: origin.path
+ pattern: '{{.greedy}}\,'
+ - fieldName: command
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.processId
+ pattern: '\,{{.integer}}'
+ - fieldName: log.trheadId
+ pattern: '\,{{.data}}\,'
+ - fieldName: log.eventType
+ pattern: '{{.integer}}'
+ - fieldName: log.eventSource
+ pattern: '\,\-'
+ - fieldName: log.processName
+ pattern: '\,{{.word}}\.{{.word}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.processId
+ pattern: '\,{{.integer}}'
+ - fieldName: log.trheadId
+ pattern: '\,{{.data}}\,'
+ - fieldName: log.eventType
+ pattern: '{{.integer}}'
+ - fieldName: log.eventSource
+ pattern: '\,\-\,'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.eventSource
+ pattern: '{{.integer}}\s'
+ - fieldName: log.component
+ pattern: '{{.word}}\,'
+ - fieldName: log.errorCode
+ pattern: '{{.integer}}\]'
+ - fieldName: log.restDataMessage
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.eventSource
+ pattern: '{{.integer}}\s'
+ - fieldName: log.component
+ pattern: '{{.word}}\,'
+ - fieldName: log.errorCode
+ pattern: '{{.integer}}\]'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+ where: log.restMessage.contains("file")
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.eventSource
+ pattern: '{{.integer}}\s'
+ - fieldName: log.component
+ pattern: '{{.word}}\,'
+ - fieldName: log.errorCode
+ pattern: '{{.integer}}\]\s'
+ - fieldName: origin.path
+ pattern: '(?:[A-Z]:\\(?:[^\\\n]+\\)*[^\\\n]*|\/(?:[^\/\n]+\/)*[^\/\n]*)'
+ source: log.restMessage
+ where: log.severityLabelCharacter.contains("V")
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.processId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\s'
+ - fieldName: log.methodName
+ pattern: '\:\:{{.data}}\,'
+ - fieldName: log.returnCode
+ pattern: '{{.integer}}\]\s'
+ - fieldName: log.detailedMessage
+ pattern: '\({{.data}}\)'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.processId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\s'
+ - fieldName: log.methodName
+ pattern: '{{.data}}\:\:{{.data}}\,'
+ - fieldName: log.returnCode
+ pattern: '{{.integer}}\]\s'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.processId
+ pattern: '\[{{.integer}}\/'
+ - fieldName: log.trheadId
+ pattern: '{{.data}}\]:?\s'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ # Using kv for the rest of the trash in the message
+ - kv:
+ fieldSplit: " "
+ valueSplit: "="
+ source: log.restMessageToKv
+
+ # Using grok to analyze the rest of the data
+ - grok:
+ patterns:
+ - fieldName: log.productVendor
+ pattern: '\|{{.data}}\|'
+ - fieldName: log.product
+ pattern: '{{.data}}\|'
+ - fieldName: log.productVersion
+ pattern: '{{.data}}\|'
+ - fieldName: log.signatureID
+ pattern: '{{.data}}\|'
+ - fieldName: log.eventType
+ pattern: '{{.data}}\|'
+ - fieldName: log.severity
+ pattern: '{{.data}}\|'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.pidStatusToKv
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ source: log.restDataMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.0trash
+ pattern: '{{.data}}PID='
+ - fieldName: log.pid
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: raw
+ where: log.severityLabelCharacter.contains("W")
+
+ # Removing unnecessary characters
+ - trim:
+ function: prefix
+ substring: '|'
+ fields:
+ - log.productVendor
+
+ - trim:
+ function: suffix
+ substring: '|'
+ fields:
+ - log.productVendor
+ - log.product
+ - log.productVersion
+ - log.signatureID
+ - log.eventType
+ - log.severity
+
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.trheadId
+
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.processId
+
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - log.syslogPriority
+
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - log.syslogPriority
+
+ - trim:
+ function: prefix
+ substring: ','
+ fields:
+ - log.trheadId
+ - log.processId
+ - log.eventType
+ - log.eventSource
+ - log.processName
+ - log.processPath
+ - log.platform
+ - origin.path
+
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.trheadId
+ - log.component
+ - log.platform
+ - origin.path
+ - log.eventSource
+ - log.processId
+ - log.methodName
+
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - command
+
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - command
+
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.eventTime
+ - log.processId
+ - log.severityLabelCharacter
+
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.status
+ - log.errorCode
+ - log.returnCode
+ - log.severityLabelCharacter
+ - log.trheadId
+
+ # Using the kv filter with default config, usefull in key-value logs
+ - kv:
+ fieldSplit: " "
+ valueSplit: "="
+ source: log.restData
+
+ # Using the kv filter with other config, usefull in key-value logs
+ - kv:
+ fieldSplit: ", "
+ valueSplit: "="
+ source: log.pidStatusToKv
+
+ # Adding severity based on log.severityLabelCharacter
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severityLabelCharacter", ["C", "A", "E"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: equals("log.severityLabelCharacter", "W")
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severityLabelCharacter", ["D", "V", "N", "I", "T"])
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.0trash
+ - log.1trash
+ - log.restData
+ - log.restMessage
+ - log.restDataMessage
+ - log.irrelevant
+ - log.messageWithTrash
+ - log.restMessageToKv
+ - log.pidStatusToKv
+ - log.userWithTrash
+ - log.severityLabelCharacter$$
+ WHERE id=1512;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209008_update_filter_elasticsearch.xml b/backend/src/main/resources/config/liquibase/changelog/20260209008_update_filter_elasticsearch.xml
new file mode 100644
index 000000000..7d3d19580
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209008_update_filter_elasticsearch.xml
@@ -0,0 +1,442 @@
+
+
+
+
+
+
+ fileset: datatype
+# server: plain text, json
+# audit: plain text, json
+# 1. Parsing the json from beats
+# 2. Parsing the message field containing the elasticsearch log
+pipeline:
+ - dataTypes:
+ - elasticsearch
+ steps:
+ - json:
+ source: raw
+ - rename:
+ from:
+ - log.url
+ to: origin.url
+ - rename:
+ from:
+ - log.log.file.path
+ to: origin.file
+ - rename:
+ from:
+ - log.host.ip
+ to: log.local.ips
+ - rename:
+ from:
+ - log.host.mac
+ to: log.local.macs
+ - rename:
+ from:
+ - log.host.hostname
+ to: origin.host
+ - rename:
+ from:
+ - log.event.dataset
+ to: log.eventDataset
+ - rename:
+ from:
+ - log.agent.version
+ to: log.agentVersion
+ - rename:
+ from:
+ - log.host.os.kernel
+ to: log.osVersion
+ - rename:
+ from:
+ - log.host.os.type
+ to: log.osType
+ - rename:
+ from:
+ - log.host.architecture
+ to: log.cpuArchitecture
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.ips
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.macs
+ - grok:
+ patterns:
+ - fieldName: deviceTime
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.level
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.component
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.nodeName
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.message
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - deviceTime
+ - log.level
+ - log.component
+ - log.nodeName
+ where: exists("log.msg")
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - deviceTime
+ - log.level
+ - log.component
+ - log.nodeName
+ where: exists("log.msg")
+ - reformat:
+ fields:
+ - deviceTime
+ function: time
+ fromFormat: '2022-01-20T22:52:07,431'
+ toFormat: '2024-09-23T15:57:40.338364445Z'
+ where: exists("deviceTime")
+ # Begin parsing when message comes in json format
+ - json:
+ source: log.message
+ where: exists("log.msg")
+ # Performing json step over the remaining message field (Cases when log.message has a message field inside)
+ - json:
+ source: log.message
+ where: exists("log.message")
+ # Rename audit fields from json
+ - rename:
+ from:
+ - log.audit_format_version
+ to: log.auditFormatVersion
+ where: exists("log.audit_format_version")
+ - rename:
+ from:
+ - log.audit_category
+ to: action
+ where: exists("log.audit_category")
+ - rename:
+ from:
+ - log.audit_node_host_address
+ to: log.auditNodeHostAddress
+ where: exists("log.audit_node_host_address")
+ - rename:
+ from:
+ - log.audit_node_host_name
+ to: log.auditNodeHostName
+ where: exists("log.audit_node_host_name")
+ - rename:
+ from:
+ - log.audit_request_layer
+ to: log.auditRequestLayer
+ where: exists("log.audit_request_layer")
+ - rename:
+ from:
+ - log.audit_request_origin
+ to: log.auditRequestOrigin
+ where: exists("log.audit_request_origin")
+ - rename:
+ from:
+ - log.audit_request_effective_user_is_admin
+ to: log.auditRequestEffectiveUserIsAdmin
+ where: exists("log.audit_request_effective_user_is_admin")
+ - rename:
+ from:
+ - log.audit_request_effective_user
+ to: log.auditRequestEffectiveUser
+ where: exists("log.audit_request_effective_user")
+ - rename:
+ from:
+ - log.audit_rest_request_path
+ to: log.auditRestRequestPath
+ where: exists("log.audit_rest_request_path")
+ - rename:
+ from:
+ - log.audit_rest_request_params
+ to: log.auditRestRequestParams
+ where: exists("log.audit_rest_request_params")
+ - rename:
+ from:
+ - log.audit_rest_request_headers
+ to: log.auditRestRequestHeaders
+ where: exists("log.audit_rest_request_headers")
+ - rename:
+ from:
+ - log.audit_request_initiating_user
+ to: log.auditRequestInitiatingUser
+ where: exists("log.audit_request_initiating_user")
+ - rename:
+ from:
+ - log.audit_request_body
+ to: log.auditRequestBody
+ where: exists("log.audit_request_body")
+ - rename:
+ from:
+ - log.audit_rest_request_method
+ to: log.auditRestRequestMethod
+ where: exists("log.audit_rest_request_method")
+ - rename:
+ from:
+ - log.audit_request_exception_stacktrace
+ to: log.auditRequestExceptionStacktrace
+ where: exists("log.audit_request_exception_stacktrace")
+ - rename:
+ from:
+ - log.audit_trace_task_id
+ to: log.auditTraceTaskId
+ where: exists("log.audit_trace_task_id")
+ - rename:
+ from:
+ - log.audit_transport_headers
+ to: log.auditTransportHeaders
+ where: exists("log.audit_transport_headers")
+ - rename:
+ from:
+ - log.audit_transport_request_type
+ to: log.auditTransportRequestType
+ where: exists("log.audit_transport_request_type")
+ - rename:
+ from:
+ - log.audit_trace_indices
+ to: log.auditTraceIndices
+ where: exists("log.audit_trace_indices")
+ - rename:
+ from:
+ - log.audit_trace_resolved_indices
+ to: log.auditTraceResolvedIndices
+ where: exists("log.audit_trace_resolved_indices")
+ - rename:
+ from:
+ - log.audit_trace_doc_types
+ to: log.auditTraceDocTypes
+ where: exists("log.audit_trace_doc_types")
+ - rename:
+ from:
+ - log.audit_trace_task_parent_id
+ to: log.auditTraceTaskParentId
+ where: exists("log.audit_trace_task_parent_id")
+ - rename:
+ from:
+ - log.audit_request_privilege
+ to: log.auditRequestPrivilege
+ where: exists("log.audit_request_privilege")
+ - rename:
+ from:
+ - log.audit_compliance_operation
+ to: log.auditComplianceOperation
+ where: exists("log.audit_compliance_operation")
+ - rename:
+ from:
+ - log.node.id
+ - log.audit_node_id
+ to: log.nodeId
+ where: exists("log.node.id") || exists("log.audit_node_id")
+ - rename:
+ from:
+ - log.node.name
+ - log.audit_node_name
+ to: log.nodeName
+ where: exists("log.node.name") || exists("log.node.name")
+ - rename:
+ from:
+ - log.cluster.name
+ - log.audit_cluster_name
+ to: log.clusterName
+ where: exists("log.cluster.name") || exists("log.audit_cluster_name")
+ - rename:
+ from:
+ - log.cluster.uuid
+ to: log.clusterUuid
+ where: exists("log.cluster.uuid")
+ # Adding fields from elastic audit json file
+ - rename:
+ from:
+ - log.event.type
+ to: log.eventType
+ where: exists("log.event.type")
+ - rename:
+ from:
+ - log.event.action
+ to: action
+ where: exists("log.event.action")
+ - rename:
+ from:
+ - log.request.id
+ to: log.requestId
+ where: exists("log.request.id")
+ # Extracting ip and port from address
+ - grok:
+ patterns:
+ - fieldName: log.origin.address
+ pattern: '(.*)\:'
+ - fieldName: origin.port
+ pattern: '{{.greedy}}'
+ source: log.origin.address
+ where: exists("log.origin.address")
+ # Cleaning ip address if has port
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.origin.address
+ where: exists("log.origin.address")
+ - rename:
+ from:
+ - log.origin.address
+ to: origin.ip
+ where: exists("log.origin.address")
+ # Adding geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ # Port field conversion
+ - cast:
+ fields:
+ - origin.port
+ to: int
+ where: exists("origin.port")
+ - rename:
+ from:
+ - log.origin.type
+ to: log.originType
+ where: exists("log.origin.type")
+ - rename:
+ from:
+ - log.url.path
+ to: origin.url
+ where: exists("log.url.path")
+ - rename:
+ from:
+ - log.url.query
+ to: log.urlQuery
+ where: exists("log.url.query")
+ - rename:
+ from:
+ - log.request.method
+ to: log.method
+ where: exists("log.request.method")
+ - rename:
+ from:
+ - log.transport_profile
+ to: log.transportProfile
+ where: exists("log.transport_profile")
+ - rename:
+ from:
+ - log.user.name
+ to: origin.user
+ where: exists("log.user.name")
+ - rename:
+ from:
+ - log.user.realm
+ to: log.userRealm
+ where: exists("log.user.realm")
+ - rename:
+ from:
+ - log.user.run_by.name
+ to: log.userRunByName
+ where: exists("log.user.run_by.name")
+ - rename:
+ from:
+ - log.authentication.type
+ to: log.authenticationType
+ where: exists("log.authentication.type")
+ - rename:
+ from:
+ - log.apikey.name
+ to: log.apikeyName
+ where: exists("log.apikey.name")
+ - rename:
+ from:
+ - log.user.roles
+ to: log.userRoles
+ where: exists("log.user.roles")
+ - rename:
+ from:
+ - log.user.run_as.name
+ to: log.userRunAsName
+ where: exists("log.user.run_as.name")
+ - rename:
+ from:
+ - log.user.run_as.name
+ to: log.userRunAsName
+ where: exists("log.user.run_as.name")
+ # Casting new fields after json parsing
+ - cast:
+ to: '[]string'
+ fields:
+ - log.auditTraceIndices
+ - log.auditTraceResolvedIndices
+ - log.indices
+ - log.userRoles
+ # Adding severity based on log.level
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.level", ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: oneOf("log.level", ["WARN", "Warning"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.level", ["Information", "Informational", "INFO", "DEBUG", "TRACE"])
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.service
+ - log.metadata
+ - log.agent
+ - log.host
+ - log.event
+ - log.ecs
+ - log.log
+ - log.fileset
+ - log.cluster
+ - log.node
+ - log.opaque_id
+ - log.trace_id
+ - log.x_forwarded_for
+ - log.request
+ - log.url
+ - log.user
+ - log.apikey
+ - log.authentication
+ - log.origin
+
+ # Droping unwanted logs
+ - drop:
+ where: exists("log.eventDataset") && exists("log.component") && ( (!equals("log.eventDataset", "elasticsearch.server") && !equals("log.eventDataset", "elasticsearch.audit")) || (equals("log.eventDataset", "elasticsearch.server") && (!equalsIgnoreCase("log.component", "audit") && !equalsIgnoreCase("log.component", "ssl") && !equalsIgnoreCase("log.component", "security") ) ) )$$
+ WHERE id=1410;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209009_update_filter_google.xml b/backend/src/main/resources/config/liquibase/changelog/20260209009_update_filter_google.xml
new file mode 100644
index 000000000..b66bf7a7b
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209009_update_filter_google.xml
@@ -0,0 +1,430 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209010_update_filter_iis.xml b/backend/src/main/resources/config/liquibase/changelog/20260209010_update_filter_iis.xml
new file mode 100644
index 000000000..796c9da71
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209010_update_filter_iis.xml
@@ -0,0 +1,205 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209011_update_filter_kafka.xml b/backend/src/main/resources/config/liquibase/changelog/20260209011_update_filter_kafka.xml
new file mode 100644
index 000000000..6121b8c0f
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209011_update_filter_kafka.xml
@@ -0,0 +1,192 @@
+
+
+
+
+
+
+ fileset: datatype
+# log: plain text
+#
+# Compatible any of Kafka logs
+# like: Server, Controller, Log-cleaner and so on
+#
+# Documentations
+# 1- https://kafka.apache.org/documentation/
+# 2- https://www.elastic.co/guide/en/beats/filebeat/7.13/exported-fields-kafka.html
+#
+# Implementation
+# 1. Parsing the json from beats
+# 2. Parsing the message field containing the apache log
+pipeline:
+ - dataTypes:
+ - kafka
+ steps:
+ - json:
+ source: raw
+
+ # Parse beats field
+ - rename:
+ from:
+ - log.url
+ to: origin.url
+
+ - rename:
+ from:
+ - log.log.file.path
+ to: origin.file
+
+ - rename:
+ from:
+ - log.host.ip
+ to: log.origin.ips
+
+ - rename:
+ from:
+ - log.host.mac
+ to: log.origin.macs
+
+ - rename:
+ from:
+ - log.host.hostname
+ to: origin.host
+
+ - rename:
+ from:
+ - log.event.dataset
+ to: action
+
+ - rename:
+ from:
+ - log.agent.version
+ to: log.agentVersion
+
+ - rename:
+ from:
+ - log.host.os.kernel
+ to: log.osVersion
+
+ - rename:
+ from:
+ - log.host.os.type
+ to: log.osType
+
+ - rename:
+ from:
+ - log.host.architecture
+ to: log.cpuArchitecture
+
+ # Fields conversions
+ - cast:
+ to: '[]string'
+ fields:
+ - log.origin.ips
+ - cast:
+ to: '[]string'
+ fields:
+ - log.origin.macs
+
+ #Parse message field in plain text format
+ # Logs Kafka parsing
+ - grok:
+ patterns:
+ - fieldName: log.deviceTime
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.severity
+ pattern: '{{.word}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: log.message
+
+ # Logs Server Kafka parsing
+ - grok:
+ patterns:
+ - fieldName: log.msg
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.class
+ pattern: '\({{.greedy}}\)'
+ source: log.restData
+
+ # Logs Controller Kafka parsing
+ - grok:
+ patterns:
+ - fieldName: log.component
+ pattern: '\[{{.data}}\](\:|\,)?'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.class
+ pattern: '\({{.greedy}}\)'
+ source: log.restData
+
+ # Removing unused caracters
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.deviceTime
+ - log.component
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.deviceTime
+ - log.component
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.class
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.class
+
+ # Adding severity field based on log.severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severity", ["INFO", "TRACE", "DEBUG"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: oneOf("log.severity", ["WARNING", "WARN"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: equals("log.severity", "ERROR")
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.service
+ - log.metadata
+ - log.log.offset
+ - log.agent
+ - log.host
+ - log.event
+ - log.ecs
+ - log.log.file
+ - log.log
+ - log.restData$$
+ WHERE id=1409;
+ ]]>
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209012_update_filter_kibana.xml b/backend/src/main/resources/config/liquibase/changelog/20260209012_update_filter_kibana.xml
new file mode 100644
index 000000000..bba81363b
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209012_update_filter_kibana.xml
@@ -0,0 +1,200 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209013_update_filter_logstash.xml b/backend/src/main/resources/config/liquibase/changelog/20260209013_update_filter_logstash.xml
new file mode 100644
index 000000000..e9db023be
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209013_update_filter_logstash.xml
@@ -0,0 +1,159 @@
+
+
+
+
+
+
+ fileset: datatype
+# log: plain text
+# 1. Parsing the json from beats
+# 2. Parsing the message field containing the logstash log
+pipeline:
+ - dataTypes:
+ - logstash
+ steps:
+ - json:
+ source: raw
+ - rename:
+ from:
+ - log.url
+ to: origin.url
+ - rename:
+ from:
+ - log.log.file.path
+ to: origin.file
+ - rename:
+ from:
+ - log.host.ip
+ to: log.local.ips
+ - rename:
+ from:
+ - log.host.mac
+ to: log.local.macs
+ - rename:
+ from:
+ - log.host.hostname
+ to: origin.host
+ - rename:
+ from:
+ - log.event.dataset
+ to: action
+ - rename:
+ from:
+ - log.agent.version
+ to: log.agentVersion
+ - rename:
+ from:
+ - log.host.os.kernel
+ to: log.osVersion
+ - rename:
+ from:
+ - log.host.os.type
+ to: log.osType
+ - rename:
+ from:
+ - log.host.architecture
+ to: log.cpuArchitecture
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.ips
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.macs
+ # Parsing common log parts
+ - grok:
+ patterns:
+ - fieldName: deviceTime
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.level
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.component
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.pipelineName
+ pattern: '^(\[{{.data}}\])'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.message
+ # Parsing when pipeline is not present
+ - grok:
+ patterns:
+ - fieldName: deviceTime
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.level
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.component
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.message
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - deviceTime
+ - log.level
+ - log.component
+ - log.pipelineName
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - deviceTime
+ - log.level
+ - log.component
+ - log.pipelineName
+ - reformat:
+ fields:
+ - deviceTime
+ function: time
+ fromFormat: '2024-07-31T17:02:07,154'
+ toFormat: '2024-09-23T15:57:40.338364445Z'
+ # Adding severity based on log.level
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.level", ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: oneOf("log.level", ["WARN", "Warning"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.level", ["Information", "Informational", "INFO", "DEBUG", "TRACE"])
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.service
+ - log.metadata
+ - log.agent
+ - log.host
+ - log.event
+ - log.ecs
+ - log.log
+ - log.fileset$$
+ WHERE id=1407;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209014_update_filter_meraki.xml b/backend/src/main/resources/config/liquibase/changelog/20260209014_update_filter_meraki.xml
new file mode 100644
index 000000000..0fa92733e
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209014_update_filter_meraki.xml
@@ -0,0 +1,1568 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field
+pipeline:
+ - dataTypes:
+ - firewall-meraki
+ steps:
+ # Header fields
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.serverIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}(\s)?\:'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.serverIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}(\s)?\:'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ # Adding control log.controlFlag field (Used to know if the message don't contains the header INT.INT mx_type mx_group)
+ - add:
+ function: 'string'
+ params:
+ key: log.controlFlag
+ value: 'Init'
+ # Begin message parsing
+ # First extract the generic message, then parse it
+ - grok:
+ patterns:
+ - fieldName: log.controlFlag
+ pattern: '{{.data}}(\s)(events|flows|urls|ids-alerts|security_event)'
+ - fieldName: log.genericEvent
+ pattern: '{{.greedy}}'
+ source: log.msg
+ # Parsing variant INT.INT mx_type mx_group
+ # Parsing from controlFlag (Format: Date? IP PORT INT.INT mx_type mx_group)
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.local.port
+ pattern: '{{.integer}}'
+ - fieldName: log.msgEventTime
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.merakiType
+ pattern: '{{.data}}\s'
+ - fieldName: log.merakiGroup
+ pattern: '{{.greedy}}'
+ source: log.controlFlag
+ where: '!equals("log.controlFlag", "Init")'
+ - grok:
+ patterns:
+ - fieldName: log.msgEventTime
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.merakiType
+ pattern: '{{.data}}\s'
+ - fieldName: log.merakiGroup
+ pattern: '{{.greedy}}'
+ source: log.controlFlag
+ where: '!equals("log.controlFlag", "Init")'
+ # ........................................
+ # event vpn connectivity change
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'vpn_type(\s)?='
+ - fieldName: log.vpnType
+ pattern: '''{{.data}}'''
+ - fieldName: log.irrelevant
+ pattern: 'peer_contact(\s)?='
+ - fieldName: origin.ip
+ pattern: '''{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'''
+ - fieldName: log.irrelevant
+ pattern: 'peer_ident(\s)?='
+ - fieldName: log.peerIdent
+ pattern: '''{{.data}}'''
+ - fieldName: log.irrelevant
+ pattern: 'connectivity(\s)?='
+ - fieldName: log.connectivity
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.connectivity", "true")
+ # ........................................
+ # event uplink connectivity change
+ - rename:
+ from:
+ - log.genericEvent
+ to: action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "failover to")'
+ # ........................................
+ # event uplink connectivity change
+ # Event: urls, HTTP GET requests in MR Access Points
+ - rename:
+ from:
+ - log.genericEvent
+ to: action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "Cellular connection")'
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Cellular connection'
+ - fieldName: log.connectionState
+ pattern: '(up|Up|down|Down)'
+ - fieldName: log.msgEventTime
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.merakiTypeIn
+ pattern: '{{.data}}\s'
+ - fieldName: log.merakiGroupIn
+ pattern: '(events|flows|urls|ids-alerts|security_event)'
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.data}}\:'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'request(\s)?\:'
+ - fieldName: log.method
+ pattern: '{{.word}}'
+ - fieldName: target.url
+ pattern: '{{.greedy}}'
+ source: action
+ where: '!equals("log.controlFlag", "Init") && contains("action", "Cellular connection")'
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Cellular connection'
+ - fieldName: log.connectionState
+ pattern: '(up|Up|down|Down)'
+ source: action
+ where: '!equals("log.controlFlag", "Init") && contains("action", "Cellular connection")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equalsIgnoreCase("log.connectionState", "up")
+ # ........................................
+ # Event: event, dhcp no offers
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}for\smac'
+ - fieldName: origin.mac
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'host(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp no offers")'
+ - trim:
+ function: suffix
+ substring: 'for mac'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp no offers")'
+ # ........................................
+ # Event: event, dhcp lease
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}of\sip'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'from server mac'
+ - fieldName: log.serverMac
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'for client mac'
+ - fieldName: origin.mac
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'from router'
+ - fieldName: log.routerIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'on subnet'
+ - fieldName: log.subnet
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'with dns'
+ - fieldName: log.dns
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: log.dns1
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp lease")'
+ - trim:
+ function: suffix
+ substring: 'of ip'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp lease")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: contains("log.genericEvent", "dhcp lease")
+ # ........................................
+ # Event: event, HTTP GET requests in Meraki MX Security Appliance
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.data}}\:'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'request(\s)?\:'
+ - fieldName: log.method
+ pattern: '{{.word}}'
+ - fieldName: target.url
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="urls"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="urls"'
+ # ........................................
+ # Event: flows, IP session initiated in Meraki MX Security Appliance
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'protocol(\s)?='
+ - fieldName: protocol
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'sport(\s)?='
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dport(\s)?='
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'pattern(\s)?\:'
+ - fieldName: log.pattern
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"'
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'protocol(\s)?='
+ - fieldName: protocol
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'sport(\s)?='
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dport(\s)?='
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'pattern(\s)?\:'
+ - fieldName: log.pattern
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (log.pattern.startsWith("0") || log.pattern.startsWith("allow") || log.pattern.startsWith("Allow"))'
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (log.pattern.startsWith("deny") || log.pattern.startsWith("Deny"))'
+ # ........................................
+ # Event: ids-alerts, ids signature matched in Meraki MX Security Appliance
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'signature(\s)?='
+ - fieldName: log.signature
+ pattern: '{{.data}}priority'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.priority
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'timestamp(\s)?='
+ - fieldName: log.msgEventTimeIn
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'direction(\s)?='
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'protocol(\s)?='
+ - fieldName: protocol
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "signature") && log.merakiGroup=="ids-alerts"'
+ - trim:
+ function: suffix
+ substring: 'priority'
+ fields:
+ - log.signature
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "signature") && log.merakiGroup=="ids-alerts"'
+ # ........................................
+ # Event: event IPsec-SA request queued due to no phase 1 found, phase2 negotiation failed, initiate new phase 1 negotiation,
+ # ISAKMP-SA established, initiate new phase 2 negotiation, IPsec-SA established, ISAKMP-SA established, and ISAKMP-SA deleted
+ # in Meraki MX Security Appliance
+ # This type of message mx_type=labs_appliance mx_group=events
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)(deleted|established)'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '-'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: 'spi(\s)?\:'
+ - fieldName: log.spi
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)request(\s)for'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Third variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)negotiation(\s)failed'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ESP'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Fourth variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)negotiation(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '\<=\>'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Fifth variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)established\:(\s)?ESP/Tunnel'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: 'spi(\s)?='
+ - fieldName: log.spi
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - origin.port
+ - target.port
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - origin.port
+ - target.port
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events" && (contains("log.genericEvent", "queued due to no phase 1") || contains("log.genericEvent", "queued due to no phase1") || || contains("log.genericEvent", "established"))'
+ # ........................................
+ # Event: event spanning-tree guard state change in Meraki MS Switches
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Port'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'received an'
+ - fieldName: protocol
+ pattern: '{{.data}}BPDU'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.mac
+ pattern: '{{.data}}so'
+ - fieldName: log.irrelevant
+ pattern: 'the port was'
+ - fieldName: actionResult
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'BPDU'
+ fields:
+ - protocol
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'so'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events" && contains("log.genericEvent", "blocked")'
+ # ........................................
+ # Event: event blocked DHCP server response in Meraki MS Switches
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Blocked'
+ - fieldName: protocol
+ pattern: '{{.data}}server'
+ - fieldName: log.irrelevant
+ pattern: 'response from'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'VLAN'
+ - fieldName: log.vlan
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'server'
+ fields:
+ - protocol
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
+ # ........................................
+ # Event: event 802.1X (all events) in Meraki MS Switches
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}port'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.port
+ pattern: '{{.data}}identity'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.identity
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ - trim:
+ function: suffix
+ substring: 'port'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.port
+ - log.identity
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.port
+ - log.identity
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ # ........................................
+ # Event: event 802.11 disassociation in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}radio'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.radio
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}channel'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.channel
+ pattern: '{{.data}}reason'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.reason
+ pattern: '{{.data}}instigator'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.instigator
+ pattern: '{{.data}}duration'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.duration
+ pattern: '{{.data}}auth_neg_dur'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.authNegDur
+ pattern: '{{.data}}last_auth_ago'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.lastAuthAgo
+ pattern: '{{.data}}is_wpa'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.isWpa
+ pattern: '{{.data}}full_conn'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fullConn
+ pattern: '{{.data}}ip_resp'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.ipResp
+ pattern: '{{.data}}ip_src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.data}}arp_resp'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.arpResp
+ pattern: '{{.data}}arp_src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.arpSrc
+ pattern: '{{.data}}dns_server'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dnsServer
+ pattern: '{{.data}}dns_req_rtt'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dnsReqRtt
+ pattern: '{{.data}}dns_resp'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dnsResp
+ pattern: '{{.data}}aid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.aid
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'radio'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.radio
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'channel'
+ fields:
+ - log.vap
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'reason'
+ fields:
+ - log.channel
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'instigator'
+ fields:
+ - log.reason
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'duration'
+ fields:
+ - log.instigator
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'auth_neg_dur'
+ fields:
+ - log.duration
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'last_auth_ago'
+ fields:
+ - log.authNegDur
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'is_wpa'
+ fields:
+ - log.lastAuthAgo
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'full_conn'
+ fields:
+ - log.isWpa
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'ip_resp'
+ fields:
+ - log.fullConn
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'ip_src'
+ fields:
+ - log.ipResp
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'arp_resp'
+ fields:
+ - origin.ip
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'arp_src'
+ fields:
+ - log.arpResp
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'dns_server'
+ fields:
+ - log.arpSrc
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'dns_req_rtt'
+ fields:
+ - log.dnsServer
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'dns_resp'
+ fields:
+ - log.dnsReqRtt
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'aid'
+ fields:
+ - log.dnsResp
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.channel
+ - log.reason
+ - log.instigator
+ - log.duration
+ - log.authNegDur
+ - log.lastAuthAgo
+ - log.isWpa
+ - log.fullConn
+ - log.ipResp
+ - origin.ip
+ - log.arpResp
+ - log.arpSrc
+ - log.dnsServer
+ - log.dnsReqRtt
+ - log.dnsResp
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.channel
+ - log.reason
+ - log.instigator
+ - log.duration
+ - log.authNegDur
+ - log.lastAuthAgo
+ - log.isWpa
+ - log.fullConn
+ - log.ipResp
+ - origin.ip
+ - log.arpResp
+ - log.arpSrc
+ - log.dnsServer
+ - log.dnsReqRtt
+ - log.dnsResp
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ # ........................................
+ # Event: event 802.1X (all events) in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}radio'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.radio
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}identity'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.identity
+ pattern: '{{.data}}aid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.aid
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'radio'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.radio
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'identity'
+ fields:
+ - log.vap
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'aid'
+ fields:
+ - log.identity
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.identity
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.identity
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ # ........................................
+ # Event: event splash authentication in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}ip'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.data}}duration'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.duration
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}download'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.download
+ pattern: '{{.data}}upload'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.upload
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'ip'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'duration'
+ fields:
+ - origin.ip
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.duration
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'download'
+ fields:
+ - log.vap
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'upload'
+ fields:
+ - log.download
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.ip
+ - log.vap
+ - log.duration
+ - log.download
+ - log.upload
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.ip
+ - log.vap
+ - log.duration
+ - log.download
+ - log.upload
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ # ........................................
+ # Event: event wireless packet flood detected in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}(\s)packet'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.packet
+ pattern: '{{.data}}device'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}radio'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.radio
+ pattern: '{{.data}}state'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.state
+ pattern: '{{.data}}alarm_id'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.alarmId
+ pattern: '{{.data}}dos_count'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dosCount
+ pattern: '{{.data}}inter_arrival'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.interArrival
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'packet'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'device'
+ fields:
+ - log.packet
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'radio'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'state'
+ fields:
+ - log.radio
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'alarm_id'
+ fields:
+ - log.state
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'dos_count'
+ fields:
+ - log.alarmId
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'inter_arrival'
+ fields:
+ - log.dosCount
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.ip
+ - origin.mac
+ - log.radio
+ - log.packet
+ - log.dosCount
+ - log.alarmId
+ - log.state
+ - log.interArrival
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.ip
+ - origin.mac
+ - log.radio
+ - log.packet
+ - log.dosCount
+ - log.alarmId
+ - log.state
+ - log.interArrival
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ # ........................................
+ # Event: flows, flow allowed by Layer 3 firewall in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}protocol'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: protocol
+ pattern: '{{.data}}sport'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dport(\s)?='
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ - trim:
+ function: suffix
+ substring: 'sport'
+ fields:
+ - protocol
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ - trim:
+ function: suffix
+ substring: 'protocol'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "allow") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "deny") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ # ........................................
+ # Event: event rogue SSID detected and SSID spoofing detected in Meraki MR Access Points
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'airmarshal_events(\s)type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}ssid(\s)?='
+ - fieldName: log.ssid
+ pattern: '{{.data}}bssid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.bssid
+ pattern: '{{.data}}src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}dst'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: target.mac
+ pattern: '{{.data}}wired_mac'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.wiredMac
+ pattern: '{{.data}}vlan_id'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vlanId
+ pattern: '{{.data}}channel'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.channel
+ pattern: '{{.data}}rssi'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.rssi
+ pattern: '{{.data}}fc_type'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcType
+ pattern: '{{.data}}fc_subtype'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcSubType
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'airmarshal_events(\s)type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}ssid(\s)?='
+ - fieldName: log.ssid
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}bssid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.bssid
+ pattern: '{{.data}}src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}dst'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: target.mac
+ pattern: '{{.data}}channel'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.channel
+ pattern: '{{.data}}rssi'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.rssi
+ pattern: '{{.data}}fc_type'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcType
+ pattern: '{{.data}}fc_subtype'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcSubType
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: '='
+ fields:
+ - action
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'ssid'
+ fields:
+ - action
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'bssid'
+ fields:
+ - log.ssid
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.ssid
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'bssid'
+ fields:
+ - log.vap
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - log.bssid
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'dst'
+ fields:
+ - origin.mac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'wired_mac'
+ fields:
+ - target.mac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'channel'
+ fields:
+ - target.mac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'vlan_id'
+ fields:
+ - log.wiredMac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'channel'
+ fields:
+ - log.vlanId
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'rssi'
+ fields:
+ - log.channel
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'fc_type'
+ fields:
+ - log.rssi
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'fc_subtype'
+ fields:
+ - log.fcType
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - action
+ - log.ssid
+ - log.bssid
+ - origin.mac
+ - target.mac
+ - log.wiredMac
+ - log.vlanId
+ - log.channel
+ - log.rssi
+ - log.fcType
+ - log.fcSubType
+ - log.vap
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - action
+ - log.ssid
+ - log.bssid
+ - origin.mac
+ - target.mac
+ - log.wiredMac
+ - log.vlanId
+ - log.channel
+ - log.rssi
+ - log.fcType
+ - log.fcSubType
+ - log.vap
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ # ........................................
+ # Event: security_event ids_alerted, ids signature matched in Meraki MX Security Appliance
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'signature(\s)?='
+ - fieldName: log.signature
+ pattern: '{{.data}}priority'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.priority
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'timestamp(\s)?='
+ - fieldName: log.msgEventTime
+ pattern: '{{.data}}dhost'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}direction'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.direction
+ pattern: '{{.data}}protocol'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: protocol
+ pattern: '{{.data}}src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}\:'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'priority'
+ fields:
+ - log.signature
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'dhost'
+ fields:
+ - log.msgEventTime
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'direction'
+ fields:
+ - origin.mac
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'protocol'
+ fields:
+ - log.direction
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - protocol
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ # ............................................................................
+ # Cleaning common fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.localIp
+ - origin.ip
+ - target.ip
+ - log.serverIp
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.ip
+ - log.peerIdent
+ - log.connectivity
+ - log.vpnType
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.port
+ - log.peerIdent
+ - log.connectivity
+ - log.vpnType
+ #......................................................................#
+ # Adding geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.serverIp
+ destination: log.serverIp.geolocation
+ where: exists("log.serverIp")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localIp
+ destination: log.localIp.geolocation
+ where: exists("log.localIp")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.ipResp
+ destination: log.ipResp.geolocation
+ where: exists("log.ipResp")
+ #......................................................................#
+ # Common field conversions
+ - cast:
+ fields:
+ - origin.port
+ - target.port
+ to: int
+ #......................................................................#
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.controlFlag
+ - log.irrelevant
+ - log.genericEvent$$
+ WHERE id=302;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209015_update_filter_mysql.xml b/backend/src/main/resources/config/liquibase/changelog/20260209015_update_filter_mysql.xml
new file mode 100644
index 000000000..5b17c62b7
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209015_update_filter_mysql.xml
@@ -0,0 +1,150 @@
+
+
+
+
+
+
+ fileset: datatype
+# error: plain text
+# 1. Parsing the json from beats
+# 2. Parsing the message field containing the mysql log
+pipeline:
+ - dataTypes:
+ - mysql
+ steps:
+ - json:
+ source: raw
+ - rename:
+ from:
+ - log.url
+ to: origin.url
+ - rename:
+ from:
+ - log.log.file.path
+ to: origin.file
+ - rename:
+ from:
+ - log.host.ip
+ to: log.local.ips
+ - rename:
+ from:
+ - log.host.mac
+ to: log.local.macs
+ - rename:
+ from:
+ - log.host.hostname
+ to: origin.host
+ - rename:
+ from:
+ - log.event.dataset
+ to: action
+ - rename:
+ from:
+ - log.agent.version
+ to: log.agentVersion
+ - rename:
+ from:
+ - log.host.os.kernel
+ to: log.osVersion
+ - rename:
+ from:
+ - log.host.os.type
+ to: log.osType
+ - rename:
+ from:
+ - log.host.architecture
+ to: log.cpuArchitecture
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.ips
+ - cast:
+ to: '[]string'
+ fields:
+ - log.local.macs
+ # Parsing common log parts
+ - grok:
+ patterns:
+ - fieldName: deviceTime
+ pattern: '{{.data}}\s'
+ - fieldName: log.thread
+ pattern: '{{.integer}}'
+ - fieldName: log.level
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.errorCode
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.subsystem
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.message
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.level
+ - log.errorCode
+ - log.subsystem
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.level
+ - log.errorCode
+ - log.subsystem
+ - reformat:
+ fields:
+ - deviceTime
+ function: time
+ fromFormat: '2020-08-06T14:25:03.109022Z'
+ toFormat: '2024-09-23T15:57:40.338364445Z'
+ # Adding severity based on log.level
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.level", ["Internal", "internal", "INTERNAL", "Error", "error", "ERROR"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: exists("log.level") && oneOf("log.level", ["Warning", "warning", "WARNING"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: exists("log.level") && !oneOf("log.level", ["Internal", "internal", "INTERNAL", "Error", "error", "ERROR", "Warning", "warning", "WARNING"])
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.service
+ - log.metadata
+ - log.agent
+ - log.host
+ - log.event
+ - log.ecs
+ - log.log
+ - log.fileset$$
+ WHERE id=1405;
+ ]]>
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209016_update_filter_nginx.xml b/backend/src/main/resources/config/liquibase/changelog/20260209016_update_filter_nginx.xml
new file mode 100644
index 000000000..924d50d0a
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209016_update_filter_nginx.xml
@@ -0,0 +1,417 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209017_update_filter_redis.xml b/backend/src/main/resources/config/liquibase/changelog/20260209017_update_filter_redis.xml
new file mode 100644
index 000000000..978a31903
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209017_update_filter_redis.xml
@@ -0,0 +1,260 @@
+
+
+
+
+
+
+ fileset: datatype
+# log: plain text
+#
+# Documentations
+# 1- https://www.elastic.co/guide/en/beats/filebeat/7.13/filebeat-module-redis.html
+# 2- https://www.elastic.co/guide/en/beats/filebeat/7.13/exported-fields-redis.html
+# 3- https://redis.io/docs/latest/operate/rs/clusters/logging/redis-slow-log/
+# 4- https://build47.com/redis-log-format-levels/
+#
+# Implementation
+# 1. Parsing the json from beats
+# 2. Parsing the message field containing the redis log
+pipeline:
+ - dataTypes:
+ - redis
+ steps:
+ - json:
+ source: raw
+
+ # Parse message field in plain text format
+ - grok:
+ patterns:
+ - fieldName: log.pid
+ pattern: '{{.data}}\:'
+ - fieldName: log.roleEnc
+ pattern: '{{.word}}'
+ - fieldName: log.deviceTime
+ pattern: '{{.monthDay}}{{.space}}{{.monthName}}{{.space}}{{.year}}{{.space}}{{.time}}'
+ - fieldName: log.levelEnc
+ pattern: '(\.)|(-)|(\*)|(#)'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.message
+
+ # Removing unwanted prefixes
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.pid
+
+ # Fields variants from module
+ # Example: [4018] 14 Nov 07:01:22.119
+ - grok:
+ patterns:
+ - fieldName: log.pid
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.deviceTime
+ pattern: '{{.monthDay}}{{.space}}{{.monthName}}{{.space}}{{.time}}'
+ - fieldName: log.levelEnc
+ pattern: '(\.)|(-)|(\*)|(#)'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.message
+
+ # Removing unwanted prefixes
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.pid
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.pid
+
+ # ................................................................................#
+ # Implementing the Record-RoleEnc Field Based on Redis Documentation
+ # https://build47.com/redis-log-format-levels/
+ #
+ # The possible values for roleEnc are as follows:
+ # (X) sentinel
+ # (M) master
+ # (S) slave
+ # (C) RDB/AOF writing child
+ # ................................................................................#
+ - add:
+ function: 'string'
+ params:
+ key: log.role
+ value: 'sentinel'
+ where: log.roleEnc=="X" || log.roleEnc=="x"
+
+ - add:
+ function: 'string'
+ params:
+ key: log.role
+ value: 'master'
+ where: log.roleEnc=="M" || log.roleEnc=="m"
+
+ - add:
+ function: 'string'
+ params:
+ key: log.role
+ value: 'slave'
+ where: log.roleEnc=="S" || log.roleEnc=="s"
+
+ - add:
+ function: 'string'
+ params:
+ key: log.role
+ value: 'rdb/aof'
+ where: log.roleEnc=="C" || log.roleEnc=="c"
+
+ # ................................................................................#
+ # Implementing the Record-severity Field Based on Redis Documentation
+ # https://build47.com/redis-log-format-levels/
+ #
+ # The log severity is a single character, which is one of the following:
+ # debug (.)
+ # verbose (-)
+ # notice (*)
+ # warning (#)
+ # ................................................................................#
+ - add:
+ function: 'string'
+ params:
+ key: log.severity
+ value: 'debug'
+ where: log.levelEnc=="."
+
+ - add:
+ function: 'string'
+ params:
+ key: log.severity
+ value: 'verbose'
+ where: log.levelEnc=="-"
+
+ - add:
+ function: 'string'
+ params:
+ key: log.severity
+ value: 'notice'
+ where: log.levelEnc=="*"
+
+ - add:
+ function: 'string'
+ params:
+ key: log.severity
+ value: 'warning'
+ where: log.levelEnc=="#"
+
+ # Adding severity field based on log.severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severity", ["debug", "verbose"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: oneOf("log.severity", ["notice", "warning"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severity", ["error"])
+
+ # Parse beats field
+ - rename:
+ from:
+ - log.url
+ to: origin.url
+
+ - rename:
+ from:
+ - log.log.file.path
+ to: origin.file
+
+ - rename:
+ from:
+ - log.host.ip
+ to: log.origin.ips
+
+ - rename:
+ from:
+ - log.host.mac
+ to: log.origin.macs
+
+ - rename:
+ from:
+ - log.host.hostname
+ to: origin.host
+
+ - rename:
+ from:
+ - log.event.dataset
+ to: action
+
+ - rename:
+ from:
+ - log.agent.version
+ to: log.agentVersion
+
+ - rename:
+ from:
+ - log.host.os.kernel
+ to: log.osVersion
+
+ - rename:
+ from:
+ - log.host.os.type
+ to: log.osType
+
+ - rename:
+ from:
+ - log.host.architecture
+ to: log.cpuArchitecture
+
+ # Fields conversions
+ - cast:
+ to: '[]string'
+ fields:
+ - log.origin.ips
+ - cast:
+ to: '[]string'
+ fields:
+ - log.origin.macs
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.service
+ - log.metadata
+ - log.log.offset
+ - log.agent
+ - log.host
+ - log.event
+ - log.ecs
+ - log.log.file
+ - log.roleEnc
+ - log.levelEnc
+ - log.log$$
+ WHERE id=1401;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209018_update_filter_sophos_xg.xml b/backend/src/main/resources/config/liquibase/changelog/20260209018_update_filter_sophos_xg.xml
new file mode 100644
index 000000000..c92284590
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209018_update_filter_sophos_xg.xml
@@ -0,0 +1,760 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}'
+ - fieldName: log.0trash
+ pattern: '{{.data}}\='
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}'
+ - fieldName: log.notDefined
+ pattern: '{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.integer}}\>'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - kv:
+ fieldSplit: " "
+ valueSplit: "="
+ source: log.restData
+
+ # Extracting common fields for all logs
+ - grok:
+ patterns:
+ - fieldName: log.1trash
+ pattern: '{{.data}}log_type='
+ - fieldName: log.type
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.2trash
+ pattern: '{{.data}}log_component='
+ - fieldName: log.component
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.3trash
+ pattern: '{{.data}}log_subtype='
+ - fieldName: log.subType
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ # Parsing the raw field for log_type="Content Filtering" log_component="HTTP" log_subtype="Allowed"
+ - grok:
+ patterns:
+ - fieldName: log.4trash
+ pattern: '{{.data}}user_agent='
+ - fieldName: log.userAgent
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.5trash
+ pattern: '{{.data}}download_file_name='
+ - fieldName: log.downloadfilename
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.6trash
+ pattern: '{{.data}}upload_file_name='
+ - fieldName: log.uploadfilename
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ # Parsing the raw field for log_type="Content Filtering" log_component="Application" log_subtype="Denied"
+ - grok:
+ patterns:
+ - fieldName: log.4trash
+ pattern: '{{.data}}category='
+ - fieldName: log.category
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.5trash
+ pattern: '{{.data}}application_name='
+ - fieldName: log.applicationName
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.6trash
+ pattern: '{{.data}}application_technology='
+ - fieldName: log.applicationTech
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.7trash
+ pattern: '{{.data}}application_category='
+ - fieldName: log.applicationCategory
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.8trash
+ pattern: '{{.data}}message='
+ - fieldName: log.logMessage
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ # Parsing the raw field for log_type="Firewall" log_component="Firewall Rule|Invalid Traffic" log_subtype="Allowed|Denied"
+ - grok:
+ patterns:
+ - fieldName: log.4trash
+ pattern: '{{.data}}ether_type='
+ - fieldName: log.etherType
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ # Parsing the raw field for log_type="Event" log_component="DDNS|DHCP Server|Firewall Authentication" log_subtype="System|Authentication"
+ - grok:
+ patterns:
+ - fieldName: log.4trash
+ pattern: '{{.data}}raw_data='
+ - fieldName: log.rawData
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.5trash
+ pattern: '{{.data}}raw_data='
+ - fieldName: log.rawData
+ pattern: '\"{{.data}}\"'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.6trash
+ pattern: '{{.data}}usergroupname='
+ - fieldName: log.userGroupName
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.7trash
+ pattern: '{{.data}}auth_client='
+ - fieldName: log.authClient
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.8trash
+ pattern: '{{.data}}message='
+ - fieldName: log.logMessage
+ pattern: '\"{{.data}}\"'
+ source: log.restData
+
+ # Renaming useful fields
+ - rename:
+ from:
+ - log.appiscloud
+ to: log.appIsCloud
+
+ - rename:
+ from:
+ - log.category
+ to: log.categoryApp
+
+ - rename:
+ from:
+ - log.categorytype
+ to: log.categoryType
+
+ - rename:
+ from:
+ - log.uploadfilename
+ to: log.uploadFileName
+
+ - rename:
+ from:
+ - log.downloadfiletype
+ to: log.downloadFileType
+
+ - rename:
+ from:
+ - log.downloadfilename
+ to: log.downloadFileName
+
+ - rename:
+ from:
+ - log.uploadfiletype
+ to: log.uploadFileType
+
+ - rename:
+ from:
+ - log.contenttype
+ to: log.contentType
+
+ - rename:
+ from:
+ - log.conid
+ to: log.connectionId
+
+ - rename:
+ from:
+ - log.deviceid
+ to: log.deviceId
+
+ - rename:
+ from:
+ - log.domain
+ to: target.domain
+
+ - rename:
+ from:
+ - log.dstip
+ to: target.ip
+
+ - rename:
+ from:
+ - log.dstport
+ to: target.port
+
+ - rename:
+ from:
+ - log.exceptions
+ to: log.webExceptions
+
+ - rename:
+ from:
+ - log.fwruleid
+ to: log.firewallRuleId
+
+ - rename:
+ from:
+ - log.iap
+ to: log.webPolicy
+
+ - rename:
+ from:
+ - log.logid
+ to: log.Id
+
+ - rename:
+ from:
+ - log.bridgedisplayname
+ to: log.bridgeDisplayName
+
+ - rename:
+ from:
+ - log.bridgename
+ to: log.bridgeName
+
+ - rename:
+ from:
+ - log.recvbytes
+ to: origin.bytesReceived
+
+ - rename:
+ from:
+ - log.sentbytes
+ to: origin.bytesSent
+
+ - rename:
+ from:
+ - log.srcip
+ to: origin.ip
+
+ - rename:
+ from:
+ - log.srcport
+ to: origin.port
+
+ - rename:
+ from:
+ - log.statuscode
+ to: log.statusCode
+
+ - rename:
+ from:
+ - log.protocol
+ to: protocol
+
+ - rename:
+ from:
+ - log.usedquota
+ to: log.responseTime
+
+ - rename:
+ from:
+ - log.usergp
+ to: log.userGroup
+
+ - rename:
+ from:
+ - log.username
+ to: origin.user
+
+ - rename:
+ from:
+ - log.srccountrycode
+ to: log.srcCountryCode
+
+ - rename:
+ from:
+ - log.dstcountrycode
+ to: log.dstCountryCode
+
+ - rename:
+ from:
+ - log.appresolvedby
+ to: log.appResolvedBy
+
+ - rename:
+ from:
+ - log.applicationrisk
+ to: log.applicationRisk
+
+ - rename:
+ from:
+ - log.applicationfilterpolicy
+ to: log.applicationFilterPolicy
+
+ - rename:
+ from:
+ - log.device
+ to: log.deviceType
+
+ - rename:
+ from:
+ - log.devicename
+ to: log.deviceName
+
+ - rename:
+ from:
+ - log.domainname
+ to: log.domainName
+
+ - rename:
+ from:
+ - log.timezone
+ to: log.timeZone
+
+ - rename:
+ from:
+ - log.filename
+ to: target.file
+
+ - rename:
+ from:
+ - log.filepath
+ to: target.path
+
+ - rename:
+ from:
+ - log.indisplayinterface
+ to: log.inDisplayInterface
+
+ - rename:
+ from:
+ - log.ininterface
+ to: log.inInterface
+
+ - rename:
+ from:
+ - log.outdisplayinterface
+ to: log.outDisplayInterface
+
+ - rename:
+ from:
+ - log.outinterface
+ to: log.outInterface
+
+ - rename:
+ from:
+ - log.vlanid
+ to: log.vLanId
+
+ - rename:
+ from:
+ - log.ftpcommand
+ to: command
+
+ - rename:
+ from:
+ - log.FTPurl
+ to: target.url
+
+ - rename:
+ from:
+ - log.FTPdirection
+ to: log.ftpDirection
+
+ - rename:
+ from:
+ - log.ipspolicyid
+ to: log.ipsPolicyId
+
+ - rename:
+ from:
+ - log.appfilterpolicyid
+ to: log.appFilterPolicyId
+
+ - rename:
+ from:
+ - log.natruleid
+ to: log.natRuleId
+
+ - rename:
+ from:
+ - log.srcmac
+ to: origin.mac
+
+ - rename:
+ from:
+ - log.policytype
+ to: log.policyType
+
+ - rename:
+ from:
+ - log.updatedip
+ to: log.updatedIp
+
+ - rename:
+ from:
+ - log.clienthostname
+ to: log.clientHostName
+
+ - rename:
+ from:
+ - log.ipaddress
+ to: origin.ip
+
+ - rename:
+ from:
+ - log.clientphysicaladdress
+ to: log.clientPhysicalAddress
+
+ - rename:
+ from:
+ - log.timestamp
+ to: log.timesTamp
+
+ - rename:
+ from:
+ - log.starttime
+ to: log.startTime
+
+ - rename:
+ from:
+ - log.authmechanism
+ to: log.authMechanism
+
+ - rename:
+ from:
+ - log.eventtype
+ to: log.eventType
+
+ - rename:
+ from:
+ - log.executionpath
+ to: log.executionPath
+
+ - rename:
+ from:
+ - log.loginuser
+ to: log.loginUser
+
+ - rename:
+ from:
+ - log.processuser
+ to: log.processUser
+
+ - rename:
+ from:
+ - log.dstmac
+ to: target.mac
+
+ - rename:
+ from:
+ - log.dstdomain
+ to: target.domain
+
+ # Removing unnecessary characters
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - log.categoryApp
+ - log.categoryType
+ - log.component
+ - log.subType
+ - log.type
+ - log.logMessage
+ - log.contentType
+ - log.deviceName
+ - log.domainName
+ - target.domain
+ - log.inDisplayInterface
+ - log.inInterface
+ - log.outDisplayInterface
+ - log.outInterface
+ - log.vLanId
+ - log.deviceType
+ - command
+ - log.clientHostName
+ - log.ipAddress
+ - log.clientPhysicalAddress
+ - log.authMechanism
+ - log.eventType
+ - log.executionPath
+ - log.loginUser
+ - log.processUser
+ - log.rawData
+ - log.userGroupName
+ - log.authClient
+ - target.file
+ - target.path
+ - log.ftpDirection
+ - target.url
+ - log.downloadFileName
+ - log.downloadFileType
+ - log.uploadFileName
+ - log.uploadFileType
+ - protocol
+ - log.reason
+ - log.referer
+ - log.status
+ - log.statusCode
+ - log.url
+ - log.virus
+ - log.userAgent
+ - log.userGroup
+ - origin.user
+ - log.bridgeName
+ - log.bridgeDisplayName
+ - log.timeZone
+ - log.applicationCategory
+ - log.applicationName
+ - log.applicationTech
+ - log.appResolvedBy
+
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - log.categoryApp
+ - log.categoryType
+ - log.component
+ - log.subType
+ - log.type
+ - log.logMessage
+ - log.contentType
+ - log.deviceName
+ - log.domainName
+ - target.domain
+ - log.inDisplayInterface
+ - log.inInterface
+ - log.outDisplayInterface
+ - log.outInterface
+ - log.vLanId
+ - log.deviceType
+ - command
+ - log.clientHostName
+ - log.ipAddress
+ - log.clientPhysicalAddress
+ - log.authMechanism
+ - log.eventType
+ - log.executionPath
+ - log.loginUser
+ - log.processUser
+ - log.rawData
+ - log.userGroupName
+ - log.authClient
+ - target.file
+ - target.path
+ - log.ftpDirection
+ - target.url
+ - log.downloadFileName
+ - log.downloadFileType
+ - log.uploadFileName
+ - log.uploadFileType
+ - protocol
+ - log.reason
+ - log.referer
+ - log.status
+ - log.statusCode
+ - log.url
+ - log.virus
+ - log.userAgent
+ - log.userGroup
+ - origin.user
+ - log.bridgeName
+ - log.bridgeDisplayName
+ - log.timeZone
+ - log.applicationCategory
+ - log.applicationName
+ - log.applicationTech
+ - log.appResolvedBy
+
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - log.syslogPriority
+
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - log.syslogPriority
+
+ # Adding geolocation to target ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+
+ # Adding geolocation to origin ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+
+ # Field conversions
+ - cast:
+ fields:
+ - target.port
+ to: int
+
+ - cast:
+ fields:
+ - log.statusCode
+ - origin.bytesReceived
+ - origin.bytesSent
+ to: float
+
+ # Renaming "log.statusCode" to "statusCode" to add it to the event structure
+ - rename:
+ from:
+ - log.statusCode
+ to: statusCode
+
+ # Adding actionResult
+ # denied by default
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: (greaterOrEqual("statusCode", 200) && lessOrEqual("statusCode", 299)) || (greaterOrEqual("statusCode", 300) && lessOrEqual("statusCode", 399) && greaterThan("origin.bytesReceived", 0))
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.0trash
+ - log.1trash
+ - log.2trash
+ - log.3trash
+ - log.4trash
+ - log.5trash
+ - log.6trash
+ - log.7trash
+ - log.8trash
+ - log.irrelevant
+ - log.rawdata
+ - log.message
+ - log.restData
+ - log.useragent
+ - log.activityname
+ - log.httpresponsecode
+ - log.overrideauthorizer
+ - log.overridename
+ - log.overridetoken
+ - log.transactionid
+ - log.applicationcategory
+ - log.applicationname
+ - log.applicationtechnology
+ - log.avpolicyname
+ - log.ethertype
+ - log.bridgedisplayname
+ - log.bridgename
+ - log.usergroupname
+ - log.authclient
+ - log.logcomponent
+ - log.logsubtype
+ - log.name
+ - log.logtype$$
+ WHERE id=801;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209019_update_filter_suricata.xml b/backend/src/main/resources/config/liquibase/changelog/20260209019_update_filter_suricata.xml
new file mode 100644
index 000000000..06344fd41
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209019_update_filter_suricata.xml
@@ -0,0 +1,196 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.syslogTimestamp
+ pattern: '{{.monthName}}(\s+){{.monthDay}}(\s+){{.time}}'
+ - fieldName: log.syslogHost
+ pattern: '{{.hostname}}'
+ - fieldName: log.syslogProgram
+ pattern: '{{.word}}'
+ - fieldName: log.syslogPid
+ pattern: '\[{{.integer}}\]: '
+ - fieldName: log.suricataJson
+ pattern: '{{.greedy}}'
+
+ # Parse Suricata JSON logs
+ - json:
+ source: log.suricataJson
+ where: regexMatch("log.suricataJson", "^\\{.*\\}$")
+
+ # Rename fields to conversion v11 schema
+ - rename:
+ from:
+ - log.destip
+ to: target.ip
+
+ - rename:
+ from:
+ - log.destport
+ to: target.port
+
+ - rename:
+ from:
+ - log.flowid
+ to: log.flowId
+
+ - rename:
+ from:
+ - log.host
+ to: target.host
+
+ - rename:
+ from:
+ - log.iniface
+ to: log.inFace
+
+ - rename:
+ from:
+ - log.srcip
+ to: origin.ip
+
+ - rename:
+ from:
+ - log.srcport
+ to: origin.port
+
+ - rename:
+ from:
+ - log.txid
+ to: log.txId
+
+ - rename:
+ from:
+ - log.eventtype
+ to: log.eventType
+
+ - rename:
+ from:
+ - log.appproto
+ to: log.appProto
+
+ - rename:
+ from:
+ - log.proto
+ to: protocol
+
+
+ # Adding severity field based on log.alert.severity
+ - add:
+ function: "string"
+ params:
+ key: severity
+ value: "low"
+ where: equals("log.alert.severity", 1)
+
+ - add:
+ function: "string"
+ params:
+ key: severity
+ value: "medium"
+ where: equals("log.alert.severity", 2)
+
+ - add:
+ function: "string"
+ params:
+ key: severity
+ value: "high"
+ where: equals("log.alert.severity", 3)
+
+ #.......................................................................
+ # Add new eventtypes to logx structure, detected in real logs, present in suricata 7.0.0
+ - rename:
+ from:
+ - log.ftpdata
+ to: log.ftpData
+
+ - rename:
+ from:
+ - log.fileinfo
+ to: log.fileInfo
+
+ # Implementing action field used for established connections
+ - add:
+ function: "string"
+ params:
+ key: action
+ value: "success"
+ where: (equals("log.eventType", "tls") && exists("log.tls.sessionresumed")) ||
+ (equals("log.eventType", "dns") && equals("log.dns.type", "answer")) ||
+ (equals("log.eventType", "flow") && exists("origin.ip") && exists("target.ip") && greaterThan("log.flow.bytestoserver", 0) && greaterThan("log.flow.bytestoclient", 0)) ||
+ (equals("log.eventType", "ssh") && exists("log.ssh.server") && exists("log.ssh.client")) ||
+ (equals("log.eventType", "alert") && exists("origin.ip") && exists("target.ip") && equals("log.alert.action", "allowed") && greaterThan("log.flow.bytestoserver", 0) && greaterThan("log.flow.bytestoclient", 0)) ||
+ (equals("log.eventType", "http") && exists("origin.ip") && exists("target.ip") && exists("log.http.status")) ||
+ (equals("log.eventType", "ftp") && exists("origin.ip") && exists("target.ip") && exists("log.ftp.completioncode")) ||
+ (equals("log.eventType", "tftp") && exists("origin.ip") && exists("target.ip") && !equals("log.tftp.packet", "error")) ||
+ (equals("log.eventType", "smb") && exists("origin.ip") && exists("target.ip") && oneOf("log.smb.command", ["NEGOTIATE"]) && oneOf("log.smb.status", ["SUCCESS", "GRANTED", "CONNECTED"])) ||
+ (equals("log.eventType", "rdp") && exists("origin.ip") && exists("target.ip") && (equals("log.rdp.eventType", "connectresponse") || equals("log.rdp.eventType", "tlshandshake"))) ||
+ (equals("log.eventType", "rfb") && exists("origin.ip") && exists("target.ip") && equals("log.rfb.authentication.security-result", "OK")) ||
+ (equals("log.eventType", "mqtt") && exists("origin.ip") && exists("target.ip") && (equals("log.mqtt.connack.returncode", "0") || equals("log.mqtt.connack.returncode", "0x00"))) ||
+ (equals("log.eventType", "pgsql") && exists("origin.ip") && exists("target.ip") && (exists("log.pgsql.request.simplequery") || exists("log.pgsql.response.commandcompleted") || equals("log.pgsql.response.sslaccepted", "true") || equals("log.pgsql.response.accepted", "true") || exists("log.pgsql.response.authenticationmd5password"))) ||
+ ((equals("log.eventType", "ike") || equals("log.eventType", "ikev1") || equals("log.eventType", "ikev2")) && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "modbus") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "sip") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "quic") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "fileinfo") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "snmp") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "dhcp") && exists("origin.ip") && exists("target.ip") && !equals("log.dhcp.assignedip", "0"))
+
+
+ # Adding geolocation to origin.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+
+ # Adding geolocation to target.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.suricataJson
+ - log.syslogPri
+ - log.syslogTimestamp
+ - log.syslogProgram
+ - log.syslogPid$$
+ WHERE id=1530;
+ ]]>
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209020_update_filter_wineventlog.xml b/backend/src/main/resources/config/liquibase/changelog/20260209020_update_filter_wineventlog.xml
new file mode 100644
index 000000000..6d66f8724
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209020_update_filter_wineventlog.xml
@@ -0,0 +1,2995 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209021_update_filter_crowdstrike.xml b/backend/src/main/resources/config/liquibase/changelog/20260209021_update_filter_crowdstrike.xml
new file mode 100644
index 000000000..edccb87b8
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209021_update_filter_crowdstrike.xml
@@ -0,0 +1,330 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209022_update_correlation_rules.xml b/backend/src/main/resources/config/liquibase/changelog/20260209022_update_correlation_rules.xml
new file mode 100644
index 000000000..fa53ecbf1
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209022_update_correlation_rules.xml
@@ -0,0 +1,22 @@
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209023_update_system_owner_correlation_rules.xml b/backend/src/main/resources/config/liquibase/changelog/20260209023_update_system_owner_correlation_rules.xml
new file mode 100644
index 000000000..40503050a
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209023_update_system_owner_correlation_rules.xml
@@ -0,0 +1,13 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260209024_update_filter_utmstack.xml b/backend/src/main/resources/config/liquibase/changelog/20260209024_update_filter_utmstack.xml
new file mode 100644
index 000000000..3d8751840
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260209024_update_filter_utmstack.xml
@@ -0,0 +1,39 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210001_update_filter_cisco_asa.xml b/backend/src/main/resources/config/liquibase/changelog/20260210001_update_filter_cisco_asa.xml
new file mode 100644
index 000000000..809279343
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210001_update_filter_cisco_asa.xml
@@ -0,0 +1,5939 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field containing the Cisco ASA log
+pipeline:
+ - dataTypes:
+ - firewall-cisco-asa
+ steps:
+ # Common ASA fields
+ - grok:
+ patterns:
+ - fieldName: log.syslogPri
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '({{.day}}\s)?{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.asaHeader
+ pattern: '{{.data}}ASA-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '({{.day}}\s)?{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.asaHeader
+ pattern: '{{.data}}ASA-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ #......................................................................#
+ # Adding log.localIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localIp
+ destination: log.localIp.geolocation
+ where: exists("log.localIp")
+ # Removing unwanted prefixes
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.messageId
+ # Field conversions
+ - cast:
+ fields:
+ - log.messageId
+ to: int
+ # Begining specific message parsing
+ #......................................................................#
+ # ASA-2-106001
+ - grok:
+ patterns:
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'flags'
+ - fieldName: log.flags
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106001
+
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==106001
+
+ #......................................................................#
+ #ASA-2-106017
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sdue\sto'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ source: log.msg
+ where: log.messageId==106017
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId==106017
+ #......................................................................#
+ # ASA-1-106021
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106021
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId==106021
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==106021
+ #......................................................................#
+ # ASA-2-106101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Number of cached deny-flows for ACL log has reached limit'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106101
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Number of cached'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==106101
+ # Parsing the limit number
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.numFlows
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==106101
+ # Field conversions
+ - cast:
+ fields:
+ - log.numFlows
+ to: int
+ where: log.messageId==106101
+
+ #......................................................................#
+ # ASA-6-106102,106103
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106102 || log.messageId==106103
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==106102 || log.messageId==106103
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==106102 || log.messageId==106103
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("actionResult", "Permitted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && !equalsIgnoreCase("actionResult", "Permitted")
+ #......................................................................#
+ # ASA-4-109017
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'User at'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'exceeded auth proxy connection limit'
+ - fieldName: log.limit
+ pattern: '\({{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109017
+
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.limit
+ where: log.messageId==109017
+ - cast:
+ fields:
+ - log.limit
+ to: int
+ where: log.messageId==109017
+ #......................................................................#
+ # ASA-6-109101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA disconnect request'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with\saudit-session-id:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109101
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==109101
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: log.messageId==109101
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==109101
+ #......................................................................#
+ # ASA-4-109102
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ', but cannot find named session'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109102
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==109102
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==109102
+ #......................................................................#
+ # ASA-3-109103
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'failed for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with session ID:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==109103
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==109103
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: log.messageId==109103
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==109103
+ #......................................................................#
+ # ASA-109201 to 109213
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'UAUTH(:)? Session(\s|=)'
+ - fieldName: log.session
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'User(\s|=)'
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Assigned IP(\s|=)'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId>=109201 && log.messageId<=109213
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.session
+ - origin.user
+ where: log.messageId>=109201 && log.messageId<=109213
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId>=109201 && log.messageId<=109213
+ #......................................................................#
+ # ASA-6-113004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user {{.word}} Successful'
+ - fieldName: log.irrelevant
+ pattern: '\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113004
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user {{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113004
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - target.ip
+ where: log.messageId==113004
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - target.ip
+ where: log.messageId==113004
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113004
+ #......................................................................#
+ # ASA-6-113005
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(server|Server)(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113005
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113005
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: log.messageId==113005
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113005
+ #......................................................................#
+ # ASA-6-113008
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA transaction status ACCEPT(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113008
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113008
+ #......................................................................#
+ # ASA-6-113009
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113009
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: log.messageId==113009
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: log.messageId==113009
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113009
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: log.messageId==113009
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113009
+ #......................................................................#
+ # ASA-6-113010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA challenge received for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}) from server'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113010
+ - trim:
+ function: suffix
+ substring: 'from server'
+ fields:
+ - origin.user
+ where: log.messageId==113010
+ #......................................................................#
+ # ASA-6-113011
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113011
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: log.messageId==113011
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: log.messageId==113011
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113011
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: log.messageId==113011
+ #......................................................................#
+ # ASA-6-113012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Successful(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?local database(\s)?:(\s)?user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113012
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113012
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113012
+ #......................................................................#
+ # ASA-6-113013
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA unable to complete the request'
+ - fieldName: log.irrelevant
+ pattern: 'Error(\s)?:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}\:'
+ - fieldName: log.irrelevant
+ pattern: 'user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113013
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ where: log.messageId==113013
+ #......................................................................#
+ # ASA-6-113014
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA authentication server not accessible(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113014
+ #......................................................................#
+ # ASA-6-113015, 113017
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(AAA user authentication|AAA credentials)\s(R|r)ejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'local database(\s)?:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113015 || log.messageId==113017
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - origin.user
+ where: log.messageId==113015 || log.messageId==113017
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(AAA user authentication|AAA credentials)\s'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113015 || log.messageId==113017
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113015 || log.messageId==113017
+ #......................................................................#
+ # ASA-6-113016
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA credentials rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113016
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: log.messageId==113016
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA credentials'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==113016
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113016
+ #......................................................................#
+ # ASA-4-113019
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?=(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)sername(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: action
+ pattern: '(\s)?Session disconnected\.'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Session Type:(\s)?'
+ - fieldName: log.sessionType
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Duration:(\s)?'
+ - fieldName: log.duration
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes xmt:(\s)?'
+ - fieldName: origin.bytesSent
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes rcv:(\s)?'
+ - fieldName: origin.bytesReceived
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Reason:(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113019
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ - log.sessionType
+ - log.duration
+ - origin.bytesSent
+ - origin.bytesReceived
+ where: log.messageId==113019
+ - cast:
+ fields:
+ - origin.bytesSent
+ - origin.bytesReceived
+ to: int
+ where: log.messageId==113019
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113019
+ #......................................................................#
+ # ASA-113031,113032,113033
+ # Common fields
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ # Specific fields
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.filter
+ pattern: '{{.data}}\sis'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'is'
+ fields:
+ - log.filter
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113031 || log.messageId==113032 || log.messageId==113033
+ #......................................................................#
+ # ASA-113034,113035,113036,113038,113039
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '(\<)?{{.data}}(\>)?\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|(\<)?{{.data}}(\>)?)(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==113034 || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==113039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==113035 || log.messageId==113038
+ #......................................................................#
+ # ASA-4-113042
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA: Non-HTTP connection from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: log.remoteUser
+ pattern: '(''{{.data}}''|{{.data}})(\s)?at'
+ - fieldName: log.remoteIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==113042
+ - trim:
+ function: suffix
+ substring: 'at'
+ fields:
+ - log.remoteUser
+ where: log.messageId==113042
+ #......................................................................#
+ # ASA-2-201003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit exceeded'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.globalIp
+ pattern: '\({{.data}}\)'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.dstInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==201003
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.globalIp
+ where: log.messageId==201003
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.globalIp
+ where: log.messageId==201003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==201003
+ #......................................................................#
+ # ASA-4-209003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Fragment database limit of'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'exceeded:(\s)?src(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'dest(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'proto(\s)?=(\s)?'
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'id(\s)?=(\s)?'
+ - fieldName: log.id
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==209003
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.ip
+ - target.ip
+ - protocol
+ where: log.messageId==209003
+ - cast:
+ fields:
+ - log.limit
+ to: int
+ where: log.messageId==209003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==209003
+ #......................................................................#
+ # ASA-3-316001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Denied new tunnel'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==316001
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==316001
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==316001
+ #......................................................................#
+ # ASA-3-316002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'VPN Handle error'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?protocol='
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'src\s'
+ - fieldName: log.inIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?dst'
+ - fieldName: log.outIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==316002
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - protocol
+ where: log.messageId==316002
+ - cast:
+ fields:
+ - log.inIfNum
+ - log.outIfNum
+ to: int
+ where: log.messageId==316002
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==316002
+ #......................................................................#
+ # ASA-302003,302004
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.irrelevant
+ pattern: '(to\s)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: log.messageId==302003 || log.messageId==302004
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: log.messageId==302003 || log.messageId==302004
+ # Parsing from/to ip and port
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpToip
+ where: log.messageId==302003 || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpToip
+ where: log.messageId==302003 || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '{{.greedy}}'
+ source: log.tmpFromip
+ where: log.messageId==302003 || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpFromip
+ where: log.messageId==302003 || log.messageId==302004
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: log.messageId==302003 || log.messageId==302004
+ # Removing temp fields
+ - delete:
+ fields:
+ - log.tmpFromip
+ - log.tmpToip
+ where: log.messageId==302003 || log.messageId==302004
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302003 || log.messageId==302004
+ #......................................................................#
+ # ASA-6-302012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Pre-allocate H225 Call Signalling Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '/(\s)?{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to laddr'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302012
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ where: log.messageId==302012
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302012
+ #......................................................................#
+ # ASA-6-302013
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302013
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: log.messageId==302013
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302013
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302013
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302013
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302013
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: log.messageId==302013
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302013
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302013
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302013
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302013
+ #......................................................................#
+ # ASA-6-302014
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302014
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302014
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302014
+ # Parsing AAA user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302014
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302014
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302014
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302014
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302014
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302014
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302014
+ #......................................................................#
+ # ASA-6-302015
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302015
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: log.messageId==302015
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302015
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302015
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302015
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302015
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: log.messageId==302015
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302015
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302015
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302015
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302015
+ #......................................................................#
+ # ASA-6-302016
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302016
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302016
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302016
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: log.messageId==302016
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302016
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302016
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302016
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302016
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302016
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302016
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302016
+ #......................................................................#
+ # ASA-6-302017
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302017
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302017
+ # Parsing translatedCid and, firewall user to and AAA user if present
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpUserInfo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==302017
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302017
+ # FW user and AAA user
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ - fieldName: target.user
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: log.messageId==302017
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: log.messageId==302017
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - target.user
+ - log.translatedCid
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ - target.user
+ where: log.messageId==302017
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpUserInfo
+ where: log.messageId==302017
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: log.messageId==302017
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302017
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302017
+ #......................................................................#
+ # ASA-6-302018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302018
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302018
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302018
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: log.messageId==302018
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: log.messageId==302018
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.translatedCid
+ where: log.messageId==302018
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302018
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ where: log.messageId==302018
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302018
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: log.messageId==302018
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302018
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302018
+ #......................................................................#
+ # ASA-6-302020, 302021
+ # 302020
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302020
+ # 302021
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302021
+ # Common parsing for 302020 and 302021
+ # For parsing faddr and fwuser from (Begin with ip/port), or icmpSeqNum
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # icmpSeqNum variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Cleaning icmpSeqNum
+ - trim:
+ function: suffix
+ substring: 'gaddr'
+ fields:
+ - log.icmpSeqNum
+ where: log.messageId==302020 || log.messageId==302021
+ # Continue with firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302020 || log.messageId==302021
+ # For parsing gaddr and global fwuser (Begin with ip/port), or icmpType
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.globalPort
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # icmpType variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Cleaning icmpType
+ - trim:
+ function: suffix
+ substring: 'laddr'
+ fields:
+ - log.icmpType
+ where: log.messageId==302020 || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: 'code'
+ fields:
+ - log.icmpType
+ where: log.messageId==302020 || log.messageId==302021
+ # Continue with global firewall
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.globalFirewallUser
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserGlobal
+ where: log.messageId==302020 || log.messageId==302021
+ # For parsing laddr and fwuser to (Begin with ip/port)
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Continue with firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302020 || log.messageId==302021
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - origin.ip
+ where: log.messageId==302020 || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - log.globalFirewallUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpFwUserGlobal
+ - log.tmpFaddrAndFwUser
+ - log.tmpGaddrAndFwUser
+ - log.tmpLaddrAndFwUser
+ where: log.messageId==302020 || log.messageId==302021
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302020 || log.messageId==302021
+ #......................................................................#
+ # ASA-6-302022, 302024, 302026
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.role
+ pattern: '({{.data}})stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortTo
+ pattern: '\({{.data}}\)'
+ source: log.msg
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port to, from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'stub'
+ fields:
+ - log.role
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpMappedIpPortFrom
+ - log.tmpMappedIpPortTo
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302022 || log.messageId==302024 || log.messageId==302026
+ #......................................................................#
+ # ASA-6-302023, 302025, 302027
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302023 || log.messageId==302025 || log.messageId==302027
+ #......................................................................#
+ # ASA-302033,302034
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Pre-allocated|Unable to pre-allocate) H323 GUP Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.tmpPortFrom
+ pattern: '{{.data}}to laddr'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.tmpIpPortTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302033 || log.messageId==302034
+ # Parsing optional ports from y to
+ - grok:
+ patterns:
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpPortFrom
+ where: log.messageId==302033 || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpIpPortTo
+ where: log.messageId==302033 || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ source: log.tmpIpPortTo
+ where: log.messageId==302033 || log.messageId==302034
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302033 || log.messageId==302034
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302033 || log.messageId==302034
+ # Remove tmp fields
+ - delete:
+ fields:
+ - log.tmpPortFrom
+ - log.tmpIpPortTo
+ where: log.messageId==302033 || log.messageId==302034
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302033
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==302034
+ #......................................................................#
+ #ASA-6-302035
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}\s{{.word}}\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302035
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: log.messageId==302035
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302035
+ # Parsing port to, firewall user to, and, from user
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==302035
+ # Without user info
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.rest
+ where: log.messageId==302035
+ # Parsing firewall user to
+ # With origin.user
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302035
+ # Without origin.user
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302035
+
+ # Decoding outside and inside sg_info
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserFrom
+ where: log.messageId==302035
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserTo
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.insideSgInfo
+ - log.outsideSgInfo
+ where: log.messageId==302035
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302035
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302035
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302035
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302035
+ #......................................................................#
+ # ASA-6-302036
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302036
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302036
+ # Decoding outside and inside firewall user, and sg_info
+ # Side from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302036
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302036
+ # Side to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302036
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: log.messageId==302036
+ # Parsing origin.user from log.reason field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.reason
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: log.messageId==302036
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302036
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302036
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302036
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302036
+ #......................................................................#
+ # ASA-6-302303
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302303
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302303
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302303
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302303
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302303
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302303
+ #......................................................................#
+ # ASA-6-302304
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302304
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302304
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302304
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302304
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: log.messageId==302304
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302304
+ #......................................................................#
+ # ASA-6-302305
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302305
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302305
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302305
+ # Parsing port to, firewall user to, and, from user
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: log.messageId==302305
+ # Without user info
+ - grok:
+ patterns:
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.rest
+ where: log.messageId==302305
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302305
+
+ # Decoding outside and inside sg_info
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserFrom
+ where: log.messageId==302305
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserTo
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.insideSgInfo
+ - log.outsideSgInfo
+ where: log.messageId==302305
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302305
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302305
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302305
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302305
+ #......................................................................#
+ # ASA-6-302306
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==302306
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==302306
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==302306
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.tmpFwUserTo
+ where: log.messageId==302306
+
+ # Decoding outside and inside sg_info
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.outsideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserFrom
+ where: log.messageId==302306
+ - grok:
+ patterns:
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.insideSgInfo
+ pattern: '{{.data}}\)'
+ source: log.firewallUserTo
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - log.insideSgInfo
+ - log.outsideSgInfo
+ where: log.messageId==302306
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: log.messageId==302306
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: log.messageId==302306
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ where: log.messageId==302306
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==302306
+ #......................................................................#
+ # ASA-6-305009
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.mappedIpTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==305009
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305009
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305009
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305009
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: log.messageId==305009
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: log.messageId==305009
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305009
+ #......................................................................#
+ # ASA-6-305010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: log.messageId==305010
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305010
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: log.messageId==305010
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305010
+ #......................................................................#
+ # ASA-6-305011
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: log.messageId==305011
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305011
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==305011
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: log.messageId==305011
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ where: log.messageId==305011
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305011
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==305011
+ #......................................................................#
+ # ASA-6-305012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: log.messageId==305012
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: log.messageId==305012
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==305012
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305012
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: log.messageId==305012
+ # Parsing srcInterface from himself to avoid parsing issues
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.srcInterface
+ where: log.messageId==305012
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: log.messageId==305012
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ where: log.messageId==305012
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: log.messageId==305012
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: log.messageId==305012
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==305012
+ #......................................................................#
+ # ASA-3-322001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sMAC\saddress'
+ - fieldName: log.localMac
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.reason
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==322001
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==322001
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.localMac
+ where: log.messageId==322001
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - log.reason
+ where: log.messageId==322001
+ #......................................................................#
+ # ASA-3-322002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.boudSrcMac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==322002
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: log.messageId==322002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: log.messageId==322002
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: log.messageId==322002
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: log.messageId==322002
+ #......................................................................#
+ # ASA-3-322003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==322003
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: log.messageId==322003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: log.messageId==322003
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: log.messageId==322003
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: log.messageId==322003
+ #......................................................................#
+ # ASA-4-400000 to 400050
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPS\:(\s)?'
+ - fieldName: log.signatureId
+ pattern: '{{.integer}}'
+ - fieldName: action
+ pattern: '{{.data}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId>=400000 && log.messageId<=400050
+ # Cleaning action before extract protocol
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: log.messageId>=400000 && log.messageId<=400050
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: (log.messageId>=400000 && log.messageId<=400022) || (log.messageId>=400026 && log.messageId<=400040)
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==400023 || log.messageId==400024 || log.messageId==400041
+ #......................................................................#
+ # ASA-4-402114
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402114
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402114
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402114
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ where: log.messageId==402114
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402114
+ #......................................................................#
+ # ASA-4-402115
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\sa\spacket'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'containing'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'data instead of'
+ - fieldName: log.expectedProtocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402115
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402115
+ #......................................................................#
+ # ASA-4-402116
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktDestAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktSrcAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktProto
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.localProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyPort
+ pattern: '{{.data}}and'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.remoteProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyPort
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402116
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402116
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.localProxyIpAddr
+ - log.localProxyIpMask
+ - log.localProxyProto
+ - log.remoteProxyIpAddr
+ - log.remoteProxyIpMask
+ - log.remoteProxyPort
+ - log.remoteProxyProto
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402116
+ - trim:
+ function: suffix
+ substring: 'and'
+ fields:
+ - log.localProxyPort
+ where: log.messageId==402116
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402116
+ #......................................................................#
+ # ASA-4-402117
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received a non-IPsec \((\s)?{{.word}}(\s)?\) packet'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402117
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received a non-IPsec \('
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402117
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402117
+ #......................................................................#
+ # ASA-4-402118
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}length'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'with offset'
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: log.messageId==402118
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402118
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402118
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402118
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402118
+ #......................................................................#
+ # ASA-4-402119, 402120
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==402119 || log.messageId==402120
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==402119 || log.messageId==402120
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: log.messageId==402119 || log.messageId==402120
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: log.messageId==402119 || log.messageId==402120
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==402119 || log.messageId==402120
+ #......................................................................#
+ # ASA-5-402128
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CRYPTO\:(\s)?'
+ - fieldName: action
+ pattern: 'An attempt to allocate a large memory block'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memorySize
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memoryLimit
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: log.messageId==402128
+ #......................................................................#
+ # ASA-4-405001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received ARP (request|response) collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}with'
+ - fieldName: log.irrelevant
+ pattern: 'existing ARP entry'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.mac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==405001
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ARP'
+ where: log.messageId==405001
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==405001
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: log.messageId==405001
+ - trim:
+ function: suffix
+ substring: 'with'
+ fields:
+ - log.srcInterface
+ where: log.messageId==405001
+ #......................................................................#
+ # ASA-4-405002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received mac mismatch collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==405002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - origin.mac
+ where: log.messageId==405002
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: log.messageId==405002
+ #......................................................................#
+ # ASA-4-406001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command low port(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==406001
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: log.messageId==406001
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: log.messageId==406001
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: log.messageId==406001
+ #......................................................................#
+ # ASA-4-406002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command different address(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.connectionIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==406002
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: log.messageId==406002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: log.messageId==406002
+ #......................................................................#
+ # ASA-4-407002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit {{.data}} for through connections exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\.'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==407002
+ # Connection number and connection limit
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Embryonic limit'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==407002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==407002
+ #......................................................................#
+ # ASA-6-603109
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown PPPOE Tunnel'
+ - fieldName: log.irrelevant
+ pattern: 'at'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'tunnel-id(\s)?=(\s)?'
+ - fieldName: log.tunnelId
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'remote-peer(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==603109
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==603109
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.srcInterface
+ - log.tunnelId
+ where: log.messageId==603109
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==603109
+ #......................................................................#
+ # ASA-6-605004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Login\s{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.service
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'user'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==605004
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Login'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ source: action
+ where: log.messageId==605004
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==605004
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==605004
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.service
+ where: log.messageId==605004
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: log.messageId==605004
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - origin.user
+ where: log.messageId==605004
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - origin.user
+ where: log.messageId==605004
+ #......................................................................#
+ # ASA-6-617100
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown {{.integer}} connection(\s)?(\(s\))?'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==617100
+ # Connection number
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==617100
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==617100
+ #......................................................................#
+ # ASA-2-106018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'ICMP packet'
+ - fieldName: log.irrelevant
+ pattern: 'type'
+ - fieldName: log.icmpType
+ pattern: '{{.data}}\s'
+ - fieldName: log.ciscoResult
+ pattern: 'denied'
+ - fieldName: log.irrelevant
+ pattern: 'by'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}src'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'dest'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106018
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ICMP'
+ where: log.messageId==106018
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - log.accessList
+ where: log.messageId==106018
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==106018
+ #......................................................................#
+ # ASA-2-106020
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Deny IP teardrop fragment'
+ - fieldName: log.irrelevant
+ pattern: '\((\s)?size(\s)?='
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?offset(\s)?='
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)(\s)?from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==106020
+ # Adding log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: log.ciscoResult
+ value: 'Denied'
+ where: log.messageId==106020
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==106020
+ #......................................................................#
+ # ASA-6-611301
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with no split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611301
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: log.messageId==611301
+ #......................................................................#
+ # ASA-6-611303
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611303
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: log.messageId==611303
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==611303
+ #......................................................................#
+ # ASA-6-611304
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT exemption configured for Network Extension Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611304
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: log.messageId==611304
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==611304
+ #......................................................................#
+ # ASA-6-611307
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Head end\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611307
+ # Adding action and log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'The VPN client is connected to the specified headend'
+ where: log.messageId==611307
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611307
+ #......................................................................#
+ # ASA-6-611309
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'Disconnecting from head end and uninstalling previously downloaded policy'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}End\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611309
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611309
+ #......................................................................#
+ # ASA-6-611310,611311
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'XAUTH'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?Peer(\s)?\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611310 || log.messageId==611311
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611310
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==611311
+ #......................................................................#
+ # ASA-6-611314
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Load Balancing Cluster with Virtual IP\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}server'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611314
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Load Balancing Cluster redirected the Secure Firewall'
+ where: log.messageId==611314
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611314
+ #......................................................................#
+ # ASA-6-611315
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Disconnecting from Load Balancing Cluster member(\:)?(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611315
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Disconnecting from Load Balancing Cluster'
+ where: log.messageId==611315
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==611315
+ #......................................................................#
+ # ASA-6-611318
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'User Authentication Enabled'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}IP(\s)?\:'
+ - fieldName: log.authServerIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Port(\s)?\:'
+ - fieldName: log.authServerPort
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}out(\s)?\:'
+ - fieldName: log.timeOut
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==611318
+ #......................................................................#
+ # ASA-3-710003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(TCP|UDP) access denied by ACL'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==710003
+ # Protocol and log.ciscoResult
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==710003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: log.messageId==710003
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: log.messageId==710003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==710003
+ #......................................................................#
+ # ASA-5-713252,713253
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Username(\s)?='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}available(\.)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==713252 || log.messageId==713253
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==713252 || log.messageId==713253
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==713252 || log.messageId==713253
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==713252 || log.messageId==713253
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==713252
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==713253
+ #......................................................................#
+ # ASA-6-716001,716002,716003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716001 || log.messageId==716002 || log.messageId==716003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==716001 || log.messageId==716002
+ #......................................................................#
+ # ASA-6-716004,716005,716006,716007,716009
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716004 || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==716004 || log.messageId==716007 || log.messageId==716009
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==716006
+ #......................................................................#
+ # ASA-6-716038
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716038
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==716038
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: log.messageId==716038
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: log.messageId==716038
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==716038
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ where: log.messageId==716038
+ #......................................................................#
+ # ASA-6-716039
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==716039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==716039
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ - origin.user
+ where: log.messageId==716039
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - origin.group
+ where: log.messageId==716039
+ #......................................................................#
+ # ASA-6-719017,719019,719020,719021,719022,719023
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==719017 || (log.messageId>=719019 && log.messageId<=719023)
+ # Adding log.ciscoResult and modifying some actions
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==719019 || log.messageId==719023
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==719020 || log.messageId==719022
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user is not checked against ACL'
+ where: log.messageId==719021
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has been authenticated'
+ where: log.messageId==719022
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has not been authenticated'
+ where: log.messageId==719023
+ # Cleaning fields
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==719017 || (log.messageId>=719019 && log.messageId<=719023)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==719017 || (log.messageId>=719019 && log.messageId<=719023)
+ #......................................................................#
+ # ASA-6-719018
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'ACL ID'
+ - fieldName: log.accessList
+ pattern: '{{.data}}not'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==719018
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: log.messageId==719018
+ - trim:
+ function: suffix
+ substring: 'not'
+ fields:
+ - log.accessList
+ where: log.messageId==719018
+ #......................................................................#
+ # ASA-6-719024
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Email Proxy piggyback auth fail'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.sessionPointer
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}}addr'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==719024
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - log.sessionPointer
+ where: log.messageId==719024
+ - trim:
+ function: suffix
+ substring: 'addr'
+ fields:
+ - origin.user
+ where: log.messageId==719024
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: log.messageId==719024
+ #......................................................................#
+ # ASA-7-609002
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown local-host'
+ - fieldName: log.zoneName
+ pattern: '{{.data}}/'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==609002
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.zoneName
+ where: log.messageId==609002
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==609002
+ #......................................................................#
+ # ASA-6-611305
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient(\s)?\:'
+ - fieldName: action
+ pattern: 'DHCP Policy installed'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.primaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.secondaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.primaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.secondaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: log.messageId==611305
+ #......................................................................#
+ # ASA-4-733100
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==733100
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: log.messageId==733100
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.data}}drop'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==733100
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'drop'
+ fields:
+ - log.dropSourceObject
+ where: log.messageId==733100
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.dropSourceObject
+ where: log.messageId==733100
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.dropSourceObject
+ where: log.messageId==733100
+ #......................................................................#
+ # ASA-4-733101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}(targeted|attacking)'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==733101
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: log.messageId==733101
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.word}}'
+ - fieldName: log.tmpIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: log.messageId==733101
+ # Renaming from or to ip, according to -> if (targeted|attacking)
+ - rename:
+ from:
+ - log.tmpIp
+ to: origin.ip
+ where: log.messageId==733101 && contains("action", "attacking")
+ - rename:
+ from:
+ - log.tmpIp
+ to: target.ip
+ where: log.messageId==733101 && contains("action", "targeted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: log.messageId==733101
+ #......................................................................#
+ # ASA-4-733102, 733103
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}host'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: log.messageId==733102 || log.messageId==733103
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection add host to shun list'
+ where: (equals("log.messageId", 733102) || equals("log.messageId", 733103)) && contains("log.msg", "add")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection removes host to shun list'
+ where: (equals("log.messageId", 733102) || equals("log.messageId", 733103)) && contains("log.msg", "removes")
+ #......................................................................#
+ # Decoding severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severity", ["1", "2", "3"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: log.severity=="4"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severity", ["5", "6", "7"])
+ #......................................................................#
+ # Adding common geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+ # Adding log.mappedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpFrom
+ destination: log.mappedIpFrom.geolocation
+ where: exists("log.mappedIpFrom")
+ # Adding log.mappedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpTo
+ destination: log.mappedIpTo.geolocation
+ where: exists("log.mappedIpTo")
+ # Adding log.translatedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpFrom
+ destination: log.translatedIpFrom.geolocation
+ where: exists("log.translatedIpFrom")
+ # Adding log.translatedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpTo
+ destination: log.translatedIpTo.geolocation
+ where: exists("log.translatedIpTo")
+ # Adding log.globalIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.globalIp
+ destination: log.globalIp.geolocation
+ where: exists("log.globalIp")
+ # Adding log.remoteIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteIp
+ destination: log.remoteIp.geolocation
+ where: exists("log.remoteIp")
+ # Adding log.mappedIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIp
+ destination: log.mappedIp.geolocation
+ where: exists("log.mappedIp")
+ # Adding log.decapsulatedPktDestAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktDestAddr
+ destination: log.decapsulatedPktDestAddr.geolocation
+ where: exists("log.decapsulatedPktDestAddr")
+ # Adding log.decapsulatedPktSrcAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktSrcAddr
+ destination: log.decapsulatedPktSrcAddr.geolocation
+ where: exists("log.decapsulatedPktSrcAddr")
+ # Adding log.localProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localProxyIpAddr
+ destination: log.localProxyIpAddr.geolocation
+ where: exists("log.localProxyIpAddr")
+ # Adding log.remoteProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteProxyIpAddr
+ destination: log.remoteProxyIpAddr.geolocation
+ where: exists("log.remoteProxyIpAddr")
+ # Adding log.primaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryDns
+ destination: log.primaryDns.geolocation
+ where: exists("log.primaryDns")
+ # Adding log.secondaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryDns
+ destination: log.secondaryDns.geolocation
+ where: exists("log.secondaryDns")
+ # Adding log.primaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryWins
+ destination: log.primaryWins.geolocation
+ where: exists("log.primaryWins")
+ # Adding log.secondaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryWins
+ destination: log.secondaryWins.geolocation
+ where: exists("log.secondaryWins")
+ #......................................................................#
+ # Common field conversions
+ - cast:
+ fields:
+ - origin.port
+ - target.port
+ to: int
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.asaHeader
+ - log.ciscoSeparator
+ - log.irrelevant
+ - log.syslogPri
+ - log.rest
+
+
+ $$
+ WHERE id = 301 ;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210002_update_filter_cisco_switch.xml b/backend/src/main/resources/config/liquibase/changelog/20260210002_update_filter_cisco_switch.xml
new file mode 100644
index 000000000..207beaa8e
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210002_update_filter_cisco_switch.xml
@@ -0,0 +1,181 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field
+pipeline:
+ - dataTypes:
+ - cisco-switch
+ steps:
+ # Header fields
+ - grok:
+ patterns:
+ - fieldName: log.switchHeader
+ pattern: '{{.data}}%'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.irrelevant
+ pattern: '{{.integer}}(\s)?\:'
+ - fieldName: log.ciscoTime
+ pattern: '{{.greedy}}'
+ source: log.switchHeader
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}{{.greedy}}'
+ source: log.switchHeader
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}{{.greedy}}'
+ source: log.switchHeader
+ #......................................................................#
+ # Beginning message parsing
+ # Variant -> %FACILITY-SUBFACILITY-SEVERITY-MNEMONIC: Message-text
+ - grok:
+ patterns:
+ - fieldName: log.facility
+ pattern: '{{.data}}-'
+ - fieldName: log.severity
+ pattern: '{{.data}}{{.integer}}'
+ - fieldName: log.facilityMnemonic
+ pattern: '{{.data}}\:'
+ - fieldName: log.ciscoMsg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: '(!contains("log.msg", "-MSG:SLOT")) && (!contains("log.msg", "-MSG: SLOT"))'
+ # Extracting subfacility if present
+ - grok:
+ patterns:
+ - fieldName: log.subFacility
+ pattern: '{{.greedy}}-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ source: log.severity
+ where: '(!contains("log.msg", "-MSG:SLOT")) && (!contains("log.msg", "-MSG: SLOT"))'
+ # --------------------------
+ # Variant -> %CARD-SEVERITY-MSG:SLOT %FACILITY-SEVERITY-MNEMONIC: Message-text
+ - grok:
+ patterns:
+ - fieldName: log.card
+ pattern: '{{.data}}-'
+ - fieldName: log.irrelevant
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.slot
+ pattern: 'SLOT{{.integer}}'
+ - fieldName: log.tmpFacilityMnemonic
+ pattern: '{{.data}}\:'
+ - fieldName: log.ciscoMsg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
+
+ - trim:
+ function: prefix
+ substring: '%'
+ fields:
+ - log.tmpFacilityMnemonic
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
+ # %FACILITY-SEVERITY-MNEMONIC
+ - grok:
+ patterns:
+ - fieldName: log.facility
+ pattern: '{{.data}}-'
+ - fieldName: log.severity
+ pattern: '{{.data}}{{.integer}}'
+ - fieldName: log.facilityMnemonic
+ pattern: '{{.data}}\:'
+ source: log.tmpFacilityMnemonic
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
+ # Extracting subfacility if present
+ - grok:
+ patterns:
+ - fieldName: log.subFacility
+ pattern: '{{.greedy}}-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ source: log.severity
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
+
+ # Cleaning common fields
+ - trim:
+ function: suffix
+ substring: '-'
+ fields:
+ - log.facility
+ - log.subFacility
+ - log.card
+ - trim:
+ function: suffix
+ substring: '%'
+ fields:
+ - log.ciscoTime
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.facilityMnemonic
+ - log.ciscoTime
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.facilityMnemonic
+ #......................................................................#
+ # Decoding severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severity", ["0", "1", "2", "3"])
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: log.severity=="4"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severity", ["5", "6", "7"])
+ #......................................................................#
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.switchHeader
+ - log.irrelevant
+ - log.tmpFacilityMnemonic
+ $$
+ WHERE id = 1510 ;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210003_update_filter_cisco_firepower.xml b/backend/src/main/resources/config/liquibase/changelog/20260210003_update_filter_cisco_firepower.xml
new file mode 100644
index 000000000..2e35a2350
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210003_update_filter_cisco_firepower.xml
@@ -0,0 +1,5161 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field containing the Cisco Firepower log
+pipeline:
+ - dataTypes:
+ - firewall-cisco-firepower
+ steps:
+ # Common Firepower fields
+ - grok:
+ patterns:
+ - fieldName: log.syslogPri
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '{{.day}}\s{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.firePowerHeader
+ pattern: '{{.data}}FTD-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '{{.day}}\s{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.firePowerHeader
+ pattern: '{{.data}}FTD-'
+ - fieldName: log.severity
+ pattern: '{{.integer}}'
+ - fieldName: log.messageId
+ pattern: '-{{.integer}}'
+ - fieldName: log.ciscoSeparator
+ pattern: '\:{{.space}}'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ #......................................................................#
+ # Adding log.localIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localIp
+ destination: log.localIp.geolocation
+ where: exists("log.localIp")
+ # Removing unwanted prefixes
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.messageId
+ # Field conversions
+ - cast:
+ fields:
+ - log.messageId
+ to: int
+ # Begining specific message parsing
+ #......................................................................#
+ # FTD-2-106001
+ - grok:
+ patterns:
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '/{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'flags'
+ - fieldName: log.flags
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106001)
+
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 106001)
+ #......................................................................#
+ # FTD-2-106017
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sdue\sto'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ source: log.msg
+ where: equals("log.messageId", 106017)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: equals("log.messageId", 106017)
+ #......................................................................#
+ # FTD-1-106021
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: action
+ pattern: '{{.greedy}}from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.irrelevant
+ pattern: 'on\sinterface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106021)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: equals("log.messageId", 106021)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 106021)
+ #......................................................................#
+ # FTD-2-106101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Number of cached deny-flows for ACL log has reached limit'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106101)
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Number of cached'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 106101)
+ # Parsing the limit number
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.numFlows
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 106101)
+ # Field conversions
+ - cast:
+ fields:
+ - log.numFlows
+ to: int
+ where: equals("log.messageId", 106101)
+ #......................................................................#
+ # FTD-6-106102,FTD-4-106103
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'access-list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}\s'
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})\s'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}/'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: origin.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}/'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: target.port
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'hit-cnt'
+ - fieldName: log.hitCount
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("actionResult", "Permitted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && !equalsIgnoreCase("actionResult", "Permitted")
+ #......................................................................#
+ # FTD-6-109101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA disconnect request'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with\saudit-session-id:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 109101)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 109101)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: equals("log.messageId", 109101)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 109101)
+ #......................................................................#
+ # FTD-4-109102
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ', but cannot find named session'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 109102)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 109102)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 109102)
+ #......................................................................#
+ # FTD-3-109103
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA {{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'failed for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}),'
+ - fieldName: log.irrelevant
+ pattern: 'with session ID:'
+ - fieldName: log.auditSessionId
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 109103)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CoA'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 109103)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.user
+ where: equals("log.messageId", 109103)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 109103)
+ #......................................................................#
+ # FTD-109201 to 109213
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'UAUTH(:)? Session(\s|=)'
+ - fieldName: log.session
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'User(\s|=)'
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Assigned IP(\s|=)'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: greaterOrEqual("log.messageId", 109201) && log.messageId<=109213
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.session
+ - origin.user
+ where: lgreaterOrEqual("log.messageId", 109201) && log.messageId<=109213
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: greaterOrEqual("log.messageId", 109201) && log.messageId<=109213
+ #......................................................................#
+ # FTD-6-113004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user {{.word}} Successful'
+ - fieldName: log.irrelevant
+ pattern: '\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113004)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user {{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113004)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - target.ip
+ where: equals("log.messageId", 113004)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - target.ip
+ where: equals("log.messageId", 113004)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113004)
+ #......................................................................#
+ # FTD-6-113005
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(server|Server)(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}(\:|,)'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113005)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113005)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: equals("log.messageId", 113005)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113005)
+ #......................................................................#
+ # FTD-6-113008
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA transaction status ACCEPT(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113008)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113008)
+ #......................................................................#
+ # FTD-6-113009
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113009)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113009)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113009)
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved default group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113009)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113009)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113009)
+ #......................................................................#
+ # FTD-6-113010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA challenge received for user'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}}) from server'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113010)
+ - trim:
+ function: suffix
+ substring: 'from server'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 113010)
+ #......................................................................#
+ # FTD-6-113011
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'for (u|U)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113011)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113011)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113011)
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA retrieved user specific group policy'
+ - fieldName: log.policy
+ pattern: '{{.data}}\sfor'
+ - fieldName: log.irrelevant
+ pattern: '(u|U)ser(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113011)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.policy
+ where: equals("log.messageId", 113011)
+ #......................................................................#
+ # FTD-6-113012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA user authentication Successful(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?local database(\s)?:(\s)?user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113012)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA user authentication'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113012)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113012)
+ #......................................................................#
+ # FTD-6-113013
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA unable to complete the request'
+ - fieldName: log.irrelevant
+ pattern: 'Error(\s)?:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}\:'
+ - fieldName: log.irrelevant
+ pattern: 'user(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113013)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ where: equals("log.messageId", 113013)
+ #......................................................................#
+ # FTD-6-113014
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA authentication server not accessible(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113014)
+ #......................................................................#
+ # FTD-6-113015, 113017
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(AAA user authentication|AAA credentials)\s(R|r)ejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'local database(\s)?:(\s)?(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - origin.user
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(AAA user authentication|AAA credentials)\s'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
+ #......................................................................#
+ # FTD-6-113016
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AAA credentials rejected(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?reason(\s)?=(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: 'server(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}}(\s)?\:'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)ser(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?:'
+ - fieldName: log.irrelevant
+ pattern: 'user IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113016)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.reason
+ - target.ip
+ - origin.user
+ where: equals("log.messageId", 113016)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'AAA credentials'
+ - fieldName: log.ciscoResult
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 113016)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113016)
+ #......................................................................#
+ # FTD-4-113019
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?=(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: '(U|u)sername(\s)?=(\s)?'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?,'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: action
+ pattern: '(\s)?Session disconnected\.'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Session Type:(\s)?'
+ - fieldName: log.sessionType
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Duration:(\s)?'
+ - fieldName: log.duration
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes xmt:(\s)?'
+ - fieldName: origin.bytesSent
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Bytes rcv:(\s)?'
+ - fieldName: origin.bytesReceived
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?Reason:(\s)?'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113019)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ - log.sessionType
+ - log.duration
+ - origin.bytesSent
+ - origin.bytesReceived
+ where: equals("log.messageId", 113019)
+ - cast:
+ fields:
+ - origin.bytesSent
+ - origin.bytesReceived
+ to: int
+ where: equals("log.messageId", 113019)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113019)
+ #......................................................................#
+ # FTD-113031,113032,113033
+ # Common fields
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|{{.data}})(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ # Specific fields
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.filter
+ pattern: '{{.data}}\sis'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'AnyConnect (vpn-filter|ipv6-vpn-filter|session not allowed)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ - trim:
+ function: suffix
+ substring: 'is'
+ fields:
+ - log.filter
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
+ #......................................................................#
+ # FTD-113034,113035,113036,113038,113039
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '(\<)?{{.data}}(\>)?\sUser'
+ - fieldName: origin.user
+ pattern: '(''{{.data}}''|(\<)?{{.data}}(\>)?)(\s)?IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 113039)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 113035) || log.messageId==113038
+ #......................................................................#
+ # FTD-4-113042
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'CoA: Non-HTTP connection from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for user'
+ - fieldName: log.remoteUser
+ pattern: '(''{{.data}}''|{{.data}})(\s)?at'
+ - fieldName: log.remoteIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - action
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 113042)
+ - trim:
+ function: suffix
+ substring: 'at'
+ fields:
+ - log.remoteUser
+ where: equals("log.messageId", 113042)
+ #......................................................................#
+ # FTD-2-201003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit exceeded'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.globalIp
+ pattern: '\({{.data}}\)'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '/(\s)?'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.dstInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 201003)
+ - trim:
+ function: prefix
+ substring: '('
+ fields:
+ - log.globalIp
+ where: equals("log.messageId", 201003)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.globalIp
+ where: equals("log.messageId", 201003)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 201003)
+ #......................................................................#
+ # FTD-4-209003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Fragment database limit of'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'exceeded:(\s)?src(\s)?=(\s)?'
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'dest(\s)?=(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'proto(\s)?=(\s)?'
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'id(\s)?=(\s)?'
+ - fieldName: log.id
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 209003)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.ip
+ - target.ip
+ - protocol
+ where: equals("log.messageId", 209003)
+ - cast:
+ fields:
+ - log.limit
+ to: int
+ where: equals("log.messageId", 209003)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 209003)
+ #......................................................................#
+ # FTD-3-316001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Denied new tunnel'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 316001)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 316001)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 316001)
+ #......................................................................#
+ # FTD-3-316002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'VPN Handle error'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?protocol='
+ - fieldName: protocol
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'src\s'
+ - fieldName: log.inIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?dst'
+ - fieldName: log.outIfNum
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 316002)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - protocol
+ where: equals("log.messageId", 316002)
+ - cast:
+ fields:
+ - log.inIfNum
+ - log.outIfNum
+ to: int
+ where: equals("log.messageId", 316002)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 316002)
+ #......................................................................#
+ # FTD-6-302003,302004
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.irrelevant
+ pattern: '(to\s)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Built H245 connection|Pre-allocate H323 UDP backconnection)'
+ - fieldName: log.irrelevant
+ pattern: 'for'
+ - fieldName: log.foreignAddress
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpToip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ - fieldName: log.localAddress
+ pattern: '({{.ipv4}}|{{.ipv6}})'
+ - fieldName: log.tmpFromip
+ pattern: '({{.ipv4}}|{{.ipv6}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
+ source: log.msg
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Parsing from/to ip and port
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpToip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpToip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '{{.greedy}}'
+ source: log.tmpFromip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.tmpFromip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ - target.port
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Removing temp fields
+ - delete:
+ fields:
+ - log.tmpFromip
+ - log.tmpToip
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302003) || log.messageId==302004
+ #......................................................................#
+ # FTD-6-302012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Pre-allocate H225 Call Signalling Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: origin.port
+ pattern: '/(\s)?{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to laddr'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302012)
+ - trim:
+ function: prefix
+ substring: '/'
+ fields:
+ - origin.port
+ where: equals("log.messageId", 302012)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302012)
+ #......................................................................#
+ # FTD-6-302013
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302013)
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: equals("log.messageId", 302013)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302013)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302013)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302013)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302013)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: equals("log.messageId", 302013)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302013)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302013)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302013)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302013)
+ #......................................................................#
+ # FTD-6-302014
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown\s(Probe)?'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302014)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302014)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302014)
+ # Parsing AAA user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302014)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302014)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: equals("log.messageId", 302014)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302014)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302014)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302014)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302014)
+ #......................................................................#
+ # FTD-6-302015
+ - grok:
+ patterns:
+ - fieldName: log.tmpDirection
+ pattern: 'Built\s{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302015)
+ # Parsing direction field
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.greedy}}'
+ source: log.tmpDirection
+ where: equals("log.messageId", 302015)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302015)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302015)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302015)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302015)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ where: equals("log.messageId", 302015)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302015)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302015)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302015)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302015)
+ #......................................................................#
+ # FTD-6-302016
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302016)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302016)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302016)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: equals("log.messageId", 302016)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302016)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ where: equals("log.messageId", 302016)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: equals("log.messageId", 302016)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302016)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302016)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302016)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302016)
+ #......................................................................#
+ # FTD-6-302017
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302017)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302017)
+ # Parsing translatedCid and, firewall user to and AAA user if present
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpUserInfo
+ pattern: '{{.greedy}}'
+ source: log.rest
+ where: equals("log.messageId", 302017)
+ - grok:
+ patterns:
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302017)
+ # FW user and AAA user
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ - fieldName: target.user
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: equals("log.messageId", 302017)
+ - grok:
+ patterns:
+ - fieldName: log.tmpFwUserTo
+ pattern: '\({{.data}}\)'
+ source: log.tmpUserInfo
+ where: equals("log.messageId", 302017)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - target.user
+ - log.translatedCid
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ - target.user
+ where: equals("log.messageId", 302017)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpDirection
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpUserInfo
+ where: equals("log.messageId", 302017)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: equals("log.messageId", 302017)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302017)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302017)
+ #......................................................................#
+ # FTD-6-302018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown GRE connection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.translatedIpFrom
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.realCid
+ pattern: '{{.data}}\('
+ - fieldName: log.translatedIpTo
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.translatedCid
+ pattern: '{{.data}}\)'
+ - fieldName: log.tmpFwUserTo
+ pattern: '({{.data}})?duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302018)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302018)
+ # Parsing firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302018)
+ # Parsing firewall user to, and AAA name of the user if exists
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ source: log.rest
+ where: equals("log.messageId", 302018)
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ source: log.rest
+ where: equals("log.messageId", 302018)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - origin.user
+ - log.translatedCid
+ where: equals("log.messageId", 302018)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ where: equals("log.messageId", 302018)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.realCid
+ where: equals("log.messageId", 302018)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302018)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - log.translatedIpTo
+ where: equals("log.messageId", 302018)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302018)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302018)
+ #......................................................................#
+ # FTD-6-302020, 302021
+ # 302020
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302020)
+ # 302021
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for faddr'
+ - fieldName: log.tmpFaddrAndFwUser
+ pattern: '({{.data}})gaddr'
+ - fieldName: log.tmpGaddrAndFwUser
+ pattern: '({{.data}})laddr'
+ - fieldName: log.tmpLaddrAndFwUser
+ pattern: '({{.data}})type'
+ - fieldName: log.icmpType
+ pattern: '({{.data}})code'
+ - fieldName: log.icmpCode
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302021)
+ # Common parsing for 302020 and 302021
+ # For parsing faddr and fwuser from (Begin with ip/port), or icmpSeqNum
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '{{.greedy}}'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # icmpSeqNum variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpSeqNum
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: 'gaddr'
+ source: log.tmpFaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Cleaning icmpSeqNum
+ - trim:
+ function: suffix
+ substring: 'gaddr'
+ fields:
+ - log.icmpSeqNum
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Continue with firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # For parsing gaddr and global fwuser (Begin with ip/port), or icmpType
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.globalPort
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '{{.greedy}}'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # icmpType variants
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: log.icmpType
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserGlobal
+ pattern: 'laddr'
+ source: log.tmpGaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Cleaning icmpType
+ - trim:
+ function: suffix
+ substring: 'laddr'
+ fields:
+ - log.icmpType
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: 'code'
+ fields:
+ - log.icmpType
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Continue with global firewall
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.globalFirewallUser
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserGlobal
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # For parsing laddr and fwuser to (Begin with ip/port)
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.tmpFwUserTo
+ pattern: '{{.greedy}}'
+ source: log.tmpLaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Continue with firewall user to
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserTo
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserTo
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - target.ip
+ - origin.ip
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.firewallUserTo
+ - log.globalFirewallUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpFwUserTo
+ - log.tmpFwUserGlobal
+ - log.tmpFaddrAndFwUser
+ - log.tmpGaddrAndFwUser
+ - log.tmpLaddrAndFwUser
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302020) || log.messageId==302021
+ #......................................................................#
+ # FTD-6-302022, 302024, 302026
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: log.role
+ pattern: '({{.data}})stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortFrom
+ pattern: '\({{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpMappedIpPortTo
+ pattern: '\({{.data}}\)'
+ source: log.msg
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortFrom
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Parsing mapped ip,port to, from tmp fields
+ # With port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Without port
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ source: log.tmpMappedIpPortTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'stub'
+ fields:
+ - log.role
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpMappedIpPortFrom
+ - log.tmpMappedIpPortTo
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
+ #......................................................................#
+ # FTD-6-302023, 302025, 302027
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown stub'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'connection for'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: 'bytes'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
+ #......................................................................#
+ # FTD-302033,302034
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(Pre-allocated|Unable to pre-allocate) H323 GUP Connection'
+ - fieldName: log.irrelevant
+ pattern: 'for faddr'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.tmpPortFrom
+ pattern: '{{.data}}to laddr'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.tmpIpPortTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Parsing optional ports from y to
+ - grok:
+ patterns:
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpPortFrom
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.tmpIpPortTo
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ - grok:
+ patterns:
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ source: log.tmpIpPortTo
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Remove tmp fields
+ - delete:
+ fields:
+ - log.tmpPortFrom
+ - log.tmpIpPortTo
+ where: equals("log.messageId", 302033) || log.messageId==302034
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302033)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 302034)
+ #......................................................................#
+ # FTD-6-302303
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpFrom
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortFrom
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.mappedIpTo
+ pattern: '{{.data}}/'
+ - fieldName: log.mappedPortTo
+ pattern: '{{.integer}}'
+ - fieldName: log.rest
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302303)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 302303)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302303)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ - log.mappedIpFrom
+ - log.mappedIpTo
+ where: equals("log.messageId", 302303)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302303)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302303)
+ #......................................................................#
+ # FTD-6-302304
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s{{.word}}\sstate-bypass\sconnection'
+ - fieldName: log.connectionId
+ pattern: '({{.data}})from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: log.reason
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 302304)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Built'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 302304)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 302304)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 302304)
+ - trim:
+ function: suffix
+ substring: 'from'
+ fields:
+ - log.connectionId
+ where: equals("log.messageId", 302304)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 302304)
+ #......................................................................#
+ # FTD-6-305009
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: log.mappedIpTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 305009)
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305009)
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305009)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305009)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: equals("log.messageId", 305009)
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 305009)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305009)
+ #......................................................................#
+ # FTD-6-305010
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown (dynamic|static) translation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: equals("log.messageId", 305010)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305010)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: equals("log.messageId", 305010)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305010)
+ #......................................................................#
+ # FTD-6-305011
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: equals("log.messageId", 305011)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305011)
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Built\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 305011)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ where: equals("log.messageId", 305011)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ where: equals("log.messageId", 305011)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305011)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 305011)
+ #......................................................................#
+ # FTD-6-305012
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)\s(TCP|UDP|ICMP)\stranslation'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: log.tmpAclSrcInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.tmpFwUserFrom
+ pattern: '({{.data}})?to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.time}}'
+ source: log.msg
+ where: equals("log.messageId", 305012)
+ # Parsing firewall user from
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.firewallUserFrom
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpFwUserFrom
+ where: equals("log.messageId", 305012)
+ # Parsing protocol
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Teardown\s(dynamic|static)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 305012)
+ # Parsing srcInterface
+ # With ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.accessList
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305012)
+ # Without ACL
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}:'
+ source: log.tmpAclSrcInterface
+ where: equals("log.messageId", 305012)
+ # Parsing srcInterface from himself to avoid parsing issues
+ - grok:
+ patterns:
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\('
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.srcInterface
+ where: equals("log.messageId", 305012)
+
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.firewallUserFrom
+ - log.accessList
+ where: equals("log.messageId", 305012)
+ # Removing tmp fields
+ - delete:
+ fields:
+ - log.tmpFwUserFrom
+ - log.tmpAclSrcInterface
+ where: equals("log.messageId", 305012)
+
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.srcInterface
+ - log.dstInterface
+ where: equals("log.messageId", 305012)
+ - trim:
+ function: suffix
+ substring: '('
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 305012)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 305012)
+ #......................................................................#
+ # FTD-3-322001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sMAC\saddress'
+ - fieldName: log.localMac
+ pattern: '{{.data}}(\s)?,'
+ - fieldName: log.reason
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 322001)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 322001)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.localMac
+ where: equals("log.messageId", 322001)
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - log.reason
+ where: equals("log.messageId", 322001)
+ #......................................................................#
+ # FTD-3-322002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.boudSrcMac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 322002)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: equals("log.messageId", 322002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 322002)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: equals("log.messageId", 322002)
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 322002)
+ #......................................................................#
+ # FTD-3-322003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.word}}\sinspection\scheck'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'for\sarp'
+ - fieldName: log.httpMessageType
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'received\sfrom\shost'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}\.'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Address'
+ - fieldName: log.fakeSrcMac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'IP\sAddress'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 322003)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'inspection check'
+ source: action
+ where: equals("log.messageId", 322003)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 322003)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.fakeSrcMac
+ where: equals("log.messageId", 322003)
+ - trim:
+ function: suffix
+ substring: '.'
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 322003)
+ #......................................................................#
+ # FTD-4-402114
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402114)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402114)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402114)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ where: equals("log.messageId", 402114)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402114)
+ #......................................................................#
+ # FTD-4-402115
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\sa\spacket'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'containing'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'data instead of'
+ - fieldName: log.expectedProtocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402115)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402115)
+ #......................................................................#
+ # FTD-4-402116
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktDestAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktSrcAddr
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.decapsulatedPktProto
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.localProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.localProxyPort
+ pattern: '{{.data}}and'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}as'
+ - fieldName: log.remoteProxyIpAddr
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyIpMask
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyProto
+ pattern: '{{.data}}/'
+ - fieldName: log.remoteProxyPort
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402116)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402116)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.localProxyIpAddr
+ - log.localProxyIpMask
+ - log.localProxyProto
+ - log.remoteProxyIpAddr
+ - log.remoteProxyIpMask
+ - log.remoteProxyPort
+ - log.remoteProxyProto
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402116)
+ - trim:
+ function: suffix
+ substring: 'and'
+ fields:
+ - log.localProxyPort
+ where: equals("log.messageId", 402116)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402116)
+ #......................................................................#
+ # FTD-4-402117
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received a non-IPsec \((\s)?{{.word}}(\s)?\) packet'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402117)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received a non-IPsec \('
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402117)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402117)
+ #......................................................................#
+ # FTD-4-402118
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}length'
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'with offset'
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: equals("log.messageId", 402118)
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402118)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402118)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402118)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402118)
+ #......................................................................#
+ # FTD-4-402119, 402120
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'IPSEC\:(\s)?'
+ - fieldName: action
+ pattern: 'Received\s(an|a)\s{{.word}}\spacket'
+ - fieldName: log.irrelevant
+ pattern: '\({{.data}}='
+ - fieldName: log.spi
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.seqNum
+ pattern: '{{.integer}}(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: origin.user
+ pattern: '{{.data}}\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ # Protocol
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Received\s(an|a)'
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ')'
+ fields:
+ - log.seqNum
+ - origin.user
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.spi
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 402119) || log.messageId==402120
+ #......................................................................#
+ # FTD-5-402128
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'CRYPTO\:(\s)?'
+ - fieldName: action
+ pattern: 'An attempt to allocate a large memory block'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memorySize
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: log.memoryLimit
+ pattern: '{{.integer}}'
+ source: log.msg
+ where: equals("log.messageId", 402128)
+ #......................................................................#
+ # FTD-4-405001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received ARP (request|response) collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.data}}with'
+ - fieldName: log.irrelevant
+ pattern: 'existing ARP entry'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.mac
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 405001)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ARP'
+ where: equals("log.messageId", 405001)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 405001)
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 405001)
+ - trim:
+ function: suffix
+ substring: 'with'
+ fields:
+ - log.srcInterface
+ where: equals("log.messageId", 405001)
+ #......................................................................#
+ # FTD-4-405002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Received mac mismatch collision'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.mac
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 405002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - origin.mac
+ where: equals("log.messageId", 405002)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: equals("log.messageId", 405002)
+ #......................................................................#
+ # FTD-4-406001
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command low port(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 406001)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: equals("log.messageId", 406001)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: equals("log.messageId", 406001)
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ where: equals("log.messageId", 406001)
+ #......................................................................#
+ # FTD-4-406002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'FTP port command different address(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: log.connectionIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 406002)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'FTP'
+ where: equals("log.messageId", 406002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - action
+ where: equals("log.messageId", 406002)
+ #......................................................................#
+ # FTD-4-407002
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Embryonic limit {{.data}} for through connections exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\.'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.globalIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
+ - fieldName: log.irrelevant
+ pattern: '\('
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '(\s)?\)(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'on interface'
+ - fieldName: log.srcInterface
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 407002)
+ # Connection number and connection limit
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Embryonic limit'
+ - fieldName: log.numCons
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '/'
+ - fieldName: log.limit
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 407002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 407002)
+ #......................................................................#
+ # FTD-6-605004
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Login\s{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.service
+ pattern: '{{.data}}for'
+ - fieldName: log.irrelevant
+ pattern: 'user'
+ - fieldName: origin.user
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 605004)
+ # Action result
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Login'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ source: action
+ where: equals("log.messageId", 605004)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 605004)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: suffix
+ substring: 'for'
+ fields:
+ - log.service
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 605004)
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 605004)
+ #......................................................................#
+ # FTD-2-106018
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'ICMP packet'
+ - fieldName: log.irrelevant
+ pattern: 'type'
+ - fieldName: log.icmpType
+ pattern: '{{.data}}\s'
+ - fieldName: log.ciscoResult
+ pattern: 'denied'
+ - fieldName: log.irrelevant
+ pattern: 'by'
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'list'
+ - fieldName: log.accessList
+ pattern: '{{.data}}src'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'dest'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106018)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'ICMP'
+ where: equals("log.messageId", 106018)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - log.accessList
+ where: equals("log.messageId", 106018)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 106018)
+ #......................................................................#
+ # FTD-2-106020
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Deny IP teardrop fragment'
+ - fieldName: log.irrelevant
+ pattern: '\((\s)?size(\s)?='
+ - fieldName: origin.bytesSent
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: ',(\s)?offset(\s)?='
+ - fieldName: log.fragmentOffset
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '\)(\s)?from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: target.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 106020)
+ # Adding log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: log.ciscoResult
+ value: 'Denied'
+ where: equals("log.messageId", 106020)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 106020)
+ #......................................................................#
+ # FTD-6-611301
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with no split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611301)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: equals("log.messageId", 611301)
+ #......................................................................#
+ # FTD-6-611303
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT configured for Client Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ress\:'
+ - fieldName: log.mappedIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611303)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: equals("log.messageId", 611303)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 611303)
+ #......................................................................#
+ # FTD-6-611304
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'NAT exemption configured for Network Extension Mode with split tunneling'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}works\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskFrom
+ pattern: '{{.data}}\s'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: log.netmaskTo
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611304)
+ # Adding protocol
+ - add:
+ function: 'string'
+ params:
+ key: protocol
+ value: 'NAT'
+ where: equals("log.messageId", 611304)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 611304)
+ #......................................................................#
+ # FTD-6-611307
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Head end\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611307)
+ # Adding action and log.ciscoResult
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'The VPN client is connected to the specified headend'
+ where: equals("log.messageId", 611307)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611307)
+ #......................................................................#
+ # FTD-6-611309
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'Disconnecting from head end and uninstalling previously downloaded policy'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}End\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611309)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611309)
+ #......................................................................#
+ # FTD-6-611310,611311
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'XAUTH'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '\:(\s)?Peer(\s)?\:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611310) || log.messageId==611311
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611310)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 611311)
+ #......................................................................#
+ # FTD-6-611314
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Load Balancing Cluster with Virtual IP\:(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}server'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611314)
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Load Balancing Cluster redirected the Secure Firewall'
+ where: equals("log.messageId", 611314)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611314)
+ #......................................................................#
+ # FTD-6-611315
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:(\s)?Disconnecting from Load Balancing Cluster member(\:)?(\s)?'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611315)
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Disconnecting from Load Balancing Cluster'
+ where: equals("log.messageId", 611315)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 611315)
+ #......................................................................#
+ # FTD-6-611318
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient\:'
+ - fieldName: action
+ pattern: 'User Authentication Enabled'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}IP(\s)?\:'
+ - fieldName: log.authServerIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}Port(\s)?\:'
+ - fieldName: log.authServerPort
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}out(\s)?\:'
+ - fieldName: log.timeOut
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 611318)
+ #......................................................................#
+ # FTD-3-710003
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '(TCP|UDP) access denied by ACL'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'to'
+ - fieldName: log.dstInterface
+ pattern: '{{.data}}(\s)?:'
+ - fieldName: target.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?/'
+ - fieldName: target.port
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 710003)
+ # Protocol and log.ciscoResult
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.word}}'
+ - fieldName: log.ciscoResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 710003)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - origin.ip
+ - target.ip
+ where: equals("log.messageId", 710003)
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.dstInterface
+ where: equals("log.messageId", 710003)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 710003)
+ #......................................................................#
+ # FTD-5-713252,713253
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'Username(\s)?='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'IP(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}available(\.)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 713252)
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 713253)
+ #......................................................................#
+ # FTD-6-716001,716002,716003
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 716001) || log.messageId==716002
+ #......................................................................#
+ # FTD-6-716004,716005,716006,716007,716009
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 716004) || log.messageId==716007 || log.messageId==716009
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 716006)
+ #......................................................................#
+ # FTD-6-716038
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Group(\s)?'
+ - fieldName: origin.group
+ pattern: '{{.data}}User'
+ - fieldName: origin.user
+ pattern: '{{.data}}IP'
+ - fieldName: origin.ip
+ pattern: '(\<)?({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\>)?'
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716038)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 716038)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'User'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: 'IP'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - origin.group
+ - origin.user
+ - origin.ip
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 716038)
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ where: equals("log.messageId", 716038)
+ #......................................................................#
+ # FTD-6-716039
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: 'group(\s)?='
+ - fieldName: origin.group
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}},'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 716039)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 716039)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - action
+ - origin.user
+ where: equals("log.messageId", 716039)
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - origin.group
+ where: equals("log.messageId", 716039)
+ #......................................................................#
+ # FTD-6-719017,719019,719020,719021,719022,719023
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: action
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
+ # Adding log.ciscoResult and modifying some actions
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 719019) || log.messageId==719023
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 719020) || log.messageId==719022
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user is not checked against ACL'
+ where: equals("log.messageId", 719021)
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has been authenticated'
+ where: equals("log.messageId", 719022)
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'WebVPN user has not been authenticated'
+ where: equals("log.messageId", 719023)
+ # Cleaning fields
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
+ #......................................................................#
+ # FTD-6-719018
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'WebVPN user(\:)?'
+ - fieldName: origin.user
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'ACL ID'
+ - fieldName: log.accessList
+ pattern: '{{.data}}not'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 719018)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719018)
+ - trim:
+ function: suffix
+ substring: 'not'
+ fields:
+ - log.accessList
+ where: equals("log.messageId", 719018)
+ #......................................................................#
+ # FTD-6-719024
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Email Proxy piggyback auth fail'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.sessionPointer
+ pattern: '{{.data}}user'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.user
+ pattern: '{{.data}}addr'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 719024)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'user'
+ fields:
+ - log.sessionPointer
+ where: equals("log.messageId", 719024)
+ - trim:
+ function: suffix
+ substring: 'addr'
+ fields:
+ - origin.user
+ where: equals("log.messageId", 719024)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: equals("log.messageId", 719024)
+ #......................................................................#
+ # FTD-7-609002
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Teardown local-host'
+ - fieldName: log.zoneName
+ pattern: '{{.data}}/'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\:'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: 'duration'
+ - fieldName: log.duration
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 609002)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.zoneName
+ where: equals("log.messageId", 609002)
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 609002)
+ #......................................................................#
+ # FTD-6-611305
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'VPNClient(\s)?\:'
+ - fieldName: action
+ pattern: 'DHCP Policy installed'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.primaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}DNS(\s)?\:'
+ - fieldName: log.secondaryDns
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.primaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}WINS(\s)?\:'
+ - fieldName: log.secondaryWins
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ source: log.msg
+ where: equals("log.messageId", 611305)
+ #......................................................................#
+ # FTD-4-733100
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}exceeded'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 733100)
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: equals("log.messageId", 733100)
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.data}}drop'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 733100)
+ # Cleaning fields
+ - trim:
+ function: suffix
+ substring: 'drop'
+ fields:
+ - log.dropSourceObject
+ where: equals("log.messageId", 733100)
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.dropSourceObject
+ where: equals("log.messageId", 733100)
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.dropSourceObject
+ where: equals("log.messageId", 733100)
+ #......................................................................#
+ # FTD-4-733101
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}(targeted|attacking)'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.burstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxBurstRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.avgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.maxAvgRateValue
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}is'
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 733101)
+ # Cleaning cumulative total count
+ - grok:
+ patterns:
+ - fieldName: log.cumulativeTotalCount
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.cumulativeTotalCount
+ where: equals("log.messageId", 733101)
+ # Parsing drop source object
+ - grok:
+ patterns:
+ - fieldName: log.dropSourceObject
+ pattern: '{{.word}}'
+ - fieldName: log.tmpIp
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: action
+ where: equals("log.messageId", 733101)
+ # Renaming from or to ip, according to -> if (targeted|attacking)
+ - rename:
+ from:
+ - log.tmpIp
+ to: origin.ip
+ where: equals("log.messageId", 733101) && contains("action", "attacking")
+ - rename:
+ from:
+ - log.tmpIp
+ to: target.ip
+ where: equals("log.messageId", 733101) && contains("action", "targeted")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.messageId", 733101)
+ #......................................................................#
+ # FTD-4-733102, 733103
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}host'
+ - fieldName: origin.ip
+ pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: equals("log.messageId", 733102) || log.messageId==733103
+ # Adding action
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection add host to shun list'
+ where: (equals("log.messageId", 733102) || log.messageId==733103) && contains("log.msg", "add")
+ - add:
+ function: 'string'
+ params:
+ key: action
+ value: 'Threat-detection removes host to shun list'
+ where: (equals("log.messageId", 733102) || log.messageId==733103) && contains("log.msg", "removes")
+ #......................................................................#
+ # Decoding severity
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: log.severity=="1" || log.severity=="2" || log.severity=="3"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: log.severity=="4"
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: log.severity=="5" || log.severity=="6" || log.severity=="7"
+ #......................................................................#
+ # Adding common geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+ # Adding log.mappedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpFrom
+ destination: log.mappedIpFrom.geolocation
+ where: exists("log.mappedIpFrom")
+ # Adding log.mappedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIpTo
+ destination: log.mappedIpTo.geolocation
+ where: exists("log.mappedIpTo")
+ # Adding log.translatedIpFrom geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpFrom
+ destination: log.translatedIpFrom.geolocation
+ where: exists("log.translatedIpFrom")
+ # Adding log.translatedIpTo geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.translatedIpTo
+ destination: log.translatedIpTo.geolocation
+ where: exists("log.translatedIpTo")
+ # Adding log.globalIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.globalIp
+ destination: log.globalIp.geolocation
+ where: exists("log.globalIp")
+ # Adding log.remoteIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteIp
+ destination: log.remoteIp.geolocation
+ where: exists("log.remoteIp")
+ # Adding log.mappedIp geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.mappedIp
+ destination: log.mappedIp.geolocation
+ where: exists("log.mappedIp")
+ # Adding log.decapsulatedPktDestAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktDestAddr
+ destination: log.decapsulatedPktDestAddr.geolocation
+ where: exists("log.decapsulatedPktDestAddr")
+ # Adding log.decapsulatedPktSrcAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.decapsulatedPktSrcAddr
+ destination: log.decapsulatedPktSrcAddr.geolocation
+ where: exists("log.decapsulatedPktSrcAddr")
+ # Adding log.localProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localProxyIpAddr
+ destination: log.localProxyIpAddr.geolocation
+ where: exists("log.localProxyIpAddr")
+ # Adding log.remoteProxyIpAddr geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.remoteProxyIpAddr
+ destination: log.remoteProxyIpAddr.geolocation
+ where: exists("log.remoteProxyIpAddr")
+ # Adding log.primaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryDns
+ destination: log.primaryDns.geolocation
+ where: exists("log.primaryDns")
+ # Adding log.secondaryDns geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryDns
+ destination: log.secondaryDns.geolocation
+ where: exists("log.secondaryDns")
+ # Adding log.primaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.primaryWins
+ destination: log.primaryWins.geolocation
+ where: exists("log.primaryWins")
+ # Adding log.secondaryWins geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.secondaryWins
+ destination: log.secondaryWins.geolocation
+ where: exists("log.secondaryWins")
+ #......................................................................#
+ # Common field conversions
+ - cast:
+ fields:
+ - origin.port
+ - target.port
+ to: int
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.firePowerHeader
+ - log.ciscoSeparator
+ - log.irrelevant
+ - log.syslogPri
+ - log.rest
+ $$
+ WHERE id = 303 ;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210004_update_filter_cisco_meraki.xml b/backend/src/main/resources/config/liquibase/changelog/20260210004_update_filter_cisco_meraki.xml
new file mode 100644
index 000000000..6f00ab3bd
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210004_update_filter_cisco_meraki.xml
@@ -0,0 +1,1569 @@
+
+
+
+
+
+
+ Syslog
+#
+# 1. Parsing the message field
+pipeline:
+ - dataTypes:
+ - firewall-meraki
+ steps:
+ # Header fields
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(\<{{.integer}}\>)'
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.serverIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}(\s)?\:'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ - grok:
+ patterns:
+ - fieldName: log.ciscoTime
+ pattern: '{{.monthName}}\s{{.monthDay}}\s{{.year}}\s{{.time}}'
+ - fieldName: log.serverIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}(\s)?\:'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: raw
+ # Adding control log.controlFlag field (Used to know if the message don't contains the header INT.INT mx_type mx_group)
+ - add:
+ function: 'string'
+ params:
+ key: log.controlFlag
+ value: 'Init'
+ # Begin message parsing
+ # First extract the generic message, then parse it
+ - grok:
+ patterns:
+ - fieldName: log.controlFlag
+ pattern: '{{.data}}(\s)(events|flows|urls|ids-alerts|security_event)'
+ - fieldName: log.genericEvent
+ pattern: '{{.greedy}}'
+ source: log.msg
+ # Parsing variant INT.INT mx_type mx_group
+ # Parsing from controlFlag (Format: Date? IP PORT INT.INT mx_type mx_group)
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}{{.time}}'
+ - fieldName: log.localIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.local.port
+ pattern: '{{.integer}}'
+ - fieldName: log.msgEventTime
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.merakiType
+ pattern: '{{.data}}\s'
+ - fieldName: log.merakiGroup
+ pattern: '{{.greedy}}'
+ source: log.controlFlag
+ where: '!equals("log.controlFlag", "Init")'
+ - grok:
+ patterns:
+ - fieldName: log.msgEventTime
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.merakiType
+ pattern: '{{.data}}\s'
+ - fieldName: log.merakiGroup
+ pattern: '{{.greedy}}'
+ source: log.controlFlag
+ where: '!equals("log.controlFlag", "Init")'
+ # ........................................
+ # event vpn connectivity change
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'vpn_type(\s)?='
+ - fieldName: log.vpnType
+ pattern: '''{{.data}}'''
+ - fieldName: log.irrelevant
+ pattern: 'peer_contact(\s)?='
+ - fieldName: origin.ip
+ pattern: '''{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'''
+ - fieldName: log.irrelevant
+ pattern: 'peer_ident(\s)?='
+ - fieldName: log.peerIdent
+ pattern: '''{{.data}}'''
+ - fieldName: log.irrelevant
+ pattern: 'connectivity(\s)?='
+ - fieldName: log.connectivity
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equals("log.connectivity", "true")
+ # ........................................
+ # event uplink connectivity change
+ - rename:
+ from:
+ - log.genericEvent
+ to: action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "failover to")'
+ # ........................................
+ # event uplink connectivity change
+ # Event: urls, HTTP GET requests in MR Access Points
+ - rename:
+ from:
+ - log.genericEvent
+ to: action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "Cellular connection")'
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Cellular connection'
+ - fieldName: log.connectionState
+ pattern: '(up|Up|down|Down)'
+ - fieldName: log.msgEventTime
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.merakiTypeIn
+ pattern: '{{.data}}\s'
+ - fieldName: log.merakiGroupIn
+ pattern: '(events|flows|urls|ids-alerts|security_event)'
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.data}}\:'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'request(\s)?\:'
+ - fieldName: log.method
+ pattern: '{{.word}}'
+ - fieldName: target.url
+ pattern: '{{.greedy}}'
+ source: action
+ where: '!equals("log.controlFlag", "Init") && contains("action", "Cellular connection")'
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: 'Cellular connection'
+ - fieldName: log.connectionState
+ pattern: '(up|Up|down|Down)'
+ source: action
+ where: '!equals("log.controlFlag", "Init") && contains("action", "Cellular connection")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: equalsIgnoreCase("log.connectionState", "up")
+ # ........................................
+ # Event: event, dhcp no offers
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}for\smac'
+ - fieldName: origin.mac
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'host(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp no offers")'
+ - trim:
+ function: suffix
+ substring: 'for mac'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp no offers")'
+ # ........................................
+ # Event: event, dhcp lease
+ - grok:
+ patterns:
+ - fieldName: action
+ pattern: '{{.data}}of\sip'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'from server mac'
+ - fieldName: log.serverMac
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'for client mac'
+ - fieldName: origin.mac
+ pattern: '{{.data}}\s'
+ - fieldName: log.irrelevant
+ pattern: 'from router'
+ - fieldName: log.routerIp
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'on subnet'
+ - fieldName: log.subnet
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'with dns'
+ - fieldName: log.dns
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: ','
+ - fieldName: log.dns1
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp lease")'
+ - trim:
+ function: suffix
+ substring: 'of ip'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp lease")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: contains("log.genericEvent", "dhcp lease")
+ # ........................................
+ # Event: event, HTTP GET requests in Meraki MX Security Appliance
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.data}}\:'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'request(\s)?\:'
+ - fieldName: log.method
+ pattern: '{{.word}}'
+ - fieldName: target.url
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="urls"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="urls"'
+ # ........................................
+ # Event: flows, IP session initiated in Meraki MX Security Appliance
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'protocol(\s)?='
+ - fieldName: protocol
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'sport(\s)?='
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dport(\s)?='
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'pattern(\s)?\:'
+ - fieldName: log.pattern
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"'
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: 'protocol(\s)?='
+ - fieldName: protocol
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'sport(\s)?='
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dport(\s)?='
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'pattern(\s)?\:'
+ - fieldName: log.pattern
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "0") || startsWith("log.pattern", "allow") || startsWith("log.pattern", "Allow"))'
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "deny") || startsWith("log.pattern", "Deny"))'
+ # ........................................
+ # Event: ids-alerts, ids signature matched in Meraki MX Security Appliance
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'signature(\s)?='
+ - fieldName: log.signature
+ pattern: '{{.data}}priority'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}='
+ - fieldName: log.priority
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'timestamp(\s)?='
+ - fieldName: log.msgEventTimeIn
+ pattern: '{{.integer}}\.{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'direction(\s)?='
+ - fieldName: log.direction
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'protocol(\s)?='
+ - fieldName: protocol
+ pattern: '{{.data}}(\s)'
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.data}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "signature") && log.merakiGroup=="ids-alerts"'
+ - trim:
+ function: suffix
+ substring: 'priority'
+ fields:
+ - log.signature
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "signature") && log.merakiGroup=="ids-alerts"'
+ # ........................................
+ # Event: event IPsec-SA request queued due to no phase 1 found, phase2 negotiation failed, initiate new phase 1 negotiation,
+ # ISAKMP-SA established, initiate new phase 2 negotiation, IPsec-SA established, ISAKMP-SA established, and ISAKMP-SA deleted
+ # in Meraki MX Security Appliance
+ # This type of message mx_type=labs_appliance mx_group=events
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)(deleted|established)'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '-'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: 'spi(\s)?\:'
+ - fieldName: log.spi
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)request(\s)for'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Third variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)negotiation(\s)failed'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}ESP'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Fourth variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)negotiation(\s)?\:'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '\<=\>'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Fifth variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Site-to-site VPN(\s)?\:(\s)?{{.greedy}}(\s)established\:(\s)?ESP/Tunnel'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: origin.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: '-\>'
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}'
+ - fieldName: target.port
+ pattern: '\[(\s)?{{.integer}}(\s)?\]'
+ - fieldName: log.irrelevant
+ pattern: 'spi(\s)?='
+ - fieldName: log.spi
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - origin.port
+ - target.port
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - origin.port
+ - target.port
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events" && (contains("log.genericEvent", "queued due to no phase 1") || contains("log.genericEvent", "queued due to no phase1") || || contains("log.genericEvent", "established"))'
+ # ........................................
+ # Event: event spanning-tree guard state change in Meraki MS Switches
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Port'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'received an'
+ - fieldName: protocol
+ pattern: '{{.data}}BPDU'
+ - fieldName: log.irrelevant
+ pattern: 'from'
+ - fieldName: origin.mac
+ pattern: '{{.data}}so'
+ - fieldName: log.irrelevant
+ pattern: 'the port was'
+ - fieldName: actionResult
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'BPDU'
+ fields:
+ - protocol
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'so'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events" && contains("log.genericEvent", "blocked")'
+ # ........................................
+ # Event: event blocked DHCP server response in Meraki MS Switches
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'Blocked'
+ - fieldName: protocol
+ pattern: '{{.data}}server'
+ - fieldName: log.irrelevant
+ pattern: 'response from'
+ - fieldName: origin.mac
+ pattern: '{{.data}}on'
+ - fieldName: log.irrelevant
+ pattern: 'VLAN'
+ - fieldName: log.vlan
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'server'
+ fields:
+ - protocol
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
+ - trim:
+ function: suffix
+ substring: 'on'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
+ # ........................................
+ # Event: event 802.1X (all events) in Meraki MS Switches
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}port'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.port
+ pattern: '{{.data}}identity'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.identity
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ - trim:
+ function: suffix
+ substring: 'port'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.port
+ - log.identity
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.port
+ - log.identity
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
+ # ........................................
+ # Event: event 802.11 disassociation in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}radio'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.radio
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}channel'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.channel
+ pattern: '{{.data}}reason'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.reason
+ pattern: '{{.data}}instigator'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.instigator
+ pattern: '{{.data}}duration'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.duration
+ pattern: '{{.data}}auth_neg_dur'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.authNegDur
+ pattern: '{{.data}}last_auth_ago'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.lastAuthAgo
+ pattern: '{{.data}}is_wpa'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.isWpa
+ pattern: '{{.data}}full_conn'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fullConn
+ pattern: '{{.data}}ip_resp'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.ipResp
+ pattern: '{{.data}}ip_src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.data}}arp_resp'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.arpResp
+ pattern: '{{.data}}arp_src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.arpSrc
+ pattern: '{{.data}}dns_server'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dnsServer
+ pattern: '{{.data}}dns_req_rtt'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dnsReqRtt
+ pattern: '{{.data}}dns_resp'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dnsResp
+ pattern: '{{.data}}aid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.aid
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'radio'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.radio
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'channel'
+ fields:
+ - log.vap
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'reason'
+ fields:
+ - log.channel
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'instigator'
+ fields:
+ - log.reason
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'duration'
+ fields:
+ - log.instigator
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'auth_neg_dur'
+ fields:
+ - log.duration
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'last_auth_ago'
+ fields:
+ - log.authNegDur
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'is_wpa'
+ fields:
+ - log.lastAuthAgo
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'full_conn'
+ fields:
+ - log.isWpa
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'ip_resp'
+ fields:
+ - log.fullConn
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'ip_src'
+ fields:
+ - log.ipResp
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'arp_resp'
+ fields:
+ - origin.ip
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'arp_src'
+ fields:
+ - log.arpResp
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'dns_server'
+ fields:
+ - log.arpSrc
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'dns_req_rtt'
+ fields:
+ - log.dnsServer
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'dns_resp'
+ fields:
+ - log.dnsReqRtt
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: 'aid'
+ fields:
+ - log.dnsResp
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.channel
+ - log.reason
+ - log.instigator
+ - log.duration
+ - log.authNegDur
+ - log.lastAuthAgo
+ - log.isWpa
+ - log.fullConn
+ - log.ipResp
+ - origin.ip
+ - log.arpResp
+ - log.arpSrc
+ - log.dnsServer
+ - log.dnsReqRtt
+ - log.dnsResp
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.channel
+ - log.reason
+ - log.instigator
+ - log.duration
+ - log.authNegDur
+ - log.lastAuthAgo
+ - log.isWpa
+ - log.fullConn
+ - log.ipResp
+ - origin.ip
+ - log.arpResp
+ - log.arpSrc
+ - log.dnsServer
+ - log.dnsReqRtt
+ - log.dnsResp
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
+ # ........................................
+ # Event: event 802.1X (all events) in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}radio'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.radio
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}identity'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.identity
+ pattern: '{{.data}}aid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.aid
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'radio'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.radio
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'identity'
+ fields:
+ - log.vap
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: 'aid'
+ fields:
+ - log.identity
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.identity
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - log.radio
+ - log.vap
+ - log.identity
+ - log.aid
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
+ # ........................................
+ # Event: event splash authentication in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}ip'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.data}}duration'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.duration
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}download'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.download
+ pattern: '{{.data}}upload'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.upload
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'ip'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'duration'
+ fields:
+ - origin.ip
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.duration
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'download'
+ fields:
+ - log.vap
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: 'upload'
+ fields:
+ - log.download
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.ip
+ - log.vap
+ - log.duration
+ - log.download
+ - log.upload
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.ip
+ - log.vap
+ - log.duration
+ - log.download
+ - log.upload
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
+ # ........................................
+ # Event: event wireless packet flood detected in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}(\s)packet'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.packet
+ pattern: '{{.data}}device'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}radio'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.radio
+ pattern: '{{.data}}state'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.state
+ pattern: '{{.data}}alarm_id'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.alarmId
+ pattern: '{{.data}}dos_count'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.dosCount
+ pattern: '{{.data}}inter_arrival'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.interArrival
+ pattern: '{{.greedy}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'packet'
+ fields:
+ - action
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'device'
+ fields:
+ - log.packet
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'radio'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'state'
+ fields:
+ - log.radio
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'alarm_id'
+ fields:
+ - log.state
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'dos_count'
+ fields:
+ - log.alarmId
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: 'inter_arrival'
+ fields:
+ - log.dosCount
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.ip
+ - origin.mac
+ - log.radio
+ - log.packet
+ - log.dosCount
+ - log.alarmId
+ - log.state
+ - log.interArrival
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.ip
+ - origin.mac
+ - log.radio
+ - log.packet
+ - log.dosCount
+ - log.alarmId
+ - log.state
+ - log.interArrival
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
+ # ........................................
+ # Event: flows, flow allowed by Layer 3 firewall in Meraki MR Access Points
+ - grok:
+ patterns:
+ - fieldName: actionResult
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: 'src(\s)?='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}'
+ - fieldName: log.irrelevant
+ pattern: 'mac(\s)?='
+ - fieldName: origin.mac
+ pattern: '{{.data}}protocol'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: protocol
+ pattern: '{{.data}}sport'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dport(\s)?='
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ source: log.genericEvent
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ - trim:
+ function: suffix
+ substring: 'sport'
+ fields:
+ - protocol
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ - trim:
+ function: suffix
+ substring: 'protocol'
+ fields:
+ - origin.mac
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "allow") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'denied'
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "deny") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
+ # ........................................
+ # Event: event rogue SSID detected and SSID spoofing detected in Meraki MR Access Points
+ # First variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'airmarshal_events(\s)type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}ssid(\s)?='
+ - fieldName: log.ssid
+ pattern: '{{.data}}bssid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.bssid
+ pattern: '{{.data}}src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}dst'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: target.mac
+ pattern: '{{.data}}wired_mac'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.wiredMac
+ pattern: '{{.data}}vlan_id'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vlanId
+ pattern: '{{.data}}channel'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.channel
+ pattern: '{{.data}}rssi'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.rssi
+ pattern: '{{.data}}fc_type'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcType
+ pattern: '{{.data}}fc_subtype'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcSubType
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ # Second variant
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'airmarshal_events(\s)type(\s)?='
+ - fieldName: action
+ pattern: '{{.data}}ssid(\s)?='
+ - fieldName: log.ssid
+ pattern: '{{.data}}vap'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.vap
+ pattern: '{{.data}}bssid'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.bssid
+ pattern: '{{.data}}src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}dst'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: target.mac
+ pattern: '{{.data}}channel'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.channel
+ pattern: '{{.data}}rssi'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.rssi
+ pattern: '{{.data}}fc_type'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcType
+ pattern: '{{.data}}fc_subtype'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.fcSubType
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: '='
+ fields:
+ - action
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'ssid'
+ fields:
+ - action
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'bssid'
+ fields:
+ - log.ssid
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'vap'
+ fields:
+ - log.ssid
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'bssid'
+ fields:
+ - log.vap
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - log.bssid
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'dst'
+ fields:
+ - origin.mac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'wired_mac'
+ fields:
+ - target.mac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'channel'
+ fields:
+ - target.mac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'vlan_id'
+ fields:
+ - log.wiredMac
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'channel'
+ fields:
+ - log.vlanId
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'rssi'
+ fields:
+ - log.channel
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'fc_type'
+ fields:
+ - log.rssi
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: 'fc_subtype'
+ fields:
+ - log.fcType
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - action
+ - log.ssid
+ - log.bssid
+ - origin.mac
+ - target.mac
+ - log.wiredMac
+ - log.vlanId
+ - log.channel
+ - log.rssi
+ - log.fcType
+ - log.fcSubType
+ - log.vap
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - action
+ - log.ssid
+ - log.bssid
+ - origin.mac
+ - target.mac
+ - log.wiredMac
+ - log.vlanId
+ - log.channel
+ - log.rssi
+ - log.fcType
+ - log.fcSubType
+ - log.vap
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
+ # ........................................
+ # Event: security_event ids_alerted, ids signature matched in Meraki MX Security Appliance
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: 'signature(\s)?='
+ - fieldName: log.signature
+ pattern: '{{.data}}priority'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.priority
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'timestamp(\s)?='
+ - fieldName: log.msgEventTime
+ pattern: '{{.data}}dhost'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.mac
+ pattern: '{{.data}}direction'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: log.direction
+ pattern: '{{.data}}protocol'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: protocol
+ pattern: '{{.data}}src'
+ - fieldName: log.irrelevant
+ pattern: '='
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}\:'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: 'dst(\s)?='
+ - fieldName: target.ip
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.hostname}}\:'
+ - fieldName: target.port
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'priority'
+ fields:
+ - log.signature
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'dhost'
+ fields:
+ - log.msgEventTime
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'direction'
+ fields:
+ - origin.mac
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'protocol'
+ fields:
+ - log.direction
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ - trim:
+ function: suffix
+ substring: 'src'
+ fields:
+ - protocol
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ # Adding action result
+ - add:
+ function: 'string'
+ params:
+ key: actionResult
+ value: 'accepted'
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
+ # ............................................................................
+ # Cleaning common fields
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.localIp
+ - origin.ip
+ - target.ip
+ - log.serverIp
+ - trim:
+ function: prefix
+ substring: ''''
+ fields:
+ - origin.ip
+ - log.peerIdent
+ - log.connectivity
+ - log.vpnType
+ - trim:
+ function: suffix
+ substring: ''''
+ fields:
+ - origin.port
+ - log.peerIdent
+ - log.connectivity
+ - log.vpnType
+ #......................................................................#
+ # Adding geolocation
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.serverIp
+ destination: log.serverIp.geolocation
+ where: exists("log.serverIp")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.localIp
+ destination: log.localIp.geolocation
+ where: exists("log.localIp")
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: log.ipResp
+ destination: log.ipResp.geolocation
+ where: exists("log.ipResp")
+ #......................................................................#
+ # Common field conversions
+ - cast:
+ fields:
+ - origin.port
+ - target.port
+ to: int
+ #......................................................................#
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.controlFlag
+ - log.irrelevant
+ - log.genericEvent
+ $$
+ WHERE id = 302 ;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210005_update_filter_cisco_deceptive_bytes.xml b/backend/src/main/resources/config/liquibase/changelog/20260210005_update_filter_cisco_deceptive_bytes.xml
new file mode 100644
index 000000000..94646afdd
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210005_update_filter_cisco_deceptive_bytes.xml
@@ -0,0 +1,510 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.notDefined
+ pattern: '{{.integer}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:'
+ - fieldName: log.userWithTrash
+ pattern: '{{.data}}CEF'
+ - fieldName: log.1trash
+ pattern: '\:{{.integer}}'
+ - fieldName: log.messageWithTrash
+ pattern: '{{.data}}{{.word}}\={{.data}}{{.space}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:'
+ - fieldName: log.userWithTrash
+ pattern: '{{.data}}CEF'
+ - fieldName: log.1trash
+ pattern: '\:{{.integer}}'
+ - fieldName: log.messageWithTrash
+ pattern: '{{.data}}{{.word}}\={{.data}}{{.space}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.user
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.userWithTrash
+
+ - grok:
+ patterns:
+ - fieldName: log.message
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.restMessageToKv
+ pattern: '{{.greedy}}'
+ source: log.messageWithTrash
+
+ # Parsing the common fields
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.eventTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.restMessage
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.eventTime
+ pattern: '\[{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.hour}}\:{{.minute}}\:{{.seconds}}'
+ - fieldName: log.restMessage
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.eventTime
+ pattern: '{{.monthDay}}-{{.monthNumber}}{{.space}}{{.hour}}\:{{.minute}}\:{{.seconds}}'
+ - fieldName: log.restMessage
+ pattern: '{{.greedy}}'
+ source: raw
+
+ # Parse the restMessage field from the rest of the common fields
+ - grok:
+ patterns:
+ - fieldName: log.processId
+ pattern: '\,{{.integer}}'
+ - fieldName: log.trheadId
+ pattern: '\,\-'
+ - fieldName: log.eventType
+ pattern: '\,{{.integer}}'
+ - fieldName: log.eventSource
+ pattern: '\,{{.word}}'
+ - fieldName: log.processName
+ pattern: '\,{{.integer}}'
+ - fieldName: log.processPath
+ pattern: '\,{{.word}}'
+ - fieldName: log.platform
+ pattern: '\,{{.data}}\,'
+ - fieldName: origin.path
+ pattern: '{{.greedy}}\,'
+ - fieldName: command
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.processId
+ pattern: '\,{{.integer}}'
+ - fieldName: log.trheadId
+ pattern: '\,{{.data}}\,'
+ - fieldName: log.eventType
+ pattern: '{{.integer}}'
+ - fieldName: log.eventSource
+ pattern: '\,\-'
+ - fieldName: log.processName
+ pattern: '\,{{.word}}\.{{.word}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.processId
+ pattern: '\,{{.integer}}'
+ - fieldName: log.trheadId
+ pattern: '\,{{.data}}\,'
+ - fieldName: log.eventType
+ pattern: '{{.integer}}'
+ - fieldName: log.eventSource
+ pattern: '\,\-\,'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.eventSource
+ pattern: '{{.integer}}\s'
+ - fieldName: log.component
+ pattern: '{{.word}}\,'
+ - fieldName: log.errorCode
+ pattern: '{{.integer}}\]'
+ - fieldName: log.restDataMessage
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.eventSource
+ pattern: '{{.integer}}\s'
+ - fieldName: log.component
+ pattern: '{{.word}}\,'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.eventSource
+ pattern: '{{.integer}}\s'
+ - fieldName: log.component
+ pattern: '{{.word}}\,'
+ - fieldName: log.errorCode
+ pattern: '{{.integer}}\]\s'
+ - fieldName: origin.path
+ pattern: '(?:[A-Z]:\\(?:[^\\\n]+\\)*[^\\\n]*|\/(?:[^\/\n]+\/)*[^\/\n]*)'
+ source: log.restMessage
+ where: contains("log.severityLabelCharacter", "V")
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.processId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\s'
+ - fieldName: log.methodName
+ pattern: '\:\:{{.data}}\,'
+ - fieldName: log.returnCode
+ pattern: '{{.integer}}\]\s'
+ - fieldName: log.detailedMessage
+ pattern: '\({{.data}}\)'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '{{.word}}\s'
+ - fieldName: log.processId
+ pattern: '{{.integer}}\,'
+ - fieldName: log.trheadId
+ pattern: '{{.integer}}\s'
+ - fieldName: log.methodName
+ pattern: '{{.data}}\:\:{{.data}}\,'
+ - fieldName: log.returnCode
+ pattern: '{{.integer}}\]\s'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.severityLabelCharacter
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.processId
+ pattern: '\[{{.integer}}\/'
+ - fieldName: log.trheadId
+ pattern: '{{.data}}\]:?\s'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ source: log.restMessage
+
+ # Using kv for the rest of the trash in the message
+ - kv:
+ fieldSplit: " "
+ valueSplit: "="
+ source: log.restMessageToKv
+
+ # Using grok to analyze the rest of the data
+ - grok:
+ patterns:
+ - fieldName: log.productVendor
+ pattern: '\|{{.data}}\|'
+ - fieldName: log.product
+ pattern: '{{.data}}\|'
+ - fieldName: log.productVersion
+ pattern: '{{.data}}\|'
+ - fieldName: log.signatureID
+ pattern: '{{.data}}\|'
+ - fieldName: log.eventType
+ pattern: '{{.data}}\|'
+ - fieldName: log.severity
+ pattern: '{{.data}}\|'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.pidStatusToKv
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ source: log.restDataMessage
+
+ - grok:
+ patterns:
+ - fieldName: log.0trash
+ pattern: '{{.data}}PID='
+ - fieldName: log.pid
+ pattern: '{{.integer}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: raw
+ where: contains("log.severityLabelCharacter", "W")
+
+ # Removing unnecessary characters
+ - trim:
+ function: prefix
+ substring: '|'
+ fields:
+ - log.productVendor
+
+ - trim:
+ function: suffix
+ substring: '|'
+ fields:
+ - log.productVendor
+ - log.product
+ - log.productVersion
+ - log.signatureID
+ - log.eventType
+ - log.severity
+
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.trheadId
+
+ - trim:
+ function: suffix
+ substring: '/'
+ fields:
+ - log.processId
+
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - log.syslogPriority
+
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - log.syslogPriority
+
+ - trim:
+ function: prefix
+ substring: ','
+ fields:
+ - log.trheadId
+ - log.processId
+ - log.eventType
+ - log.eventSource
+ - log.processName
+ - log.processPath
+ - log.platform
+ - origin.path
+
+ - trim:
+ function: suffix
+ substring: ','
+ fields:
+ - log.trheadId
+ - log.component
+ - log.platform
+ - origin.path
+ - log.eventSource
+ - log.processId
+ - log.methodName
+
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - command
+
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - command
+
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.eventTime
+ - log.processId
+ - log.severityLabelCharacter
+
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.status
+ - log.errorCode
+ - log.returnCode
+ - log.severityLabelCharacter
+ - log.trheadId
+
+ # Using the kv filter with default config, usefull in key-value logs
+ - kv:
+ fieldSplit: " "
+ valueSplit: "="
+ source: log.restData
+
+ # Using the kv filter with other config, usefull in key-value logs
+ - kv:
+ fieldSplit: ", "
+ valueSplit: "="
+ source: log.pidStatusToKv
+
+ # Adding severity based on log.severityLabelCharacter
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'high'
+ where: oneOf("log.severityLabelCharacter", ["C", "A", "E"])
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'medium'
+ where: equals("log.severityLabelCharacter", "W")
+
+ - add:
+ function: 'string'
+ params:
+ key: severity
+ value: 'low'
+ where: oneOf("log.severityLabelCharacter", ["D", "V", "N", "I", "T"])
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.0trash
+ - log.1trash
+ - log.restData
+ - log.restMessage
+ - log.restDataMessage
+ - log.irrelevant
+ - log.messageWithTrash
+ - log.restMessageToKv
+ - log.pidStatusToKv
+ - log.userWithTrash
+ - log.severityLabelCharacter
+
+
+ $$
+ WHERE id = 1512 ;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210006_update_filter_aix_ibm.xml b/backend/src/main/resources/config/liquibase/changelog/20260210006_update_filter_aix_ibm.xml
new file mode 100644
index 000000000..700b33d8c
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210006_update_filter_aix_ibm.xml
@@ -0,0 +1,588 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.deviceTime
+ pattern: '{{.monthName}}{{.space}}{{.monthDay}}{{.space}}{{.time}}'
+ - fieldName: log.msgInit
+ pattern: '{{.greedy}}'
+ source: raw
+
+ #......................................................................#
+ # Removing unnecessary characters of the syslogHeader
+ #......................................................................#
+ - trim:
+ function: prefix
+ substring: "<"
+ fields:
+ - log.priority
+ - trim:
+ function: suffix
+ substring: ">"
+ fields:
+ - log.priority
+
+ # .......................................................................#
+ # Checking that the message contains Message forwarded from
+ # .......................................................................#
+ - grok:
+ patterns:
+ - fildName: log.irrelevant
+ pattern: 'Message(\s)forwarded(\s)from'
+ - fieldName: from.host
+ pattern: '{{.data}}(\:)'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: log.msgInit
+ where: contains("log.msgInit", "Message forwarded from")
+
+ # Removing unnecessary characters
+ - trim:
+ function: suffix
+ substring: ":"
+ fields:
+ - from.host
+
+ #......................................................................#
+ # Checking that the message contains TTY= or PWD= or COMMAND= or USER=
+ #......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.commandType
+ pattern: '{{.data}}(\:)'
+ - fieldName: origin.user
+ pattern: '{{.data}}(\s)?(\:)'
+ - fieldName: log.msgWithTTY
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+ where: contains("log.msgAll", "TTY=") || contains("log.msgAll", "PWD=") || contains("log.msgAll", "USER=") || contains("log.msgAll", "COMMAND=")
+
+ # Removing unnecessary characters
+ - trim:
+ function: suffix
+ substring: ":"
+ fields:
+ - log.commandType
+ - origin.user
+ # ......................................................................#
+ # Using grok to parse msgWithTTY individual fields
+ # If "TTY=" in [msgWithTTY]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(TTY=)'
+ - fieldName: log.tty
+ pattern: '{{.data}}(\;)'
+ - fieldName: log.msgWithTTY
+ pattern: '{{.greedy}}'
+ source: log.msgWithTTY
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
+
+ # ......................................................................#
+ # If "PWD=" in [msgWithTTY]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(PWD=)'
+ - fieldName: log.pwd
+ pattern: '{{.data}}(\;)'
+ - fieldName: log.msgWithTTY
+ pattern: '{{.greedy}}'
+ source: log.msgWithTTY
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
+
+ # ......................................................................#
+ # If "USER=" in [msgWithTTY]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(USER=)'
+ - fieldName: origin.user
+ pattern: '{{.data}}(\;)'
+ - fieldName: log.msgWithTTY
+ pattern: '{{.greedy}}'
+ source: log.msgWithTTY
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
+
+ # ......................................................................#
+ # If "COMMAND=" in [msgWithTTY]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(COMMAND=)'
+ - fieldName: origin.command
+ pattern: '{{.greedy}}'
+ source: log.msgWithTTY
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
+
+ # ......................................................................#
+ # Using grok to parse msgAll
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.commandType
+ pattern: '{{.data}}(\:)'
+ - fieldName: origin.user
+ pattern: '{{.data}}(\s)?(\:)'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\)'
+ - fieldName: origin.command
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+ where: contains("log.msgAll", "(command continued)")
+
+ # ......................................................................#
+ # Removing unnecessary characters
+ # ......................................................................#
+ - trim:
+ function: suffix
+ substring: ";"
+ fields:
+ - log.tty
+ - log.pwd
+ - origin.user
+ - trim:
+ function: suffix
+ substring: ":"
+ fields:
+ - log.commandType
+ - origin.user
+
+ # ......................................................................#
+ # if message.matches("\\w+\\[[0-9]+\\]\\:") to parse msgAll
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.eventType
+ pattern: '{{.data}}\['
+ - fieldName: log.pid
+ pattern: '{{.integer}}\]:'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+ where: regexMatch("log.msgAll", "\\w+\\[[0-9]+\\]\\:")
+
+ # ......................................................................#
+ # Removing unnecessary characters
+ # ......................................................................#
+ - trim:
+ function: suffix
+ substring: "["
+ fields:
+ - log.eventType
+ - trim:
+ function: suffix
+ substring: "]:"
+ fields:
+ - log.pid
+
+ # ......................................................................#
+ # Format where the LENGTH, SESSIONID, ENTRYID, STATEMENT, USERID, USERHOST, ACTION, RETURNCODE, OBJ$CREATOR, OBJ$NAME, and OS$USERID fields exist
+ # ......................................................................#
+ # if ("LENGTH" in [message] or "SESSIONID" in [message] or "ENTRYID" in [message] or "STATEMENT" in [message] or "USERID" in [message] or "USERHOST" in [message] or "ACTION" in [message]
+ # or "RETURNCODE" in [message] or "OBJ$CREATOR" in [message] or "OBJ$NAME" in [message] or "OS$USERID" in [message])
+ # ......................................................................#
+ # Using grok to parse msg individual fields
+ # ......................................................................#
+ # If "LENGTH:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(LENGTH:)'
+ - fieldName: log.length
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "SESSIONID:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(SESSIONID:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.sessionID
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "ENTRYID:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(ENTRYID:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.entryID
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "STATEMENT:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(STATEMENT:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.statement
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "USERID:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(USERID:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.userID
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "USERHOST:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(USERHOST:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.userHost
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "ACTION:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(ACTION:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: action
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "RETURNCODE:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(RETURNCODE:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.returnCode
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "OBJ$CREATOR:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(OBJ$CREATOR:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.objCreator
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "OBJ$NAME:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(OBJ$NAME:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.objName
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # If "OS$USERID:" in [msg]
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '(OS$USERID:)'
+ - fieldName: log.irrelevant
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.osUserID
+ pattern: '\"{{.data}}\"'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................
+ # Removing msg field
+ # ......................................................................
+ - delete:
+ fields:
+ - log.msg
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
+
+ # ......................................................................#
+ # if ([msg]=~/from(.+)port/)
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}from(\s)'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}'
+ - fieldName: log.irrelevant
+ pattern: '(port)'
+ - fieldName: origin.port
+ pattern: '{{.integer}}'
+ - fieldName: log.restMsg
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: regexMatch("log.msg", "from(.+)port")
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}from(\s)user(\s)'
+ - fieldName: origin.user
+ pattern: '{{.word}}'
+ - fieldName: origin.ip
+ pattern: '{{.ipv4}}'
+ - fieldName: log.irrelevant
+ pattern: '(port)'
+ - fieldName: origin.port
+ pattern: '{{.greedy}}'
+ source: log.msg
+ where: regexMatch("log.msg", "from(.+)port")
+
+ # ......................................................................#
+ # if restmsg contains protocol SSH and SHA256
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: protocol
+ pattern: '{{.data}}(\:)'
+ - fieldName: log.sshKey
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}(\:)'
+ - fieldName: origin.sha256
+ pattern: '{{.greedy}}'
+ source: log.restMsg
+ where: contains("log.restMsg", "ssh") && contains("log.restMsg", "SHA256")
+
+ # ......................................................................#
+ # Fileds conversions
+ # ......................................................................#
+ - cast:
+ fields:
+ - origin.port
+ to: int
+
+ # ......................................................................#
+ # Removing unnecessary characters
+ # ......................................................................#
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.eventType
+ - protocol
+
+ # ......................................................................#
+ # Using grok to parse msgAll
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.eventType
+ pattern: '{{.word}}(\:)'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+
+ - grok:
+ patterns:
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msgAll
+
+ # ......................................................................#
+ # Using grok to parse msgInit
+ # ......................................................................#
+ - grok:
+ patterns:
+ - fieldName: log.eventType
+ pattern: '{{.word}}(\:)'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}(\[)'
+ - fieldName: log.pid
+ pattern: '{{.integer}}(\])'
+ - fieldName: log.msg
+ pattern: '{{.greedy}}'
+ source: log.msgInit
+ # ......................................................................#
+
+ # ......................................................................#
+ # Removing unnecessary characters
+ # ......................................................................#
+ - trim:
+ function: suffix
+ substring: ':'
+ fields:
+ - log.eventType
+
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.pid
+
+ # ......................................................................#
+ # Removing unnecessary characters
+ # ......................................................................#
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - log.length
+ - log.sessionID
+ - log.entryID
+ - log.statement
+ - log.userID
+ - log.userHost
+ - action
+ - log.returnCode
+ - log.objCreator
+ - log.objName
+ - log.osUserID
+
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - log.length
+ - log.sessionID
+ - log.entryID
+ - log.statement
+ - log.userID
+ - log.userHost
+ - action
+ - log.returnCode
+ - log.objCreator
+ - log.objName
+ - log.osUserID
+
+ # Adding geolocation to origin.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+
+ # Adding geolocation to target.ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: target.ip
+ destination: target.geolocation
+ where: exists("target.ip")
+
+ # ..........................................................................#
+ # Remove issues fileds
+ # ..........................................................................#
+ - delete:
+ fields:
+ - log.irrelevant
+ - log.msgWithTTY
+ - log.msgAll
+ - log.msgInit
+ - log.restMsg
+
+
+ $$
+ WHERE id = 1525;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210007_update_filter_o365.xml b/backend/src/main/resources/config/liquibase/changelog/20260210007_update_filter_o365.xml
new file mode 100644
index 000000000..91ca908e5
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210007_update_filter_o365.xml
@@ -0,0 +1,124 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210008_update_filter_windows_events.xml b/backend/src/main/resources/config/liquibase/changelog/20260210008_update_filter_windows_events.xml
new file mode 100644
index 000000000..aaf4e3d46
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210008_update_filter_windows_events.xml
@@ -0,0 +1,2998 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260210009_update_data_input_status_checkpoint.xml b/backend/src/main/resources/config/liquibase/changelog/20260210009_update_data_input_status_checkpoint.xml
new file mode 100644
index 000000000..ed77c3aae
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260210009_update_data_input_status_checkpoint.xml
@@ -0,0 +1,20 @@
+
+
+
+
+
+
+
+
+
+
+
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260211001_update_filter_bit_defender.xml b/backend/src/main/resources/config/liquibase/changelog/20260211001_update_filter_bit_defender.xml
new file mode 100644
index 000000000..d7257df07
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260211001_update_filter_bit_defender.xml
@@ -0,0 +1,287 @@
+
+
+
+
+
+
+ '
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.notDefined
+ pattern: '{{.integer}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.hostId
+ pattern: '{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}'
+ - fieldName: log.processPid
+ pattern: '\[{{.integer}}\]'
+ - fieldName: log.1trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.hostId
+ pattern: '{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}'
+ - fieldName: log.processPid
+ pattern: '\[{{.integer}}\]'
+ - fieldName: log.1trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.syslogHostIP
+ pattern: '{{.ipv4}}|{{.ipv6}}|{{.word}}'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.syslogVersion
+ pattern: '{{.integer}}'
+ - fieldName: log.syslogDeviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}\w{{.time}}\w'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.syslogPriority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.0trash
+ pattern: '{{.word}}\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.cefVersion
+ pattern: 'CEF\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
+ # Using grok to parse components of the cef_message
+ - grok:
+ patterns:
+ - fieldName: log.productVendor
+ pattern: '\|{{.data}}\|'
+ - fieldName: log.product
+ pattern: '{{.data}}\|'
+ - fieldName: log.productVersion
+ pattern: '{{.data}}\|'
+ - fieldName: log.signatureID
+ pattern: '{{.data}}\|'
+ - fieldName: log.eventType
+ pattern: '{{.data}}\|'
+ - fieldName: log.severity
+ pattern: '{{.data}}\|'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ # Using grok to parse kv issued fields with space
+ - grok:
+ patterns:
+ - fieldName: log.2trash
+ pattern: '{{.data}}dvc='
+ - fieldName: log.dvcToParse
+ pattern: '{{.data}}{{.word}}\='
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ - grok:
+ patterns:
+ - fieldName: log.2trash
+ pattern: '{{.data}}request='
+ - fieldName: log.requestToParse
+ pattern: '{{.data}}{{.word}}\='
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.restData
+
+ # Applying grok to remove unnecessary data
+ - grok:
+ patterns:
+ - fieldName: log.deviceIps
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.dvcToParse
+
+ - grok:
+ patterns:
+ - fieldName: log.requested
+ pattern: '{{.greedy}}{{.space}}'
+ - fieldName: log.irrelevant
+ pattern: '{{.greedy}}'
+ source: log.requestToParse
+
+ # Using the kv filter with default config, usefull in key-value logs
+ - kv:
+ fieldSplit: " "
+ valueSplit: "="
+ source: log.restData
+
+ # Renaming useful fields
+ - rename:
+ from:
+ - log.spt
+ to: origin.port
+
+ - rename:
+ from:
+ - log.src
+ to: origin.ip
+
+ - rename:
+ from:
+ - log.sproc
+ to: origin.path
+
+ - rename:
+ from:
+ - log.filePath
+ to: origin.path
+
+ # Removing unnecessary characters
+ - trim:
+ function: prefix
+ substring: '|'
+ fields:
+ - log.productVendor
+
+ - trim:
+ function: suffix
+ substring: '|'
+ fields:
+ - log.productVendor
+ - log.product
+ - log.productVersion
+ - log.signatureID
+ - log.eventType
+ - log.severity
+
+ - trim:
+ function: prefix
+ substring: '<'
+ fields:
+ - log.syslogPriority
+
+ - trim:
+ function: suffix
+ substring: '>'
+ fields:
+ - log.syslogPriority
+
+ - trim:
+ function: prefix
+ substring: '['
+ fields:
+ - log.processPid
+
+ - trim:
+ function: suffix
+ substring: ']'
+ fields:
+ - log.processPid
+
+ # Adding geolocation to origin ip
+ - dynamic:
+ plugin: com.utmstack.geolocation
+ params:
+ source: origin.ip
+ destination: origin.geolocation
+ where: exists("origin.ip")
+
+ # Reformat and field conversions
+ - cast:
+ fields:
+ - origin.port
+ to: int
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.0trash
+ - log.1trash
+ - log.2trash
+ - log.restData
+ - log.irrelevant
+ - log.spt
+ - log.src
+ - log.sproc
+ - log.filePath
+ - log.dvc
+ - log.request
+ - log.dvcToParse
+ - log.cefVersion
+ $$
+ WHERE id = 1514;
+ ]]>
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260211002_update_utm_correlation_seq.xml b/backend/src/main/resources/config/liquibase/changelog/20260211002_update_utm_correlation_seq.xml
new file mode 100644
index 000000000..50ae828bb
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260211002_update_utm_correlation_seq.xml
@@ -0,0 +1,16 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260211003_update_filter_netflow.xml b/backend/src/main/resources/config/liquibase/changelog/20260211003_update_filter_netflow.xml
new file mode 100644
index 000000000..44e923b60
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260211003_update_filter_netflow.xml
@@ -0,0 +1,295 @@
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/backend/src/main/resources/config/liquibase/data/20260209/utm_correlation_rules.sql b/backend/src/main/resources/config/liquibase/data/20260209/utm_correlation_rules.sql
new file mode 100644
index 000000000..60df0f5c3
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/data/20260209/utm_correlation_rules.sql
@@ -0,0 +1,12942 @@
+TRUNCATE TABLE utm_correlation_rules RESTART IDENTITY CASCADE;
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (1, 'Antivirus Service Stopped or Disabled', 2, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when the Bitdefender antivirus service or critical security modules are stopped, disabled, or experiencing failures. This is a critical security event that could indicate malicious tampering or system issues.
+
+Next Steps:
+- Verify if the service was intentionally stopped by authorized personnel
+- Check system logs for any errors or crashes that may have caused the service to stop
+- Look for signs of malware or unauthorized access attempts around the time of the event
+- Review recent system changes or updates that might have affected the antivirus service
+- If tampering is suspected, isolate the affected system and perform a forensic analysis
+- Restart the Bitdefender service and ensure all modules are functioning properly
+- Monitor for recurring issues that might indicate persistent threats
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1562/001/"]', '(equals("log.eventType", "modules") ||
+ equals("log.eventType", "Product ModulesStatus") ||
+ equals("log.eventType", "registration")) &&
+(oneOf("log.severity", ["high", "5"]) ||
+ contains("log.product", "disabled") ||
+ contains("log.product", "stopped") ||
+ (contains("log.restData", "module") && contains("log.restData", "stopped")) ||
+ (contains("log.restData", "module") && contains("log.restData", "disabled")) ||
+ (contains("log.restData", "av") && contains("log.restData", "failure")))
+', '2026-02-09 16:28:45.181415', true, false, 'origin', null, '[]', '["lastEvent.log.eventType","lastEvent.log.hostId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (2, 'Bitdefender AV Policy Weakened', 3, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when Bitdefender GravityZone antivirus policies are weakened by administrators, such as disabling real-time protection, reducing scan aggressiveness, or adding broad exclusions. This could indicate a compromised admin account or insider threat.
+
+Next Steps:
+1. Identify the administrator who modified the policy
+2. Verify the policy change was authorized through change management
+3. Review the specific settings that were weakened
+4. Check for concurrent suspicious activity on managed endpoints
+5. Restore the previous policy configuration if unauthorized
+6. Review admin account access logs for compromise indicators
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1562/001/"]', '(contains("log.message", ["policy", "configuration", "setting"]) &&
+ (contains("log.message", ["disabled", "weakened", "reduced", "lowered", "excluded"]) ||
+ (contains("log.message", "real-time") && contains("log.message", "off")) ||
+ (contains("log.message", "exclusion") && contains("log.message", "added")) ||
+ (contains("log.message", "protection") && contains("log.message", "disabled")))) &&
+exists("log.severity")
+', '2026-02-09 16:28:45.307390', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"log.hostId","operator":"filter_term","value":"{{log.hostId}}"}],"or":null,"within":"now-1h","count":3}]', '["lastEvent.log.eventType","lastEvent.log.hostId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (3, 'Bootkit/UEFI Threat Detection', 3, 3, 3, 'Defense Evasion, Persistence', 'T1542.001 - Boot or Logon Autostart Execution: System Firmware', 'Detects bootkit or UEFI-level threats that attempt to persist at the firmware level and compromise the boot process. These threats can survive system reinstalls and bypass traditional security measures by infecting the system firmware.
+
+Next Steps:
+- Isolate the affected system immediately to prevent spread
+- Review system boot logs and firmware settings for modifications
+- Check for other malware detections on the same host in the past 24-48 hours
+- Verify system integrity using offline scanning tools
+- Consider reimaging the system and updating firmware/UEFI
+- Enable Secure Boot if not already enabled
+- Review user activity and recently installed software on the affected system
+- Document the infection for incident response reporting
+- Check if other systems with similar hardware/firmware versions are affected
+', '["https://attack.mitre.org/techniques/T1542/001/","https://www.bitdefender.com/business/support/en/77209-135324-event-types.html"]', 'equals("log.eventType", "av") &&
+greaterOrEqual("log.severity", 8) &&
+(
+ contains("log.requested", ["boot", "uefi", "rootkit", "firmware"]) ||
+ contains("log.restData", ["boot", "uefi", "rootkit", "firmware",
+ "\\EFI\\", "/EFI/", "\\boot\\", "/boot/"])
+)
+', '2026-02-09 16:28:45.432145', true, false, 'origin', null, '[]', '["lastEvent.log.hostId","lastEvent.log.severity"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (4, 'Bitdefender Console Used for Lateral Movement', 3, 3, 3, 'Lateral Movement', 'T1072 - Software Deployment Tools', 'Detects when the Bitdefender GravityZone management console is potentially being used to push malicious policies, scripts, or tasks to managed endpoints, indicating a compromised admin account being leveraged for lateral movement.
+
+Next Steps:
+1. Review all recent task and policy deployments from the console
+2. Identify the admin account used and verify its legitimacy
+3. Check for unusual login patterns to the GravityZone console
+4. Review the content of pushed policies for malicious configurations
+5. Suspend the admin account if compromise is suspected
+6. Audit all managed endpoints for signs of compromise
+', '["https://attack.mitre.org/techniques/T1072/","https://www.bitdefender.com/business/support/en/77212-237089-event-types.html"]', '(contains("log.message", ["remote task", "deploy", "push policy", "execute script"]) ||
+ (contains("log.message", "task") && contains("log.message", "created") &&
+ (contains("log.message", "scan") || contains("log.message", "install") ||
+ contains("log.message", "uninstall") || contains("log.message", "execute")))) &&
+exists("log.severity")
+', '2026-02-09 16:28:45.567103', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"log.hostId","operator":"filter_term","value":"{{log.hostId}}"}],"or":null,"within":"now-30m","count":10}]', '["lastEvent.log.eventType","lastEvent.log.hostId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (5, 'Advanced Persistent Threat (APT) Detection', 3, 3, 2, 'Command and Control', 'TA0011 - Application Layer Protocol', 'Detects indicators of Advanced Persistent Threats including targeted attacks, sophisticated malware, and persistent threats detected by Bitdefender GravityZone''s HyperDetect module.
+
+Next Steps:
+- Investigate the affected endpoint to determine the scope of compromise
+- Review process execution history and network connections from the affected system
+- Check for lateral movement by examining authentication logs from the same source IP
+- Isolate the affected system if active threat is confirmed
+- Collect forensic artifacts including memory dumps and event logs
+- Search for similar malware indicators across the environment
+- Review user account activities for signs of credential compromise
+- Contact security operations center if threat actors match known APT groups
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/tactics/TA0011/"]', 'equals("log.product", "Bitdefender GravityZone") &&
+greaterOrEqual("log.severity", 8) &&
+(
+ contains("log.eventType", ["apt", "targeted", "advanced", "persistent", "hyperdetect"]) ||
+ contains("log.restData", ["apt", "targeted attack", "advanced persistent",
+ "lazarus", "equation", "sofacy", "cozy bear", "fancy bear",
+ "panda", "kitten", "carbanak", "fin7", "fileless"]) ||
+ equals("log.signatureID", "hyperdetect")
+) &&
+exists("log.hostId")
+', '2026-02-09 16:28:45.697226', true, false, 'origin', null, '[]', '["lastEvent.log.eventType","lastEvent.log.hostId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (6, 'Crypto-Mining Detection', 2, 2, 3, 'Impact', 'T1496 - Resource Hijacking', 'Detects cryptocurrency mining activities including miners, coin miners, and cryptojacking attempts detected by Bitdefender GravityZone.
+
+Next Steps:
+- Review the affected endpoint details (hostname, IP) to identify the compromised system
+- Check CPU and memory usage patterns on the affected system for unusual spikes
+- Look for network connections to known mining pools or suspicious outbound traffic
+- Search for related processes running with names like xmrig, minerd, cgminer, or bfgminer
+- Review recent file downloads and installations on the affected system
+- Check for persistence mechanisms (scheduled tasks, startup items, services)
+- Isolate the affected system if active mining is confirmed
+- Run a full system scan with updated definitions
+- Consider reimaging the system if compromise is extensive', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1496/"]', 'equals("log.productVendor", "Bitdefender") &&
+equals("log.product", "GravityZone") &&
+(
+ contains("log.eventType", ["miner", "coin", "crypto", "CoinMiner"]) ||
+ contains("log.requested", ["miner", "coin", "xmr", "monero", "bitcoin",
+ "ethereum", "xmrig", "minerd", "cgminer", "bfgminer", "coinhive"])
+)
+', '2026-02-09 16:28:45.842442', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (7, 'Email-Based Threat Spreading', 3, 3, 2, 'Initial Access', 'T1566 - Phishing', 'Detects email-based malware spreading including phishing attempts, malicious attachments, and email-borne threats through Bitdefender''s Exchange protection. This rule triggers on Exchange-specific malware events and monitors for patterns of email-based threats.
+
+Next Steps:
+1. Investigate the affected email and sender:
+ - Check the sender''s email address and domain reputation
+ - Review email headers for spoofing indicators
+ - Analyze attachment hash values if present in log.restData
+ - Check log.severity for threat level assessment
+2. Review related events:
+ - Look for similar events from the same sender or to other recipients
+ - Check if the email was delivered or blocked
+ - Verify if any users clicked links or opened attachments
+ - Search for the same signatureID across other hosts
+3. Remediation actions:
+ - If delivered, recall the email from all recipients immediately
+ - Reset credentials if phishing was successful
+ - Block sender domain/IP at email gateway
+ - Update email security policies if needed
+ - Scan affected endpoints for malware if attachments were opened
+ - Update Bitdefender Exchange protection rules
+4. Investigation commands:
+ - Check host status: Verify log.hostId endpoint protection status
+ - Review product version: Ensure log.productVersion is up to date
+ - Analyze event patterns: Look for unusual log.eventType combinations
+', '["https://attack.mitre.org/techniques/T1566/","https://www.bitdefender.com/business/support/en/77209-135324-event-types.html"]', 'oneOf("log.eventType", ["exchange-malware", "exchange-user-credentials", "exchange-organization-info"]) ||
+(contains("log.eventType", "exchange") && equals("log.severity", "High")) ||
+(contains("log.product", "Exchange") && contains("log.eventType", ["malware", "phishing"]))
+', '2026-02-09 16:28:45.976907', true, false, 'origin', null, '[]', '["lastEvent.log.hostId","lastEvent.log.signatureID"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (8, 'Fileless Malware Detection', 2, 2, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects fileless malware attacks including PowerShell-based attacks, memory injection, and living-off-the-land techniques using Bitdefender GravityZone''s HyperDetect and Command-Line Scanner modules. These attacks execute malicious code directly in memory without writing to disk, making them harder to detect with traditional antivirus.
+
+Next Steps:
+- Isolate the affected endpoint immediately to prevent lateral movement
+- Review process tree to identify the parent process and initial attack vector
+- Check for PowerShell command history and script blocks (Event ID 4104)
+- Look for suspicious WMI activity or unusual process spawning patterns
+- Examine network connections from the affected process
+- Collect memory dump if the process is still running
+- Review user activity to determine if account is compromised
+- Apply security patches if exploitation of vulnerability is suspected
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1055/","https://www.bitdefender.com/en-us/business/gravityzone-platform/fileless-attack-defense"]', 'oneOf("log.eventType", ["fileless_attack", "hyperdetect_fileless", "command_line_scanner"]) ||
+(
+ equals("log.eventType", "malware_detected") &&
+ contains("log.restData", ["fileless", "memory injection", "powershell",
+ "wscript", "cscript", "mshta", "regsvr32", "rundll32"])
+) ||
+(
+ oneOf("log.severity", ["HIGH", "CRITICAL"]) &&
+ contains("log.restData", "code injection")
+)
+', '2026-02-09 16:28:46.092180', true, false, 'origin', null, '[]', '["lastEvent.log.eventType","lastEvent.log.hostId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (9, 'Bitdefender GravityZone High Severity Threat Detection', 3, 3, 2, 'Execution', 'T1204.002 - User Execution: Malicious File', 'Detects high-severity malware threats identified by Bitdefender GravityZone that require immediate attention. This rule triggers on severity levels 8-10, which indicate critical threats such as trojans, ransomware, rootkits, or other advanced malware.
+
+Next Steps:
+1. Immediately isolate the affected endpoint(s) from the network to prevent lateral movement
+2. Review the threat details in Bitdefender GravityZone console:
+ - Check threat name and malware type from the event details
+ - Verify the affected file path and process information
+ - Review the action taken by Bitdefender (quarantine, delete, etc.)
+3. Investigate the source of infection:
+ - Check origin.ip and origin.path for the malware source
+ - Review recent user activity and email attachments
+ - Look for similar threats on other endpoints
+4. Perform forensic analysis:
+ - Collect memory dumps if rootkit or fileless malware is suspected
+ - Check for persistence mechanisms (registry, scheduled tasks, services)
+ - Review network connections from the affected host
+5. Remediation actions:
+ - Ensure Bitdefender has successfully cleaned/quarantined the threat
+ - Run full system scan on affected and neighboring systems
+ - Update antivirus signatures and security policies
+ - Consider reimaging if system integrity is compromised
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1204/002/","https://attack.mitre.org/techniques/T1055/"]', 'oneOf("log.severity", ["8", "9", "10"]) && oneOf("log.eventType", ["avc", "malware_detected", "av"])', '2026-02-09 16:28:46.176247', true, false, 'origin', null, '[]', '["lastEvent.log.signatureID","lastEvent.log.syslogHostIP"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (149, 'Azure Global Administrator Role Addition to PIM User', 3, 3, 3, 'Persistence', 'T1098.001 - Account Manipulation: Additional Cloud Credentials', 'Detects when users are granted Global Administrator (Company Administrator) role assignments through Azure AD/Entra ID Privileged Identity Management (PIM).
+
+**Security Context:**
+The Global Administrator role is the most powerful administrative role in Azure AD/Entra ID, granting complete control over all aspects of the directory and services that use Azure AD identities. PIM enables just-in-time privileged access through eligible (requires activation) or time-bound assignments. Adversaries who gain sufficient privileges may add themselves or other compromised accounts to this role to establish persistence and maintain full administrative control over the tenant.
+
+**Detection Logic:**
+This rule monitors AuditLogs for successful PIM role assignments specifically for the Global Administrator role. It detects both:
+- **Eligible assignments (permanent)**: User can activate the role when needed
+- **Active assignments (time-bound)**: Role is directly active for a specified duration
+
+The rule identifies these assignments through the operation names and filters for the Global Administrator role specifically.
+
+**Investigation Steps:**
+1. Identify the assignor: Check log.propertiesInitiatedBy for who made the role assignment
+2. Identify the assignee: Examine log.propertiesTargetResources for the user receiving the role
+3. Verify authorization: Confirm if this assignment was part of approved privileged access request
+4. Check assignment type: Determine if it''s eligible (requires activation) or time-bound (direct)
+5. Review duration: For time-bound assignments, check the duration of the assignment
+6. Analyze timing: Determine if assignment follows suspicious authentication or compromise indicators
+7. Review justification: Check if a business justification was provided in log.propertiesAdditionalDetails
+8. Check user history: Review the assignee''s account for recent suspicious activity
+9. Examine recent actions: Look for privileged operations performed immediately after assignment
+10. Correlate with sign-ins: Check for unusual authentication patterns before/after assignment
+
+**Recommended Actions:**
+- If unauthorized, immediately revoke the Global Administrator role assignment
+- Review all recent PIM role assignments for anomalies
+- Enable PIM approval workflows for Global Administrator role assignments
+- Implement maximum assignment duration limits for time-bound assignments
+- Require MFA and justification for all Global Administrator activations
+- Enable PIM alerts for high-privilege role assignments
+- Audit accounts with Privileged Role Administrator permissions
+- Review and limit the number of permanent Global Administrator assignments
+- Enable Azure AD Identity Protection to detect compromised credentials
+- Implement break-glass emergency access accounts following best practices
+
+**PIM Assignment Types:**
+- **Eligible (permanent)**: User must activate the role when needed, typically with MFA and justification
+- **Active (time-bound)**: Role is directly assigned for a limited duration without activation required
+- Both types should be monitored as adversaries may use either for persistence
+
+**Common Attack Patterns:**
+- Compromised Privileged Role Administrator adding backdoor accounts
+- Insider threat establishing persistent administrative access
+- Privilege escalation from lower-privilege administrative roles
+- Adding service principals or managed identities to Global Administrator role
+- Creating long-duration time-bound assignments for sustained access
+
+**MITRE ATT&CK Reference:** T1098.001 - Account Manipulation: Additional Cloud Credentials
+
+**Azure Documentation:**
+- AuditLogs table: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs
+- PIM for Azure AD roles: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
+', '["https://attack.mitre.org/techniques/T1098/001/","https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs","https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure","https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-administrator"]', 'equalsIgnoreCase("log.category", "AuditLogs") &&
+(equals("log.resultType", "0") || equalsIgnoreCase("actionResult", "SUCCESS")) &&
+(contains("log.operationName", "Add eligible member to role") || contains("log.operationName", "Add member to role")) &&
+(contains("log.properties.targetResources.displayName", "Global Administrator") || contains("log.properties.targetResources.displayName", "Company Administrator"))
+', '2026-02-09 16:31:20.596213', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (10, 'Memory-Based Threat Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects memory-based threats including process injection, memory manipulation, and fileless malware executing in memory based on Bitdefender GravityZone event types.
+
+Next Steps:
+1. Identify the affected process and host using log.hostId and origin.path fields
+2. Check if the process is legitimate or if it shows signs of compromise
+3. Review the process tree to identify parent-child relationships
+4. Look for other suspicious activities on the same host in the last hour
+5. Collect memory dump if the process is still running
+6. Analyze network connections from the affected process
+7. Check for persistence mechanisms on the affected system
+8. Isolate the host if active malicious behavior is confirmed
+', '["https://attack.mitre.org/techniques/T1055/","https://www.bitdefender.com/business/support/en/77209-135324-event-types.html"]', 'exists("log.eventType") &&
+(oneOf("log.eventType", ["aph", "antiexploit", "hd"]) ||
+ (exists("origin.path") && contains("origin.path", "memory"))) &&
+(oneOf("log.severity", ["critical", "high"]) ||
+ exists("log.malwareName") ||
+ exists("log.threatName"))
+', '2026-02-09 16:28:46.350884', true, false, 'origin', null, '[]', '["lastEvent.log.hostId","adversary.path"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (11, 'Malware Outbreak Detection - Multiple Hosts Infected', 3, 3, 3, 'Command and Control', 'T1105 - Ingress Tool Transfer', 'Detects when the same malware signature or threat is detected on multiple endpoints within a short time window. This pattern indicates a potential malware outbreak spreading across the network environment.
+
+Next Steps:
+1. Immediately isolate affected endpoints to prevent further spread
+2. Identify the malware signature ID and research its capabilities and impact
+3. Check network logs for lateral movement patterns between infected hosts
+4. Review the initial infection vector - check email logs, web proxy logs, and USB device usage
+5. Verify antivirus definitions are up-to-date on all endpoints
+6. Conduct memory and disk forensics on patient zero if identifiable
+7. Check for persistence mechanisms on infected systems
+8. Review domain controller and authentication logs for credential compromise
+9. Document all affected systems and timeline for incident response
+10. Consider engaging incident response team if outbreak involves critical systems
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1105/"]', 'equals("log.eventType", "AntiMalware") &&
+oneOf("log.severity", ["4", "5"]) &&
+exists("log.signatureID") &&
+exists("log.syslogHostIP")
+', '2026-02-09 16:28:46.496449', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"log.signatureID","operator":"filter_term","value":"{{log.signatureID}}"},{"field":"log.eventType","operator":"filter_term","value":"AntiMalware"}],"or":null,"within":"now-2h","count":10}]', '["lastEvent.log.signatureID","lastEvent.log.syslogHostIP"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (12, 'Multiple Malware Detections from Single Source', 3, 3, 2, 'Command and Control', 'T1105 - Ingress Tool Transfer', 'Detects when multiple malware threats are detected on a single host within a short time period. This could indicate a compromised system actively spreading malware or an attacker launching multiple malware variants.
+
+Next Steps:
+1. Investigate the affected host:
+ - Identify the system using the hostId field
+ - Check if it''s a critical system or server
+ - Review recent user activity on the host
+2. Analyze the detected malware:
+ - Review the malware types and names detected (signatureID field)
+ - Check file paths and processes involved
+ - Determine if malware was successfully quarantined
+3. Check for lateral movement:
+ - Look for connections from the affected host to other internal systems
+ - Review authentication logs for suspicious activity
+ - Check for file share access patterns
+4. Remediation actions:
+ - Isolate the affected system if confirmed compromised
+ - Run full system scans on potentially affected systems
+ - Update antivirus signatures and definitions
+ - Consider reimaging if system is severely compromised
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1105/"]', 'equals("log.eventType", "AntiMalware") &&
+oneOf("log.severity", ["4", "5"]) &&
+exists("log.hostId")
+', '2026-02-09 16:28:46.621867', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"log.hostId","operator":"filter_term","value":"{{log.hostId}}"},{"field":"log.eventType","operator":"filter_term","value":"AntiMalware"}],"or":null,"within":"now-1h","count":5}]', '["lastEvent.log.hostId","lastEvent.log.signatureID"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (13, 'Network-Based Threat Detection', 3, 2, 3, 'Command and Control', 'T1071 - Application Layer Protocol: Command and Control', 'Detects network-based threats including C2 communications, malicious network activity, and suspicious network connections identified by Bitdefender GravityZone.
+
+Next Steps:
+1. Identify the affected host using log.hostId and check for other security events from this system
+2. Review origin.ip to determine if it''s a known malicious IP or C2 server
+3. Check firewall logs for any blocked or allowed connections to/from the suspicious IP
+4. Investigate running processes on the affected host for signs of malware
+5. Review network traffic patterns for data exfiltration attempts
+6. If ransomware is detected, immediately isolate the affected system
+7. Collect network packet captures if available for deeper analysis
+8. Check if other hosts have communicated with the same external IP address
+9. Submit suspicious IPs to threat intelligence platforms for reputation checking
+10. Document findings and update firewall rules to block confirmed malicious IPs
+', '["https://attack.mitre.org/techniques/T1071/","https://www.bitdefender.com/business/support/en/77209-135324-event-types.html"]', '(oneOf("log.eventType", ["network-sandboxing", "fw"]) &&
+ oneOf("log.severity", ["high", "critical", "4", "5"])) ||
+(exists("origin.ip") && contains("log.eventType", "network") &&
+ contains("log.restData", ["malware", "threat", "blocked", "c2", "botnet"])) ||
+(equals("log.severity", "critical") && contains("log.product", "network"))
+', '2026-02-09 16:28:46.751926', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"log.hostId","operator":"filter_term","value":"{{log.hostId}}"},{"field":"log.eventType","operator":"filter_term","value":"network-sandboxing"}],"or":null,"within":"now-4h","count":3}],"within":"now-2h","count":5}]', '["lastEvent.log.hostId","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (24, 'Deception API Call Tracking', 2, 2, 1, 'Execution', 'T1106 - Native API', 'Tracks suspicious API calls made to decoy services or endpoints. This behavior indicates an attacker is attempting to interact with what they believe are legitimate services but are actually deception assets.
+
+Next Steps:
+- Review the source IP address and check if it''s from a known legitimate source
+- Examine the API endpoint accessed and the HTTP method used
+- Look for other activity from the same IP address across all log sources
+- Check if the source IP has accessed multiple decoy endpoints (indicating reconnaissance)
+- Investigate any authentication tokens or credentials used in the API calls
+- Consider blocking the source IP if malicious intent is confirmed
+- Document the attack pattern for threat intelligence sharing
+', '["https://attack.mitre.org/techniques/T1106/","https://deceptivebytes.com/solution/"]', 'equals("log.eventType", "api_call") && equals("log.isDecoy", "true") && exists("log.httpMethod") && exists("origin.ip")', '2026-02-09 16:28:48.236834', true, false, 'origin', null, '[]', '["lastEvent.log.apiEndpoint","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (14, 'Bitdefender GravityZone Quarantine Failure Detection', 3, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when Bitdefender GravityZone fails to quarantine detected malware. This could indicate that the malware is actively resisting remediation attempts or that there are permission issues preventing proper quarantine.
+
+Next Steps:
+- Immediately isolate the affected system from the network
+- Check if the malware process is still running and attempt manual termination
+- Verify antivirus permissions and ensure it has necessary privileges
+- Review system logs for signs of privilege escalation or rootkit activity
+- Consider reimaging the system if quarantine continues to fail
+- Check for similar failures on other systems in the environment
+- Investigate the specific malware detected and research its capabilities
+- Review quarantine configuration and storage capacity
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1562/001/"]', 'oneOf("log.eventType", ["quarantine_failed", "quarantine_failure"]) ||
+(equals("log.eventType", "AntiMalware") &&
+ (containsAll("log.requestToParse", ["quarantine", "fail"]) ||
+ contains("log.restData", ["quarantine failed", "unable to quarantine", "failed to quarantine"]) ||
+ (equals("log.severity", "failure") && contains("log.requestToParse", "quarantine"))))
+', '2026-02-09 16:28:46.891407', true, false, 'origin', null, '[]', '["lastEvent.log.hostId","lastEvent.log.signatureID"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (15, 'Ransomware Behavior Detection', 3, 3, 3, 'Impact', 'T1486 - Data Encrypted for Impact', 'Detects ransomware behavior patterns including file encryption attempts, mass file modifications, and ransomware-specific malware types detected by Bitdefender GravityZone.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent spread
+2. Check for recent backup availability and integrity
+3. Review process execution history on the affected host
+4. Look for suspicious file modifications or mass encryption activities
+5. Check for ransomware notes or changed file extensions
+6. Investigate the source of infection (email attachments, downloads, RDP compromise)
+7. Scan other systems for similar indicators
+8. Consider engaging incident response team for containment and recovery
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1486/"]', '(contains("log.message", ["ransomware", "ransom", "locky", "cerber",
+ "wannacry", "petya", "ryuk", "sodinokibi", "maze"]) ||
+ contains("log.signatureID", "ransomware") ||
+ (equals("log.severity", "10") && contains("log.eventType", "malware"))) &&
+exists("log.severity")
+', '2026-02-09 16:28:47.031671', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"log.hostId","operator":"filter_term","value":"{{log.hostId}}"}],"or":null,"within":"now-10m","count":5}]', '["lastEvent.log.hostId","lastEvent.log.signatureID"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (16, 'Real-time Protection Disabled', 3, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when real-time protection features are disabled on an endpoint. This is a critical security event as it leaves the system vulnerable to malware infections and requires immediate investigation.
+
+Next Steps:
+1. Immediately investigate who disabled the real-time protection and why
+2. Check if the action was authorized by IT security team
+3. Review recent activity on the affected endpoint for signs of compromise
+4. Re-enable real-time protection if the action was unauthorized
+5. Check for any malware infections that may have occurred while protection was disabled
+6. Review system logs for any suspicious activities during the protection downtime
+7. Consider implementing additional controls to prevent unauthorized disabling of security tools
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1562/001/"]', 'exists("log.syslogHostIP") &&
+(
+ (equals("log.eventType", "modules") &&
+ equals("log.product", "av") &&
+ contains("log.restData", "real-time")) ||
+ (equals("log.eventType", "Product ModulesStatus") &&
+ oneOf("log.severity", ["4", "5"]) &&
+ (contains("log.restData", "protection disabled") ||
+ contains("log.restData", "real-time scanning disabled")))
+)
+', '2026-02-09 16:28:47.155607', true, false, 'origin', null, '[]', '["lastEvent.log.eventType","lastEvent.log.syslogHostIP"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (17, 'Rootkit Detection', 3, 3, 2, 'Defense Evasion', 'T1014 - Rootkit', 'Detects rootkit infections and kernel-level threats that attempt to hide malicious activity at the system level using Bitdefender GravityZone''s advanced detection capabilities.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Capture a memory dump and disk image for forensic analysis
+3. Check for signs of privilege escalation or kernel-level modifications
+4. Review system logs for any suspicious driver installations or kernel module loading
+5. Scan other systems in the same network segment for similar infections
+6. Consider rebuilding the system from a known clean state as rootkits can be difficult to fully remove
+7. Review how the rootkit was initially delivered (email attachment, exploit kit, etc.)
+8. Update all security software and operating system patches
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1014/"]', 'equals("log.eventType", "malware_detected") &&
+oneOf("log.severity", ["high", "critical"]) &&
+(
+ contains("log.restData", ["rootkit", "kernel", "tdss", "zeroaccess",
+ "necurs", "bootkit", "alureon", "rustock", "sinowal"]) ||
+ contains("log.requested", "rootkit") ||
+ equals("log.signatureID", "rootkit")
+)
+', '2026-02-09 16:28:47.296159', true, false, 'origin', null, '[]', '["lastEvent.log.hostId","lastEvent.log.signatureID"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (18, 'Bitdefender GravityZone Suspicious Exclusion Added', 3, 3, 1, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when exclusions are added to Bitdefender GravityZone that may allow malware to operate undetected. Attackers often add exclusions to antivirus software to prevent detection of their malicious tools and activities.
+
+Next Steps:
+1. Review the exclusion details to determine what files, folders, or processes were excluded
+2. Verify if the exclusion was authorized by security team or IT administrators
+3. Check if the excluded path contains any suspicious executables or scripts
+4. Review recent activity from the user who added the exclusion
+5. If unauthorized, immediately remove the exclusion and scan the excluded locations
+6. Consider implementing a change control process for antivirus exclusions
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1562/001/"]', 'equals("log.eventType", "exclusion_added") ||
+(oneOf("log.eventType", ["policy_change", "configuration_change"]) &&
+ contains("log.requested", "exclusion"))
+', '2026-02-09 16:28:47.446530', true, false, 'origin', null, '[]', '["lastEvent.log.eventType","lastEvent.log.hostId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (192, 'AWS GuardDuty Detector Deletion', 3, 2, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/delete-detector.html","https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html"]', 'equals("log.eventSource", "guardduty.amazonaws.com") &&
+equals("log.eventName", "DeleteDetector")
+', '2026-02-09 16:32:23.040735', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (19, 'USB-Based Malware Propagation', 3, 3, 2, 'Lateral Movement, Initial Access', 'T1091 - Replication Through Removable Media', 'Detects USB-based malware propagation attempts including autorun infections, removable media threats, and device control violations. This rule monitors for device control events and removable media access patterns that may indicate malware attempting to spread via USB devices.
+
+Next Steps:
+1. Isolate the affected endpoint immediately to prevent further spread
+2. Check device control logs for unauthorized USB device connections
+3. Scan all removable media that were connected to the affected system
+4. Review file creation/modification events on removable drives (especially autorun.inf)
+5. Verify if similar events occurred on other endpoints in the network
+6. Update device control policies to restrict USB usage if necessary
+7. Consider implementing USB device whitelisting for critical systems
+', '["https://attack.mitre.org/techniques/T1091/","https://www.bitdefender.com/business/support/en/77209-135324-event-types.html"]', '(oneOf("log.eventType", ["device-control", "dp"]) &&
+ (contains("log.restData", ["malware", "threat", "infection", "autorun", "suspicious"]) ||
+ oneOf("log.severity", ["high", "critical", "4", "5"]))) ||
+(contains("log.requested", ["usb", "removable", "autorun"]) &&
+ contains("log.restData", ["malware", "threat", "infection"]))
+', '2026-02-09 16:28:47.571150', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-bitdefender-gz-*","with":[{"field":"log.hostId","operator":"filter_term","value":"{{log.hostId}}"}],"or":null,"within":"now-30m","count":5}]', '["lastEvent.log.eventType","lastEvent.log.hostId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (20, 'Bitdefender GravityZone Zero-Day Malware Detection', 3, 3, 2, 'Execution', 'T1203 - Exploitation for Client Execution', 'Detects potential zero-day malware identified by Bitdefender''s advanced threat detection capabilities including HyperDetect and Sandbox Analyzer. These detection methods use behavioral analysis and machine learning to identify previously unknown threats.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Review the detection details including file path, process information, and threat indicators
+3. Check if similar detections occurred on other systems in the environment
+4. Collect the suspicious file/process for further analysis in a sandbox environment
+5. Review system logs for any suspicious activities before and after the detection
+6. Update security policies to block similar threats across the organization
+7. Consider submitting the sample to Bitdefender for further analysis
+', '["https://www.bitdefender.com/business/support/en/77212-237089-event-types.html","https://attack.mitre.org/techniques/T1203/"]', 'oneOf("log.eventType", ["HyperDetect Activity", "Sandbox Analyzer Detection", "hyperdetect"]) ||
+(equals("log.eventType", "avc") && equals("log.severity", "High"))
+', '2026-02-09 16:28:47.700896', true, false, 'origin', null, '[]', '["lastEvent.log.hostId","lastEvent.log.syslogHostIP"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (21, 'Advanced Threat Tactic Identification', 3, 3, 3, 'Advanced Persistent Threat', 'Multiple Tactics', 'Detects advanced threat tactics including initial access, execution, and persistence techniques by monitoring deception environment interactions and behavioral patterns. This rule triggers when deceptive assets are accessed with high behavior scores indicating sophisticated attack patterns.
+
+Next Steps:
+1. Immediately isolate the affected endpoint(s) associated with the source IP
+2. Review the specific tactic name to understand the attack phase (initial access, execution, persistence, etc.)
+3. Check all deception assets that were triggered to map the attacker''s movement
+4. Analyze the behavior score details to understand the sophistication level
+5. Look for related alerts from the same source IP across different systems
+6. Collect forensic data from the endpoint before any remediation
+7. Review authentication logs for any credential abuse from this source
+8. Check network logs for lateral movement attempts
+9. Update security controls to block the identified tactics
+10. Consider deploying additional deception assets in the path of the attacker
+', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/tactics/TA0003/"]', 'equals("log.eventType", "advanced_threat_detected") &&
+equals("log.threatLevel", "critical") &&
+(oneOf("log.tacticName", ["initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion"])) &&
+equals("log.deceptionTriggered", true) &&
+greaterOrEqual("log.behaviorScore", 80)
+', '2026-02-09 16:28:47.842316', true, false, 'origin', null, '[{"indexPattern":"v11-log-deceptive-bytes-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.tacticName","operator":"filter_term","value":"{{log.tacticName}}"}],"or":null,"within":"now-15m","count":3}]', '["lastEvent.log.tacticName","lastEvent.log.threatLevel","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (22, 'Criminal Group Signatures', 3, 3, 2, 'Organized Crime Activity', 'Criminal Group TTPs', 'Identifies attack signatures and behavioral patterns associated with known criminal groups including ransomware operators, financial crime syndicates, and organized cybercrime operations. Deception technology detects malicious activity by monitoring interactions with decoy assets that should never be accessed in legitimate workflows.
+
+Next Steps:
+1. IMMEDIATE: Isolate the affected endpoint to prevent lateral movement
+2. Verify the criminal group signature or toolset identified in the alert details
+3. Check if the source IP/domain appears in threat intelligence feeds or previous incidents
+4. Review all activity from the affected endpoint in the last 24-48 hours
+5. Search for indicators of lateral movement or data staging activities
+6. Scan other endpoints for similar patterns or IoCs
+7. If ransomware indicators are present, activate ransomware response playbook
+8. Collect forensic evidence: process creation logs, network connections, file modifications
+9. Check for data exfiltration attempts to external IPs or cloud services
+10. Review all user account activity associated with the endpoint for signs of compromise
+11. Document all findings and coordinate with incident response team
+12. Consider threat hunting across the environment for related criminal group activities
+', '["https://attack.mitre.org/groups/","https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf","https://www.acalvio.com/cyber-deception/the-role-of-deception-technology-in-the-endpoint-security-reference-architecture/","https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"]', 'oneOf("log.eventType", ["threat_detected", "deception_triggered", "malicious_activity"]) &&
+oneOf("log.threatType", ["criminal_group", "ransomware", "organized_crime"]) &&
+(exists("log.signature") || exists("log.toolset") || exists("log.groupName")) &&
+(oneOf("log.action", ["blocked", "detected", "prevented"]) ||
+ oneOf("log.severity", ["high", "critical"])) &&
+(oneOf("log.indicatorType", ["ransomware", "financial_theft", "cryptomining", "data_exfiltration"]) ||
+ greaterOrEqual("log.threatScore", 70))
+', '2026-02-09 16:28:47.971185', true, false, 'origin', null, '[]', '["lastEvent.log.groupName","lastEvent.log.signature","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (23, 'Data Theft Attempt on Decoy Files', 3, 2, 1, 'Collection', 'T1005 - Data from Local System', 'Detects attempts to access, copy, or exfiltrate deceptive decoy files and honeypot data, indicating potential data theft activities by an attacker. This rule triggers when an attacker interacts with high-sensitivity decoy files planted by Deceptive Bytes.
+
+Next Steps:
+- Immediately isolate the affected endpoint to prevent lateral movement
+- Review the source IP and user account for suspicious activity patterns
+- Check for other decoy interactions from the same source in the past 24 hours
+- Examine network traffic logs for potential data exfiltration attempts
+- Verify if the user account has been compromised or if this is insider threat activity
+- Consider resetting credentials for the affected user account
+- Document all decoy files accessed for forensic analysis
+', '["https://attack.mitre.org/techniques/T1005/","https://attack.mitre.org/techniques/T1567/","https://deceptivebytes.com/solution/"]', 'equals("log.event_type", "decoy_accessed") &&
+oneOf("log.action", ["file_read", "file_copy", "file_download"]) &&
+equals("log.decoy_sensitivity", "high")
+', '2026-02-09 16:28:48.101258', true, false, 'origin', null, '[{"indexPattern":"v11-log-deceptive-bytes-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.event_type","operator":"filter_term","value":"decoy_accessed"}],"or":null,"within":"now-2h","count":3}]', '["lastEvent.log.decoy_file","adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (786, 'Windows: Volume Shadow Copy Deletion via WMIC', 1, 2, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1490/"]', 'regexMatch("log.message", "(delete(.+)shadowcopy|shadowcopy(.+)delete)") && contains("log.eventDataProcessName", "WMIC.exe")', '2026-02-09 16:57:43.422219', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (25, 'Deception Token Access Patterns', 3, 3, 1, 'Defense Evasion, Persistence, Privilege Escalation, Initial Access', 'T1078 - Valid Accounts: Credential Access', 'Detects when deception tokens or honeytokens are accessed, indicating potential unauthorized activity or insider threat. Multiple token accesses from the same source within a short timeframe suggest systematic reconnaissance or data harvesting attempts. Honeytokens are fake credentials or access tokens planted as traps to detect unauthorized access.
+
+Next Steps:
+1. Identify the source IP and user account associated with the token access
+2. Review access logs to determine if this is legitimate testing or actual malicious activity
+3. Check for lateral movement from the same source IP across the network
+4. Investigate any data access or exfiltration attempts following the token access
+5. Consider immediately blocking the source IP if confirmed malicious
+6. Review and rotate any potentially compromised credentials in the environment
+7. Alert security team immediately as honeytoken access is a high-confidence indicator of compromise
+8. Document the incident and update detection rules based on observed attack patterns
+9. Verify the integrity of the deception infrastructure to ensure it wasn''t compromised
+', '["https://attack.mitre.org/techniques/T1078/","https://deceptivebytes.com/"]', 'equals("log.eventType", "token_access") &&
+equals("log.deceptionType", "honeytoken") &&
+exists("origin.ip") &&
+oneOf("log.severity", ["high", "critical"])
+', '2026-02-09 16:28:48.366791', true, false, 'origin', null, '[{"indexPattern":"v11-log-deceptive-bytes-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"token_access"}],"or":null,"within":"now-1h","count":3}]', '["lastEvent.log.tokenId","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (26, 'Decoy Share Access Monitoring', 3, 2, 1, 'Discovery', 'T1135 - Network Share Discovery', 'Detects when an attacker attempts to access decoy network shares set up by Deceptive Bytes. This indicates potential lateral movement or reconnaissance activity within the network. Any interaction with decoy shares is a high-confidence indicator of malicious activity since legitimate users should never access these resources.
+
+Next Steps:
+- Immediately investigate the source IP and verify if it belongs to an authorized user or system
+- Check for other suspicious activities from the same source IP in the last 24-48 hours
+- Review authentication logs to identify any compromised credentials associated with this IP
+- Look for lateral movement attempts or privilege escalation from the same source
+- Consider isolating the source system if it shows signs of compromise
+- Document all accessed decoy resources for threat intelligence purposes
+- Update security controls to block or monitor the attacker''s techniques
+', '["https://attack.mitre.org/techniques/T1135/","https://deceptivebytes.com/solution/"]', 'equals("log.eventType", "decoy_access") && equals("log.resourceType", "network_share") && exists("origin.ip")', '2026-02-09 16:28:48.496984', true, false, 'origin', '["adversary.ip","lastEvent.log.resourceType"]', '[{"indexPattern":"v11-log-deceptive-bytes-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"decoy_access"},{"field":"log.resourceType","operator":"filter_term","value":"network_share"}],"or":null,"within":"now-30m","count":3}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (27, 'Decoy System Enumeration', 3, 2, 1, 'Discovery', 'T1082 - System Information Discovery', 'Detects when an attacker performs system enumeration activities on decoy systems or services. This includes port scanning, service discovery, or system information gathering on deception assets.
+
+Next Steps:
+- Immediately investigate the source IP address for other suspicious activities
+- Check if the source IP has attempted to access other decoy or real systems
+- Review network logs for lateral movement attempts from this source
+- Consider blocking the source IP if malicious intent is confirmed
+- Document the attack pattern for threat intelligence sharing
+- Verify if the attacker has discovered any real assets alongside decoys
+', '["https://attack.mitre.org/techniques/T1082/","https://deceptivebytes.com/solution/"]', 'equals("log.eventType", "system_enumeration") &&
+(equals("log.isDecoy", true) || equals("log.isDecoy", "true")) &&
+oneOf("log.action", ["port_scan", "service_discovery", "system_info"]) &&
+exists("origin.ip")
+', '2026-02-09 16:28:48.646238', true, false, 'origin', '["adversary.ip","lastEvent.log.targetHost","lastEvent.log.decoyName"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (28, 'Fake User Authentication Attempts', 3, 3, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects authentication attempts using decoy user accounts created by Deceptive Bytes. This indicates an attacker has obtained what they believe are valid credentials and is attempting to use them.
+
+Next Steps:
+- Immediately investigate the source IP address for other suspicious activities
+- Check if the same IP has triggered other deception alerts or security events
+- Review how the attacker obtained the decoy credentials (phishing, credential dumping, insider threat)
+- Examine network logs for lateral movement attempts from this IP
+- Consider blocking the source IP if confirmed malicious
+- Check for any legitimate user accounts that may have been compromised
+- Review authentication logs for attempts using real credentials from the same source
+- Notify the security team for potential active breach investigation
+', '["https://attack.mitre.org/techniques/T1110/","https://deceptivebytes.com/solution/"]', 'equals("log.eventType", "authentication") && equals("log.isDecoyUser", true) && exists("log.authResult") && exists("origin.ip")', '2026-02-09 16:28:48.776477', true, false, 'origin', null, '[]', '["lastEvent.log.username","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (29, 'Honey Table Query Detection', 3, 2, 1, 'Collection', 'T1005 - Data from Local System', 'Detects when an attacker queries honey tables or decoy database objects deployed by Deceptive Bytes. This indicates potential data exfiltration attempts or database reconnaissance. Honey tables are deliberately placed decoy data designed to attract and identify unauthorized access attempts.
+
+Next Steps:
+1. Identify the source IP and determine if it''s an internal or external address
+2. Check if the source IP has accessed other decoy resources or legitimate database tables
+3. Review the specific honey table(s) that were queried to understand attacker interest
+4. Correlate with authentication logs to identify the user account used
+5. Check for any data exfiltration patterns following the honey table access
+6. Isolate the compromised system or account if malicious activity is confirmed
+7. Review database access logs for unauthorized queries to legitimate tables
+8. Consider blocking the source IP if it''s external and confirmed malicious
+9. Document the incident and update security monitoring rules if needed
+', '["https://attack.mitre.org/techniques/T1005/","https://deceptivebytes.com/solution/"]', 'equals("log.eventType", "decoy_access") && equals("log.resourceType", "database_table") && equals("log.action", "query") && exists("origin.ip")', '2026-02-09 16:28:48.911903', true, false, 'origin', null, '[{"indexPattern":"v11-log-deceptive-bytes-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"decoy_access"}],"or":null,"within":"now-1h","count":5}]', '["lastEvent.log.tableName","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (30, 'Lateral Movement Trap Triggered', 3, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Detects when an attacker triggers a deceptive trap while attempting lateral movement across the network. This indicates potential compromise and active threat movement within the environment.
+
+Next Steps:
+1. Immediately isolate the source IP address to prevent further lateral movement
+2. Review all activities from the source IP in the last 24-48 hours
+3. Check if the source system shows signs of compromise (unusual processes, new services, etc.)
+4. Identify what credentials or methods were used in the lateral movement attempt
+5. Review network logs for any successful connections from this source to other systems
+6. Initiate incident response procedures for potential active threat
+7. Consider deploying additional deception tokens around critical assets
+', '["https://attack.mitre.org/techniques/T1021/","https://deceptivebytes.com/solution/"]', 'equals("log.event_type", "trap_triggered") && equals("log.trap_type", "lateral_movement") && exists("origin.ip")', '2026-02-09 16:28:49.282062', true, false, 'origin', null, '[]', '["lastEvent.log.trap_type","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (49, 'Suspicious Process Behavior Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects suspicious process behaviors including injection attempts, privilege escalation, and abnormal process creation patterns identified by ESET''s behavioral monitoring. This alert indicates potential malware activity or exploitation attempts on the affected system.
+
+Next Steps:
+1. Immediately review the alert details to identify:
+ - Affected hostname (check log.headHostname)
+ - Specific threat or behavior detected (check log.jsonMessage)
+ - Process name and path if available
+ - Time of detection (check log.deviceTime)
+2. Investigate the process that triggered the alert:
+ - Verify if it''s a legitimate application or unknown/suspicious
+ - Check process creation chain and parent-child relationships
+ - Review file hash against threat intelligence sources
+3. Check for related security events:
+ - Look for other ESET alerts from the same host
+ - Search for network connections from the suspicious process
+ - Review authentication events around the same timeframe
+4. Containment actions if malicious:
+ - Isolate the affected host from the network
+ - Kill the suspicious process if still running
+ - Preserve forensic evidence (memory dump, logs)
+5. Remediation steps:
+ - Run full antivirus scan on the affected system
+ - Check for persistence mechanisms (registry, scheduled tasks)
+ - Update ESET signatures and perform system hardening
+6. Prevention measures:
+ - Review and update application control policies
+ - Ensure ESET real-time protection is enabled
+ - Consider implementing application whitelisting
+', '["https://help.eset.com/ees/12/en-US/idh_dialog_epfw_ids_alert.html","https://attack.mitre.org/techniques/T1055/"]', 'oneOf("log.msgType", ["EnterpriseInspectorAlert_Event", "HIPS_Event"]) &&
+exists("log.jsonMessage") &&
+contains("log.jsonMessage", ["Process injection", "Suspicious behavior",
+ "Anomalous process", "blocked", "terminated", "prevented"])
+', '2026-02-09 16:28:51.996232', true, false, 'origin', null, '[]', '["lastEvent.log.headHostname","lastEvent.log.msgType"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (31, 'Nation-State Tactic Detection', 3, 3, 3, 'Advanced Persistent Threat', 'T1595 - Active Scanning / Nation-State Attack Patterns', 'Detects sophisticated attack patterns and techniques commonly associated with nation-state actors including advanced persistence mechanisms, custom tooling, and strategic lateral movement.
+
+Next Steps:
+1) Immediately isolate affected systems and preserve forensic evidence
+2) Review all decoy interactions and identify compromised credentials
+3) Check for lateral movement attempts from the source IP across all systems
+4) Analyze custom tools or malware samples if detected
+5) Engage incident response team for potential APT activity
+6) Review network traffic for command & control communications
+7) Implement enhanced monitoring on high-value targets identified in the attack
+', '["https://attack.mitre.org/groups/","https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats"]', 'oneOf("log.event_type", ["decoy_interaction", "honeypot_access", "deception_triggered"]) &&
+equals("log.threat_level", "critical") &&
+(equals("log.attack_sophistication", "advanced") || greaterOrEqual("log.threat_score", 85)) &&
+(equals("log.apt_indicators", true) ||
+ equals("log.custom_malware", true) ||
+ equals("log.advanced_ttps", true) ||
+ greaterThan("log.targeted_decoys", 1) ||
+ equals("log.persistence_attempt", true))
+', '2026-02-09 16:28:49.375846', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (32, 'Living Off The Land Attack Using Deceptive Resources', 3, 3, 2, 'Defense Evasion', 'T1218 - Signed Binary Proxy Execution', 'Detects when attackers use legitimate system tools and binaries to interact with deceptive resources, indicating Living Off The Land (LOLBins) attack techniques. This is a high-confidence indicator of malicious activity as legitimate users should not be accessing deceptive resources with system binaries.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent lateral movement
+2. Review the process execution chain to identify the parent process and any child processes
+3. Check if the user account is compromised by reviewing recent authentication logs
+4. Examine command line arguments and scripts executed by the LOLBin
+5. Search for other deceptive resource interactions from the same user or system
+6. Collect memory dump if possible for forensic analysis
+7. Review network connections made by the process for C2 communication
+8. Check for persistence mechanisms (scheduled tasks, registry modifications, services)
+', '["https://attack.mitre.org/techniques/T1218/","https://attack.mitre.org/techniques/T1053/","https://lolbas-project.github.io/","https://deceptivebytes.com/solution/"]', 'equals("log.event_type", "lolbin_trap") && oneOf("log.process_name", ["powershell.exe", "cmd.exe", "wmic.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe"]) && exists("log.deceptive_target")', '2026-02-09 16:28:49.511077', true, false, 'origin', null, '[]', '["lastEvent.log.deceptive_target","adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (33, 'Privilege Escalation Bait Accessed', 3, 3, 2, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects when an attacker accesses deceptive privileged account baits or attempts to escalate privileges using trapped credentials, indicating active exploitation attempts. This is a high-priority alert as it indicates an active attacker who has progressed beyond initial access and is attempting to gain elevated privileges.
+
+Next Steps:
+- Immediately isolate the affected system to prevent lateral movement
+- Review authentication logs for the source IP and user account to identify scope of compromise
+- Check for other deception bait interactions from the same source in the past 24 hours
+- Investigate any legitimate user activity that may have been compromised
+- Collect forensic data from the endpoint including running processes and network connections
+- Review SIEM/EDR alerts for related suspicious activities from the same source
+- Document the attacker''s TTPs for threat intelligence sharing
+- Consider resetting credentials for any accounts that may have been exposed
+- Update firewall rules to block the attacker''s source IP if confirmed malicious
+', '["https://attack.mitre.org/techniques/T1068/","https://attack.mitre.org/techniques/T1078/","https://www.checkpoint.com/cyber-hub/cyber-security/what-is-deception-technology/"]', 'equals("log.event_type", "bait_accessed") &&
+equals("log.bait_type", "privileged_account") &&
+oneOf("log.target_privilege", ["admin", "system", "administrator"])
+', '2026-02-09 16:28:49.605982', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (34, 'Ransomware Behavior Detected in Deception Environment', 3, 3, 3, 'Impact', 'T1486 - Data Encrypted for Impact', 'Detects ransomware-like behavior patterns when attackers interact with deceptive files, including rapid file enumeration, encryption attempts, and ransom note creation in the Deceptive Bytes deception environment.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent ransomware spread
+2. Check the process name and path identified in the alert for known ransomware indicators
+3. Review file system activity from the same process for encryption patterns
+4. Check for shadow copy deletion attempts (vssadmin, wmic shadowcopy delete)
+5. Look for network connections to potential C2 servers from the identified process
+6. Preserve forensic evidence and memory dumps if possible
+7. Verify if this is a deception environment interaction or production system compromise
+8. Check for lateral movement attempts from the source IP address
+9. Review backup integrity and availability before any restoration attempts
+', '["https://attack.mitre.org/techniques/T1486/","https://attack.mitre.org/techniques/T1490/","https://deceptivebytes.com/solution/"]', 'equals("log.event_type", "ransomware_behavior") &&
+oneOf("log.behavior_pattern", ["mass_encryption", "file_enumeration", "ransom_note_drop"])
+', '2026-02-09 16:28:49.721539', true, false, 'origin', null, '[{"indexPattern":"v11-log-deceptive-bytes-*","with":[{"field":"log.process","operator":"filter_term","value":"{{log.process}}"},{"field":"log.source_ip","operator":"filter_term","value":"{{log.source_ip}}"}],"or":null,"within":"now-15m","count":10}]', '["lastEvent.log.hostname","lastEvent.log.process"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (35, 'Threat Actor Attribution', 2, 2, 2, 'Threat Intelligence', 'T1583 - Acquire Infrastructure', 'Correlates observed attack patterns, tools, techniques, and infrastructure with known threat actor profiles to provide attribution intelligence and identify potential threat actors based on high-confidence indicators.
+
+Next Steps:
+1. Review the attributed threat actor profile and historical campaigns for context
+2. Analyze the specific TTPs (Tactics, Techniques, and Procedures) that triggered the attribution
+3. Check for related activity from the same actor across other systems or time periods
+4. Correlate with threat intelligence feeds to validate attribution confidence
+5. Document observed infrastructure and tooling for future threat hunting
+6. Consider implementing specific detections for this actor''s known techniques
+7. Share attribution indicators with security teams for enhanced monitoring
+8. Escalate to incident response team if high-profile threat actor is identified
+', '["https://attack.mitre.org/groups/","https://malpedia.caad.fkie.fraunhofer.de/"]', 'equals("log.eventType", "threat_attribution") &&
+greaterOrEqual("log.attributionConfidence", 70) &&
+exists("log.actorProfile") &&
+equals("log.deceptionTriggered", true) &&
+(greaterOrEqual("log.ttpsMatched", 3) ||
+ equals("log.infrastructureMatch", true) ||
+ exists("log.toolingFingerprint")) &&
+equals("log.historicalCampaignMatch", true)
+', '2026-02-09 16:28:49.841808', true, false, 'origin', null, '[]', '["lastEvent.log.actorProfile","lastEvent.log.campaignId","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (36, 'Zero-Day Behavior Patterns Detection', 3, 3, 3, 'Defense Evasion', 'T1211 - Exploitation for Defense Evasion', 'Identifies potential zero-day exploits and unknown malware through abnormal behavior patterns, deception interactions, and anomaly detection in endpoint activities.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Capture memory dumps and process information for forensic analysis
+3. Check for similar behavioral anomalies on other endpoints in the same network segment
+4. Review the exploit technique and process chain to understand the attack vector
+5. Submit samples to threat intelligence platforms for analysis
+6. Update security controls based on the identified exploit patterns
+7. Document all IOCs (file hashes, network connections, process behaviors) for threat hunting
+', '["https://attack.mitre.org/techniques/T1211/","https://attack.mitre.org/techniques/T1055/","https://attack.mitre.org/techniques/T1620/"]', 'oneOf("log.eventType", ["unknown_threat", "behavioral_anomaly", "zero_day_suspect"]) &&
+equals("log.threatSignature", "unknown") &&
+equals("log.deceptionEnvironment", true) &&
+(
+ (greaterOrEqual("log.memoryAnomalyScore", 90)) ||
+ (greaterOrEqual("log.processChainAnomalyScore", 85)) ||
+ (greaterOrEqual("log.networkBehaviorScore", 88)) ||
+ (greaterOrEqual("log.fileSystemAnomalyScore", 92))
+) &&
+equals("log.knownMalwareFamily", "") &&
+exists("log.exploitTechnique")
+', '2026-02-09 16:28:49.976711', true, false, 'origin', null, '[{"indexPattern":"v11-log-deceptive-bytes-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.processName","operator":"filter_term","value":"{{log.processName}}"}],"or":null,"within":"now-30m","count":2}]', '["lastEvent.log.exploitTechnique","lastEvent.log.processHash","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (37, 'Advanced Heuristic Detection Triggers', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects when ESET''s advanced heuristic engine identifies suspicious behavior patterns that may indicate novel malware or zero-day threats. These detections use DNA signatures and behavioral analysis.
+
+Next Steps:
+- Review the affected hostname and user context to understand the scope
+- Check the process name (if available) that triggered the detection
+- Verify if the action taken (cleaned/deleted/quarantined) was successful
+- Look for related alerts from the same host within the past 24 hours
+- If multiple hosts show similar detections, investigate potential lateral movement
+- Consider isolating the affected system if threat persists
+- Review ESET console link (if available) for detailed threat information
+- Check file hash against threat intelligence databases if available
+- Capture and analyze the malicious file sample if quarantined
+- Review system logs for any unusual activities before and after detection
+- Update ESET signatures and run a full system scan
+', '["https://help.eset.com/eea/8/en-US/idh_config_threat_sense.html","https://attack.mitre.org/techniques/T1055/"]', 'oneOf("log.msgType", ["EnterpriseInspectorAlert_Event", "threat_event", "FirewallAggregatedAlert_Event"]) &&
+contains("log.jsonMessage", ["heuristic", "NewHeur", "suspicious behavior"]) &&
+contains("log.jsonMessage", ["cleaned", "deleted", "quarantined", "blocked"])
+', '2026-02-09 16:28:50.121137', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-esmc-eset-*","with":[{"field":"log.headHostname","operator":"filter_term","value":"{{log.headHostname}}"}],"or":null,"within":"now-30m","count":3}]', '["lastEvent.log.headHostname","lastEvent.log.msgType"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (38, 'ESET Botnet Communication Detection', 3, 3, 2, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects attempts to communicate with known botnet command and control servers. ESET identifies typical communication patterns when a computer is infected and a bot is attempting to communicate with malicious C2 infrastructure.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent further C2 communication
+2. Check the hostname (log.headHostname) to identify the affected system
+3. Review the full log message content (log.jsonMessage) for additional threat details including target IPs and processes
+4. Review process activity on the affected host to identify the malicious process
+5. Scan the system with ESET for complete malware removal
+6. Check other systems in the network for similar C2 communication attempts
+7. Update firewall rules to block any identified C2 server IPs found in the logs
+8. Consider reimaging the system if the infection persists
+9. Review ESET logs for the time period around this detection to identify related malicious activity
+', '["https://www.eset.com/us/botnet/","https://support.eset.com/en/kb7487-resolve-the-incomingattackgeneric-or-botnetcncgeneric-network-protection-alert","https://attack.mitre.org/techniques/T1071/"]', 'contains("log.jsonMessage", ["Botnet", "CnC.Generic", "botnet", "C&C", "command and control"]) &&
+exists("log.headHostname")
+', '2026-02-09 16:28:50.326726', true, false, 'origin', null, '[]', '["lastEvent.log.headHostname","lastEvent.log.jsonMessage"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (39, 'ESET Agent Disabled or Tampered', 3, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when the ESET security agent is disabled, uninstalled, or tampered with. This is a critical defense evasion indicator as attackers commonly disable endpoint protection before executing their payload.
+
+Next Steps:
+1. Immediately investigate the affected endpoint
+2. Determine who or what process disabled the agent
+3. Check for concurrent malicious activity on the endpoint
+4. Reinstall and re-enable the ESET agent
+5. Review the endpoint for malware or unauthorized software
+6. Check if similar tampering occurred on other endpoints
+', '["https://help.eset.com/ees/8/en-US/idh_config_era_agent.html","https://attack.mitre.org/techniques/T1562/001/"]', '(regexMatch("log.message", "(?i)(eset|ekrn|egui|agent)") &&
+ regexMatch("log.message", "(?i)(disabled|stopped|uninstalled|removed|tampered|terminated)")) ||
+(contains("log.message", "protection status") && contains("log.message", "disabled")) ||
+(contains("log.message", "agent") && contains("log.message", "not responding")) ||
+(equals("log.eventType", "AGENT_EVENT") && contains("log.message", "removed"))
+', '2026-02-09 16:28:50.486216', true, false, 'origin', null, '[]', '["lastEvent.log.eventType","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (40, 'ESET ERA/ESMC Console Suspicious Activity', 3, 3, 2, 'Lateral Movement', 'T1072 - Software Deployment Tools', 'Detects suspicious activity on the ESET ERA/ESMC management console including unauthorized policy changes, mass task deployments, or admin account modifications that could indicate console compromise.
+
+Next Steps:
+1. Verify the admin account performing console operations
+2. Review recent policy changes and task deployments
+3. Check admin login history for unauthorized access
+4. Verify the content of any pushed policies or tasks
+5. Suspend suspicious admin accounts
+6. Audit endpoints affected by recent console changes
+', '["https://help.eset.com/esmc_admin/70/en-US/","https://attack.mitre.org/techniques/T1072/"]', '(contains("log.message", "policy") &&
+ (contains("log.message", "modified") || contains("log.message", "assigned") ||
+ contains("log.message", "created"))) ||
+(contains("log.message", "client task") &&
+ (contains("log.message", "executed") || contains("log.message", "deployed"))) ||
+(contains("log.message", "administrator") &&
+ ((contains("log.message", "created") || contains("log.message", "modified")) ||
+ (contains("log.message", "login") && contains("log.message", "failed"))))
+', '2026-02-09 16:28:50.647197', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-esmc-eset-*","with":[{"field":"log.headHostname","operator":"filter_term","value":"{{log.headHostname}}"}],"or":null,"within":"now-30m","count":10}]', '["lastEvent.log.headHostname","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (41, 'ESET Repeated Quarantine Failures', 2, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects repeated quarantine failures in ESET, which may indicate malware actively resisting quarantine through file locks, permission manipulation, or rapid re-creation of malicious files.
+
+Next Steps:
+1. Identify the specific file or threat that cannot be quarantined
+2. Check the file permissions and processes locking the file
+3. Attempt manual quarantine or deletion in safe mode
+4. Review the malware''s persistence mechanisms
+5. Consider isolating the endpoint for manual remediation
+6. Run a boot-time scan if available
+', '["https://help.eset.com/ees/8/en-US/","https://attack.mitre.org/techniques/T1562/001/"]', '(contains("log.message", "quarantine") &&
+ (contains("log.message", "failed") || contains("log.message", "error") ||
+ contains("log.message", "unable") || contains("log.message", "denied"))) ||
+(contains("log.message", "clean") && contains("log.message", "failed") &&
+ contains("log.message", "threat"))
+', '2026-02-09 16:28:50.806501', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-esmc-eset-*","with":[{"field":"log.headHostname","operator":"filter_term","value":"{{log.headHostname}}"}],"or":null,"within":"now-1h","count":5}]', '["lastEvent.log.headHostname","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (42, 'ESET Exploit Detection Alert', 3, 3, 2, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects when ESET''s Exploit Blocker identifies and blocks exploitation attempts targeting vulnerabilities in commonly exploited applications such as browsers, document readers, email clients, Flash, and Java.
+
+Next Steps:
+1. Identify the affected host and the specific exploit attempt details
+2. Check for any successful exploitation attempts on the same host
+3. Review process execution logs for suspicious activity following the exploit attempt
+4. Verify that the exploit was successfully blocked and no compromise occurred
+5. Update the vulnerable application if a patch is available
+6. Consider isolating the host if exploitation may have succeeded
+', '["https://www.eset.com/us/about/technology/","https://attack.mitre.org/techniques/T1068/"]', '(contains("log.jsonMessage", "exploit") ||
+ oneOf("log.msgType", ["Exploit_Blocked", "Exploit"])) &&
+equals("actionResult", "blocked") &&
+oneOf("log.severity", ["medium", "high"])
+', '2026-02-09 16:28:50.965988', true, false, 'origin', null, '[]', '["lastEvent.log.jsonMessage","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (43, 'ESET Host Intrusion Prevention System Triggered', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects when ESET''s Host-based Intrusion Prevention System (HIPS) blocks suspicious behavior, including process manipulation, registry modifications, and file system changes that indicate potential malware activity. HIPS events indicate active attempts to compromise system integrity through various attack techniques.
+
+Next Steps:
+1. Review the blocked process or action details in the ESET console
+2. Identify the source application attempting the blocked behavior
+3. Check if the blocked action is from legitimate software (false positive)
+4. If malicious, isolate the affected system and perform full malware scan
+5. Review system logs for any successful compromise attempts before HIPS activation
+6. Update HIPS rules if necessary to prevent similar attacks
+7. Check for persistence mechanisms on the affected host
+8. Review network connections from the suspicious process if applicable
+', '["https://help.eset.com/ees/8/en-US/idh_hips_main.html","https://attack.mitre.org/techniques/T1055/"]', 'equals("log.actionResult", "HIPS_Event") && equals("log.action", "blocked") && oneOf("log.severity", ["medium", "high"])', '2026-02-09 16:28:51.125733', true, false, 'origin', null, '[]', '["lastEvent.log.objectname","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (44, 'Machine Learning Detection Anomalies', 3, 3, 2, 'Execution', 'T1204.002 - User Execution: Malicious File', 'Identifies threats detected by ESET''s machine learning engine that analyzes file behavior patterns and characteristics to identify previously unknown malware variants. Machine learning detection indicates advanced malware that may evade signature-based detection methods.
+
+Next Steps:
+- Immediately investigate the affected host for signs of compromise
+- Review the threat details in the log message to understand the malware type and behavior
+- Check if the malware was successfully blocked or quarantined
+- Look for similar detections across other hosts in your environment
+- Consider isolating the affected system if the threat was not successfully contained
+- Review process activity around the time of detection for suspicious behavior
+- Collect and analyze the malware sample if available for threat intelligence
+- Update security policies to prevent similar threats
+- Check for any data exfiltration or lateral movement attempts from the affected host
+', '["https://help.eset.com/protect_admin/11.0/en-US/events-exported-to-json-format.html","https://attack.mitre.org/techniques/T1204/002/"]', 'contains("log.message", "machine learning") &&
+contains("log.message", ["threat", "detected", "found"]) &&
+exists("log.msgType") &&
+exists("log.headHostname")
+', '2026-02-09 16:28:51.285844', true, false, 'origin', null, '[]', '["lastEvent.log.headHostname","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (45, 'ESET Network Attack Detection', 3, 2, 1, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects network-based attacks and exploits blocked by ESET''s Network Attack Protection (IDS). This includes attempts to exploit known vulnerabilities in network services and protocols.
+
+Next Steps:
+1. Review the attack details in ESET console to identify the specific vulnerability or attack pattern
+2. Check if the source IP is known malicious using threat intelligence sources
+3. Verify if other systems received similar attacks from the same source
+4. Review firewall logs for additional suspicious activity from the source IP
+5. Consider blocking the source IP at the perimeter firewall if attacks persist
+6. Update network security policies and ensure all systems are patched
+', '["https://help.eset.com/ees/7/en-US/idh_config_epfw_network_attack_protection.html","https://attack.mitre.org/techniques/T1190/"]', 'equals("log.event_type", "NetworkProtection_Event") &&
+equals("log.action", "blocked") &&
+exists("origin.ip")
+', '2026-02-09 16:28:51.445944', true, false, 'origin', null, '[]', '["adversary.ip","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (46, 'Suspicious Encrypted File Activity', 3, 3, 2, 'Impact', 'T1486 - Data Encrypted for Impact', 'Detects suspicious encrypted file activities that may indicate ransomware encryption attempts or unauthorized file encryption operations. This rule triggers when ESET detects ransomware-related threats or file encryption activities.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent spread
+2. Check if backup systems are accessible and uncompromised
+3. Review the threat details in log.jsonMessage for specific ransomware variant
+4. Look for other systems showing similar encryption patterns
+5. Preserve forensic evidence before remediation
+6. Consider engaging incident response team for ransomware cases
+7. Do not power off the system if encryption is in progress
+', '["https://attack.mitre.org/techniques/T1486/","https://help.eset.com/protect_admin/10.1/en-US/events-exported-to-json-format.html"]', 'equals("log.msgType", "Threat_Event") &&
+contains("log.jsonMessage", ["ransomware", "filecoder", "encrypted", ".encrypted"])
+', '2026-02-09 16:28:51.606002', true, false, 'origin', null, '[]', '["lastEvent.log.msgType","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (47, 'Registry Modification Attempts Blocked', 2, 3, 2, 'Defense Evasion, Persistence', 'T1112 - Modify Registry', 'Identifies attempts to modify critical Windows registry keys that were blocked by ESET, indicating potential persistence or system tampering attempts. Registry modifications are a common technique used by malware to establish persistence, disable security features, or alter system behavior.
+
+Next Steps:
+1. Review the blocked action details to understand what registry key was targeted
+2. Investigate the source process and user account involved in the attempt
+3. Check for other security events from the same host around the same time
+4. Verify if this is legitimate administrative activity or potential malicious behavior
+5. If suspicious, isolate the affected system and perform a full malware scan
+6. Review system logs for any successful registry modifications before the block occurred
+', '["https://help.eset.com/esmc_admin/70/en-US/events-exported-to-json-format.html","https://attack.mitre.org/techniques/T1112/"]', 'exists("log.jsonMessage") &&
+contains("log.jsonMessage", "registry") &&
+oneOf("log.action", ["blocked", "denied", "prevented"]) &&
+oneOf("log.severity", ["high", "medium"])
+', '2026-02-09 16:28:51.765946', true, false, 'origin', null, '[]', '["lastEvent.log.action","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (48, 'ESET Blocked Suspicious PowerShell Activity', 3, 3, 1, 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'Detects when ESET blocks suspicious PowerShell commands or scripts that exhibit malicious behavior patterns, including obfuscated scripts, encoded commands, or attempts to bypass execution policies. This is a high-priority security event that indicates potential malicious activity was prevented.
+
+Next Steps:
+1. Review the blocked PowerShell command details in the log message
+2. Identify the user account and process that attempted to execute PowerShell
+3. Check if this is part of legitimate administrative activity or scripting
+4. Investigate the source of the PowerShell execution (parent process, script location)
+5. Look for other suspicious activities from the same host or user
+6. Consider isolating the affected system if malicious intent is confirmed
+7. Review and update PowerShell execution policies if needed
+', '["https://help.eset.com/ees/8/en-US/idh_hips_main.html","https://attack.mitre.org/techniques/T1059/001/"]', 'regexMatch("log.message", "(?i)(powershell|pwsh)") && equals("log.action", "blocked") && exists("log.headHostname")', '2026-02-09 16:28:51.906284', true, false, 'origin', null, '[]', '["lastEvent.log.headHostname","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (50, 'Code Injection Attempt Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects attempts to inject malicious code into legitimate processes. This technique is commonly used by malware to evade detection and gain elevated privileges by running within trusted processes.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent lateral movement
+2. Identify the source process that attempted the injection
+3. Check if the malware was successfully quarantined or if manual removal is needed
+4. Review system logs for any suspicious activities around the same timeframe
+5. Scan the system with updated antivirus definitions
+6. Check for persistence mechanisms (scheduled tasks, registry keys, services)
+7. Review network connections from the affected host for C2 communications
+8. Consider reimaging the system if critical processes were compromised
+', '["https://attack.mitre.org/techniques/T1055/","https://support.kaspersky.com/KESWin/11/en-us/151065.htm"]', '(equals("log.signatureID", "3") || equals("log.cs1", "DETECT")) &&
+(regexMatch("log.cefMsg", "(?i).*(inject|injection|CreateRemoteThread|SetWindowsHookEx|WriteProcessMemory).*") ||
+ contains("log.cs4", ["inject", "hooking", "trojan", "backdoor"]) ||
+ contains("log.action", ["terminate", "delete", "quarantine"])) &&
+(contains("log.cefMsg", ["lsass", "csrss", "winlogon", "services", "svchost", "explorer"]) ||
+ contains("log.cefMsgAll", "process"))
+', '2026-02-09 16:29:46.566557', true, false, 'origin', null, '[]', '["lastEvent.log.cs3","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (51, 'Kaspersky Command and Control Communication Detection', 3, 3, 2, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects potential command and control (C2) communication attempts identified by Kaspersky, including suspicious outbound connections, malware callbacks, and botnet communication patterns. This rule triggers when Kaspersky identifies network threats related to botnet activity, C2 communications, or malware beaconing that was not successfully blocked.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent further C2 communication
+2. Review the target IP address against threat intelligence feeds to confirm malicious activity
+3. Check if other systems have communicated with the same C2 server
+4. Analyze the process or malware that initiated the connection
+5. Review Kaspersky logs for additional context about the threat
+6. Perform a full system scan and forensic analysis on the affected machine
+7. Update antivirus signatures and ensure real-time protection is enabled
+8. Consider reimaging the system if compromise is confirmed
+', '["https://attack.mitre.org/techniques/T1071/","https://support.kaspersky.com/KLMS/8.2/en-US/151504.htm"]', '(contains("log.cs2", ["Bot", "bot", "C2", "Command", "command"]) ||
+ contains("log.message", ["callback", "beacon"]) ||
+ equals("log.cat", "NetworkThreat")) &&
+exists("target.ip") &&
+!equals("action", "blocked")
+', '2026-02-09 16:29:46.705948', true, false, 'origin', null, '[]', '["adversary.host","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (52, 'Kaspersky Critical Object Detection', 3, 3, 2, 'Execution', 'T1204 - User Execution: Malicious File', 'Detects when Kaspersky identifies critical threats including malware, trojans, or other dangerous objects that require immediate attention. High severity detections often indicate active threats.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Identify the malware name/signature from log.cs1, log.cs2, or log.cs4 fields
+3. Check if Kaspersky successfully quarantined or removed the threat
+4. Scan other systems in the same network segment for similar infections
+5. Review recent user activity and email attachments that could be the infection vector
+6. Collect and preserve forensic artifacts if needed for incident response
+7. Update antivirus signatures and run a full system scan
+8. Consider reimaging the system if the infection is severe or persistent
+', '["https://support.kaspersky.com/ScanEngine/1.0/en-US/186767.htm","https://attack.mitre.org/techniques/T1204/"]', 'exists("log.signatureID") &&
+equals("log.cefDeviceSeverity", "High") &&
+(contains("log.cs1", ["INFECTED", "MALWARE", "TROJAN"]) ||
+ contains("log.cs2", "Trojan") ||
+ contains("log.cs4", "Trojan") ||
+ contains("log.message", ["infected", "malicious"]))
+', '2026-02-09 16:29:46.871602', true, false, 'origin', null, '[]', '["lastEvent.log.signatureID","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (168, 'GCP probable Government-backed attack', 3, 3, 2, 'Collection', 'T1560 - Archive Collected Data', 'A user''s account might have been targeted by government-backed attack. Government-backed attackers are trying to access the account of one of your users. An attack happens to less than 0.1% of all Google Account users. There''s a chance the alert is a false alarm. However, we believe we detected activities that government-backed attackers use to try to steal a password or other personal information. Such activity includes the user receiving an email containing a harmful attachment, links to malicious software downloads, or links to fake websites that are designed to access passwords.', '["https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1560"]', 'contains("log.protoPayload.methodName", "google.login.LoginService.govAttackWarning")
+', '2026-02-09 16:31:52.331138', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (53, 'Kaspersky Data Exfiltration Attempts Detection', 3, 2, 1, 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 'Detects potential data exfiltration attempts identified by Kaspersky through suspicious network traffic patterns, large data transfers, or connections to suspicious external destinations. This rule monitors for network threats, trojan/backdoor detections, and suspicious data transfer patterns that may indicate data exfiltration.
+
+Next Steps:
+1. Immediately identify the source host (origin.ip) and any associated user accounts on the affected system
+2. Check if the destination IP (target.ip) is known malicious using threat intelligence sources
+3. Review the volume and frequency of data transfers to this destination in the last 24-48 hours
+4. Search for any other malware detections (especially Trojans/Backdoors) on the same host
+5. Analyze network traffic logs for unusual patterns or protocols from the source IP
+6. Check if other hosts in your network have connected to the same destination
+7. If confirmed malicious:
+ - Block the destination IP at firewall/proxy level
+ - Isolate the affected system from network
+ - Initiate full incident response procedures
+ - Preserve evidence for forensic analysis
+8. Document all findings and actions taken for compliance and future reference
+', '["https://attack.mitre.org/techniques/T1048/","https://support.kaspersky.com/KLMS/8.2/en-US/151684.htm"]', '(equals("log.cat", "NetworkThreat") ||
+ regexMatch("log.cs2", "(?i).*(trojan|backdoor).*") ||
+ regexMatch("log.cefMsg", "(?i).*(data.*transfer|exfiltrat|upload.*suspicious|unauthorized.*transfer).*") ||
+ regexMatch("log.cefMsgAll", "(?i).*(data.*exfiltration|suspicious.*upload|unauthorized.*transfer).*")) &&
+exists("target.ip") &&
+greaterOrEqual("log.cefDeviceSeverity", 3)
+', '2026-02-09 16:29:47.051234', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-kaspersky-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.cat","operator":"filter_term","value":"NetworkThreat"}],"or":null,"within":"now-30m","count":5}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (54, 'Kaspersky Agent Disabled or Tampered', 3, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when the Kaspersky security agent is disabled, stopped, or tampered with. This is a critical indicator of defense evasion as attackers disable endpoint protection to execute malware undetected.
+
+Next Steps:
+1. Immediately investigate the affected endpoint
+2. Identify the user or process that disabled the agent
+3. Check for concurrent malicious activity
+4. Re-enable the Kaspersky agent
+5. Perform a full system scan
+6. Check for similar events on other endpoints
+', '["https://support.kaspersky.com/","https://attack.mitre.org/techniques/T1562/001/"]', 'exists("log.signatureID") &&
+(regexMatch("log.message", "(?i)(kaspersky|klnagent|kavfs|kesl).*( disabled| stopped| removed| tampered| uninstalled)") ||
+ regexMatch("log.message", "(?i)(protection|self-defense).*(disabled|off|stopped)") ||
+ (contains("log.cs1", "PROTECTION") && contains("log.message", "disabled")) ||
+ (contains("log.message", "agent") && contains("log.message", "not running")))
+', '2026-02-09 16:29:47.205678', true, false, 'origin', null, '[]', '["lastEvent.log.dvchost","lastEvent.log.src"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (55, 'Kaspersky Ransomware Behavior Detection', 3, 3, 3, 'Impact', 'T1486 - Data Encrypted for Impact', 'Detects ransomware behavior patterns identified by Kaspersky including mass file encryption, ransom note creation, and ransomware-specific malware classifications.
+
+Next Steps:
+1. Immediately isolate the affected system from the network
+2. Identify the ransomware variant from Kaspersky''s classification
+3. Check backup availability and integrity
+4. Do not pay the ransom
+5. Engage incident response team
+6. Scan other systems for the same indicators
+7. Determine the initial infection vector
+', '["https://support.kaspersky.com/","https://attack.mitre.org/techniques/T1486/"]', 'exists("log.signatureID") &&
+(regexMatch("log.message", "(?i)(ransomware|ransom|trojan-ransom|cryptolocker|locky|cerber|wannacry|ryuk|conti|lockbit|blackcat)") ||
+ contains("log.cs2", "Trojan-Ransom") || contains("log.cs4", "Trojan-Ransom") ||
+ (contains("log.message", "encrypt") && contains("log.message", "mass")) ||
+ (contains("log.message", "System Watcher") && contains("log.message", "rollback")))
+', '2026-02-09 16:29:47.406636', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-kaspersky-*","with":[{"field":"log.src","operator":"filter_term","value":"{{log.src}}"}],"or":null,"within":"now-10m","count":3}]', '["lastEvent.log.dvchost","lastEvent.log.src"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (56, 'Kaspersky Rootkit Detection', 3, 3, 3, 'Defense Evasion', 'T1014 - Rootkit', 'Detects rootkit activity identified by Kaspersky security, including hidden processes, kernel-level modifications, and rootkit-specific malware classifications that indicate a deeply compromised system.
+
+Next Steps:
+1. Immediately isolate the affected system
+2. Do not trust any output from the compromised system
+3. Perform offline forensic analysis
+4. Plan for full system reimaging
+5. Check for lateral movement from the compromised host
+6. Determine the initial infection vector
+', '["https://support.kaspersky.com/","https://attack.mitre.org/techniques/T1014/"]', 'exists("log.signatureID") &&
+(regexMatch("log.message", "(?i)(rootkit|bootkit|Rootkit|hidden.*process|hidden.*module)") ||
+ contains("log.cs2", "Rootkit") || contains("log.cs4", "Rootkit") ||
+ contains("log.cs2", "Bootkit") || contains("log.cs4", "Bootkit") ||
+ (contains("log.message", "System Analysis") && contains("log.message", "hidden")))
+', '2026-02-09 16:29:47.566348', true, false, 'origin', null, '[]', '["lastEvent.log.dvchost","lastEvent.log.src"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (57, 'Lateral Movement Indicators Detection', 3, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Detects indicators of lateral movement attempts within the network through Kaspersky antivirus logs.
+Attackers use various techniques including PSExec, WMI, RDP, SMB shares, and exploitation tools to move
+from one compromised system to others, expanding their access and control across the network. This rule
+identifies blocked or detected activities that may indicate lateral movement attempts.
+
+Next Steps:
+1. Investigate the source IP and hostname for signs of compromise
+2. Review authentication logs for the same time period to identify potential credential theft
+3. Check if the detected tools (PSExec, WMI, RDP) are authorized for use in your environment
+4. Examine network traffic between the source and destination systems
+5. Look for other suspicious activities from the same source host
+6. Consider isolating affected systems if lateral movement is confirmed
+7. Review similar patterns from the same source within the detection window
+', '["https://attack.mitre.org/tactics/TA0008/","https://support.kaspersky.com/KESWin/11/en-us/151065.htm"]', '(equals("log.cn1", "3") || equals("log.cs1", "DETECT") || equals("log.act", "blocked")) &&
+(contains("log.cefMsg", ["psexec", "wmi", "rdp", "smb", "admin$", "ipc$", "c$",
+ "remote", "lateral", "pivot"]) ||
+ contains("log.cs4", ["exploit", "mimikatz", "bloodhound", "sharphound", "propagat"])) &&
+exists("log.dst") &&
+exists("log.src") &&
+safe(log.src, "") != safe(log.dst, "")
+', '2026-02-09 16:29:47.711856', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-kaspersky-*","with":[{"field":"log.src","operator":"filter_term","value":"{{log.src}}"}],"or":null,"within":"now-2h","count":3}]', '["lastEvent.log.dhost","lastEvent.log.dst","lastEvent.log.src"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (188, 'AWS CloudTrail Log Deleted', 2, 3, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies the deletion of an AWS log trail. An adversary may delete trails in an attempt to evade defenses', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/delete-trail.html"]', 'equals("log.eventSource", "cloudtrail.amazonaws.com") &&
+equals("log.eventName", "DeleteTrail")
+', '2026-02-09 16:32:22.485394', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (58, 'Living Off the Land Binaries (LOLBins) Abuse Detection', 3, 3, 2, 'Defense Evasion', 'T1218 - System Binary Proxy Execution', 'Detects the malicious use of legitimate Windows system binaries (LOLBins) to execute malicious code. Attackers abuse these trusted tools to bypass security controls and maintain persistence. LOLBins are particularly dangerous because they are signed Microsoft binaries that are trusted by most security products.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Review the full context of the detection including command line parameters and parent processes
+3. Check for any network connections or file downloads initiated by the LOLBin process
+4. Look for persistence mechanisms (scheduled tasks, registry keys, services) created around the same time
+5. Scan for additional indicators of compromise on the affected system
+6. Review user account activity for signs of compromise or privilege escalation
+7. Consider reimaging the system if fileless malware is confirmed
+', '["https://attack.mitre.org/techniques/T1218/","https://lolbas-project.github.io/","https://www.kaspersky.com/enterprise-security/wiki-section/products/fileless-threats-protection"]', '(equals("log.signatureID", "3") || equals("log.cs1", "DETECT")) &&
+(regexMatch("log.cefMsg", "(?i).*(rundll32|regsvr32|mshta|certutil|bitsadmin|powershell|wmic|cscript|wscript|msiexec|installutil|regasm|regsvcs).*") ||
+ contains("log.cs4", ["fileless", "LOLBin", "LOLBas"])) &&
+(contains("log.cefMsg", ["download", "execute", "bypass", "encoded", "obfuscat", "hidden", "malicious"]) ||
+ exists("log.actionResult"))
+', '2026-02-09 16:29:47.867270', true, false, 'origin', null, '[]', '["lastEvent.log.cs4","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (59, 'Kaspersky Application Privilege Escalation Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055/T1134 - Process Injection and Access Token Manipulation', 'Detects attempts to escalate privileges through application manipulation, process injection, or unauthorized elevation of permissions monitored by Kaspersky endpoint protection. These techniques are commonly used by attackers to gain higher-level permissions on compromised systems.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent lateral movement
+2. Review the process that triggered the alert and its parent process chain
+3. Check if the source process is legitimate or potentially malicious
+4. Look for other suspicious activities on the same host in the last hour
+5. Collect memory dumps if possible for forensic analysis
+6. Review user account permissions and recent changes
+7. Check for any unauthorized scheduled tasks or services
+8. Update Kaspersky signatures and run a full system scan
+', '["https://support.kaspersky.com/KLMS/8.2/en-US/151684.htm","https://attack.mitre.org/techniques/T1055/","https://attack.mitre.org/techniques/T1134/"]', 'exists("log.signatureID") &&
+!equals("log.action", "Allowed") &&
+(contains("log.message", ["privilege", "elevation", "EXPLOIT", "Exploit",
+ "process injection", "token manipulation"]) ||
+ contains("log.cs1", "EXPLOIT") ||
+ contains("log.cs2", "Exploit") ||
+ contains("log.cs4", "Exploit") ||
+ contains("log.cefMsg", ["privilege", "elevation"]))
+', '2026-02-09 16:29:48.010688', true, false, 'origin', null, '[]', '["lastEvent.log.signatureID","adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (60, 'Kaspersky Sandbox Evasion Attempts Detection', 3, 3, 2, 'Defense Evasion, Discovery', 'T1497 - Virtualization/Sandbox Evasion', 'Identifies malware attempting to detect and evade sandbox environments. This includes time-based evasion, environment checks, anti-VM techniques, and other behaviors designed to avoid analysis in controlled environments.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent potential malware spread
+2. Review the process that triggered the sandbox evasion detection
+3. Check for any suspicious parent processes or child processes
+4. Collect memory dumps and samples for deeper analysis
+5. Review recent file downloads and email attachments on the affected system
+6. Check if similar detection occurred on other systems in the network
+7. Consider submitting the sample to Kaspersky for further analysis
+', '["https://www.kaspersky.com/enterprise-security/malware-sandbox","https://attack.mitre.org/techniques/T1497/","https://attack.mitre.org/techniques/T1497/001/"]', 'exists("log.signatureID") &&
+(contains("log.cefMsg", ["sandbox", "evasion", "anti-VM", "virtualization"]) ||
+ contains("log.cefMsgAll", ["sandbox", "evasion"]) ||
+ contains("log.cs1", "SANDBOX_") ||
+ contains("log.cs4", ["Evasion", "AntiVM", "environment check", "time delay", "VM detection"]) ||
+ (equals("log.cat", "Behavior Detection") &&
+ contains("log.cefMsg", ["delay", "sleep"])))
+', '2026-02-09 16:29:48.151518', true, false, 'origin', '["adversary.host","lastEvent.log.cs4"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (61, 'Kaspersky Suspicious Network Activity Detection', 3, 2, 2, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects suspicious network activities including unusual connections, potential C2 communications, or network-based attacks identified by Kaspersky security monitoring. This rule triggers when Kaspersky blocks network connections that match suspicious patterns and multiple similar events occur from the same host.
+
+Next Steps:
+1. Review the source and destination IP addresses for known malicious indicators using threat intelligence feeds
+2. Check if the blocked connection was attempting to reach known C2 servers or suspicious domains
+3. Examine the process that initiated the network connection (check log.processName or log.filePath if available)
+4. Review other security events from the same host within the last hour for additional IOCs
+5. Verify if multiple hosts are exhibiting similar network behavior (potential lateral movement or outbreak)
+6. Check firewall logs for any successful connections to the same destination that may have bypassed Kaspersky
+7. Consider isolating the affected system if C2 communication is confirmed
+8. Run a full system scan on the affected host and check for persistence mechanisms
+9. Review network traffic logs for data exfiltration attempts to the same destination
+10. Document the incident and update block lists with confirmed malicious IPs/domains
+', '["https://support.kaspersky.com/kwts/6.1/267200","https://attack.mitre.org/techniques/T1071/","https://attack.mitre.org/techniques/T1043/"]', 'exists("log.signatureID") &&
+(contains("log.message", ["suspicious connection", "network attack", "port scan", "unusual traffic"]) ||
+ contains("log.descMsg", "network") ||
+ contains("log.cs1", "NETWORK") ||
+ contains("log.cs2", "Net-Worm") ||
+ contains("log.cs4", "Net-Worm") ||
+ (exists("log.dstIP") && exists("log.dpt"))) &&
+equals("log.act", "Blocked")
+', '2026-02-09 16:29:48.296465', true, false, 'origin', null, '[{"indexPattern":"v11-log-antivirus-kaspersky-*","with":[{"field":"log.src","operator":"filter_term","value":"{{log.src}}"},{"field":"log.dstIP","operator":"filter_term","value":"{{log.dstIP}}"}],"or":null,"within":"now-30m","count":5}]', '["lastEvent.log.dstIP","lastEvent.log.dvchost","lastEvent.log.src"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (82, 'Storyline Correlation Event', 3, 3, 2, 'Attack Chain Detection', 'Attack Chain Analysis', 'Detects correlated attack patterns identified by SentinelOne''s Storyline feature, which connects related events to reveal complete attack chains and multi-stage threats.
+
+Next Steps:
+1. Review the complete attack chain in the SentinelOne console''s Storyline view
+2. Identify all affected endpoints and users involved in the attack chain
+3. Check for lateral movement or persistence mechanisms across the related events
+4. Isolate affected endpoints if active threats are detected
+5. Collect forensic data from all systems identified in the storyline
+6. Review and update security policies based on the attack patterns observed
+7. Analyze the attack timeline and identify any gaps in detection
+8. Coordinate with incident response team for threat hunting activities
+', '["https://www.sentinelone.com/platform/storyline-active-response/","https://attack.mitre.org/tactics/enterprise/"]', 'regexMatch("log.eventDescription", "(?i)(storyline|attack chain|correlated|multi.?stage|campaign)") && regexMatch("log.message", "(?i)(threat|attack|compromise|breach)")', '2026-02-09 16:29:51.525591', true, false, 'origin', null, '[]', '["lastEvent.log.eventDescription","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (62, 'Suspicious Packed Executable Detection', 3, 3, 2, 'Defense Evasion', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'Detects when Kaspersky identifies suspicious packed executables, which are often used by malware to evade detection and analysis. Packed executables use compression or encryption to hide their true content and make reverse engineering more difficult.
+
+Next Steps:
+1. Identify the affected system from origin.hostname and origin.ip fields
+2. Review the detected threat details from log.descMsg and log.msg fields
+3. Check the action taken by the antivirus (blocked/detected) in the action field
+4. Verify if the file is legitimate software that uses packing for protection
+5. If malicious, isolate the affected system immediately
+6. Perform a full system scan to identify additional threats
+7. Review process execution logs for suspicious child processes spawned by packed executables
+8. Check network connections initiated by the suspicious executable
+9. Submit the sample to Kaspersky or third-party sandbox for detailed analysis
+10. Update antivirus signatures and ensure real-time protection is enabled
+', '["https://www.kaspersky.com/resource-center/threats/suspicious-packers","https://attack.mitre.org/techniques/T1027/002/"]', 'oneOf("action", ["blocked", "detected"]) &&
+(contains("log.descMsg", ["Packed", "packer"]) ||
+ contains("log.msg", ["packed", "Packed"]) ||
+ contains("log.descMsg", ["NSAnti", "Themida", "VMProtect", "ASPack", "UPX",
+ "PECompact", "Enigma", "Armadillo"]) ||
+ contains("log.msg", ["NSAnti", "Themida", "VMProtect", "ASPack", "UPX",
+ "PECompact", "Enigma", "Armadillo"]) ||
+ contains("log.cat", ["Trojan.Packed", "Packed"]))
+', '2026-02-09 16:29:48.426196', true, false, 'origin', null, '[]', '["adversary.hostname","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (63, 'Kaspersky Suspicious Scheduled Tasks Detection', 3, 3, 2, 'Execution, Persistence, Privilege Escalation', 'T1053 - Scheduled Task/Job', 'Detects suspicious scheduled task creation or modification identified by Kaspersky, which could indicate persistence mechanisms used by malware or attackers. Scheduled tasks are commonly abused by attackers to maintain persistence, execute malicious code at specific times, or escalate privileges.
+
+Next Steps:
+1. Review the scheduled task details in log.msg, log.fname, and log.descMsg fields
+2. Check the specific threat signature in log.signatureID to understand the detection
+3. Examine log.cs1 and log.cs2 fields for additional threat context and classification
+4. Verify if the task creation was part of legitimate administrative activity
+5. Check the affected host (origin.host) for other persistence mechanisms:
+ - Registry run keys
+ - Startup folder items
+ - Services
+ - WMI event subscriptions
+6. Review log.deviceTime for timeline analysis and correlate with other security events
+7. If confirmed malicious:
+ - Disable or remove the scheduled task immediately
+ - Scan the system for additional malware components
+ - Check if the malware has spread to other systems
+ - Preserve evidence and initiate incident response procedures
+', '["https://attack.mitre.org/techniques/T1053/","https://support.kaspersky.com/ScanEngine/1.0/en-US/186767.htm"]', '(containsAll("log.msg", ["scheduled", "task"]) ||
+ contains("log.msg", ["schtasks", "schedule"]) ||
+ contains("log.descMsg", ["scheduled", "task"]) ||
+ contains("log.cs2", "persist") ||
+ contains("log.fname", "\\Tasks\\") ||
+ contains("log.cat", "persistence")) &&
+(exists("log.signatureID") ||
+ oneOf("log.cs1", ["infected", "suspicious"]) ||
+ exists("log.cefDeviceSeverity"))
+', '2026-02-09 16:29:48.581531', true, false, 'origin', null, '[]', '["lastEvent.log.signatureID","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (64, 'Kaspersky Suspicious Service Installation Detection', 2, 2, 2, 'Persistence, Privilege Escalation', 'T1543.003 - Create or Modify System Process: Windows Service', 'Detects suspicious Windows service installation or modification attempts identified by Kaspersky, which could indicate malware persistence mechanisms or privilege escalation attempts. Service manipulation is a common technique used by malware to maintain persistence on compromised systems.
+
+Next Steps:
+1. Identify the service name and executable path from the alert details
+2. Verify if the service installation was authorized and legitimate
+3. Check the digital signature and reputation of the service executable
+4. Review parent process that initiated the service installation
+5. Look for other suspicious activities on the affected host around the same time
+6. If confirmed malicious, stop and remove the service, quarantine associated files
+7. Perform full system scan and check for additional compromise indicators
+', '["https://attack.mitre.org/techniques/T1543/003/","https://support.kaspersky.com/ScanEngine/2.1/en-US/186767.htm"]', '(containsAll("log.message", ["Service", "install"]) ||
+ containsAll("log.message", ["sc.exe", "create"]) ||
+ containsAll("log.message", ["New", "Service"]) ||
+ contains("log.fname", "\\services.exe") ||
+ contains("log.cs2", "Service")) &&
+(oneOf("log.cs1", ["infected", "suspicious"]) ||
+ greaterOrEqual("log.cefDeviceSeverity", 3))
+', '2026-02-09 16:29:48.715709', true, false, 'origin', null, '[]', '["lastEvent.log.fname","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (65, 'Kaspersky System File Tampering Detection', 2, 3, 1, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects attempts to tamper with critical system files, Windows services, or protected system components. This includes unauthorized modifications to system binaries, service configurations, or attempts to manipulate security-critical files.
+
+Next Steps:
+1. Identify the affected system file or component from the log details
+2. Check if the modification was authorized (planned maintenance, legitimate software update)
+3. Review process information to identify the source of the tampering attempt
+4. Look for additional indicators of compromise on the affected system
+5. Investigate any parent processes or scripts that initiated the modification
+6. Check for persistence mechanisms that may have been established
+7. Consider isolating the system if unauthorized tampering is confirmed
+', '["https://support.kaspersky.com/kwts/6.1/267200","https://attack.mitre.org/techniques/T1562/001/","https://attack.mitre.org/techniques/T1036/"]', 'exists("log.signatureID") &&
+(contains("log.message", ["system file", "critical file", "protected file", "service tamper"]) ||
+ contains("log.cs1", "SYSTEM_MOD") ||
+ contains("log.cs4", "SystemFile") ||
+ contains("log.cefMsg", ["system modification", "unauthorized change"]) ||
+ (equals("log.cat", "Behavior Detection") && contains("log.message", "modify")))
+', '2026-02-09 16:29:48.851403', true, false, 'origin', null, '[]', '["lastEvent.log.cs4","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (66, 'Kaspersky WMI Abuse Detection', 3, 3, 2, 'Execution', 'T1047 - Windows Management Instrumentation', 'Detects potential Windows Management Instrumentation (WMI) abuse identified by Kaspersky, including suspicious WMI queries, event subscriptions, or process creation via WMI. WMI is a legitimate Windows component often abused by attackers for lateral movement, persistence, and code execution.
+
+Next Steps:
+1. Identify the affected host and user account involved in the WMI activity
+2. Review the specific WMI commands or queries that triggered the alert
+3. Check for any unauthorized scheduled tasks or startup items created via WMI
+4. Look for other indicators of compromise on the affected system
+5. Verify if this is legitimate administrative activity or potential malicious behavior
+6. If confirmed malicious, isolate the system and perform incident response procedures
+', '["https://attack.mitre.org/techniques/T1047/","https://support.kaspersky.com/KLMS/8.2/en-US/151684.htm"]', '(contains("log.cefMsg", ["WMI", "wmi", "wmic", "winmgmt", "scrcons.exe"]) ||
+ contains("log.cefMsgAll", "WMI")) &&
+(greaterOrEqual("log.cefDeviceSeverity", 3) || equals("log.cat", "blocked"))
+', '2026-02-09 16:29:49.335545', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (67, 'SentinelOne Agent Tampering Attempts', 3, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects attempts to tamper with, disable, or modify the SentinelOne agent. This is a critical security event as attackers often try to disable security tools before launching their main attack. Immediate response required.
+
+Next Steps:
+1. Immediately isolate the affected endpoint to prevent further damage
+2. Review the user account associated with the tampering attempt
+3. Check system logs for any suspicious activities before and after the tampering attempt
+4. Verify if the SentinelOne agent is still functioning properly
+5. Look for any malware or unauthorized software that may have been installed
+6. Review network connections from the affected host for command and control activity
+7. If tampering was successful, consider reimaging the system after forensic analysis
+', '["https://support.sentinelone.com/hc/en-us/articles/360001089343-Protecting-the-SentinelOne-Agent","https://attack.mitre.org/techniques/T1562/001/"]', 'regexMatch("log.eventDescription", ".*(tamper|disable|stop|uninstall|modify).*agent.*") ||
+regexMatch("log.eventDescription", ".*agent.*(tamper|disable|stop|uninstall|modify).*") ||
+oneOf("log.activityType", ["agent_uninstall", "agent_disable", "agent_tamper"]) ||
+equals("log.eventType", "AgentTamperingAttempt") ||
+(regexMatch("log.processName", ".*(sentinelone|sentinel).*") &&
+ oneOf("log.action", ["kill", "terminate", "stop", "disable"]))
+', '2026-02-09 16:29:49.440788', true, false, 'origin', null, '[]', '["lastEvent.log.agentId","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (68, 'Kaspersky Trusted Application Compromise Detection', 3, 3, 2, 'Defense Evasion', 'T1218 - Signed Binary Proxy Execution', 'Identifies when legitimate or trusted applications exhibit malicious behavior, potentially indicating compromise or exploitation. This includes detecting when signed binaries are used for malicious purposes or when trusted processes perform suspicious activities. This is a critical security event that indicates an attacker may be using living-off-the-land techniques to evade detection.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent lateral movement
+2. Identify the compromised trusted application and its process chain
+3. Review recent system changes and user activities on the affected host
+4. Check for persistence mechanisms (scheduled tasks, services, registry keys)
+5. Analyze network connections from the compromised application
+6. Look for data exfiltration indicators from the affected system
+7. Consider reimaging the system if compromise is confirmed
+8. Update security policies to monitor the exploited application more closely
+', '["https://www.kaspersky.com/enterprise-security/wiki-section/products/kaspersky-anti-targeted-attack-platform","https://attack.mitre.org/techniques/T1218/","https://attack.mitre.org/techniques/T1574/"]', 'exists("log.signatureID") &&
+(contains("log.msg", ["trusted application", "signed binary", "legitimate program"]) ||
+ contains("log.cs1", "TRUSTED_COMP") ||
+ contains("log.cs4", "TrustedApp") ||
+ contains("log.descMsg", "whitelisted") ||
+ (equals("log.cat", "Exploit Prevention") && contains("log.msg", "exploit")) ||
+ containsAll("log.msg", ["behavior", "trusted"])) &&
+oneOf("log.cefDeviceSeverity", ["High", "Medium"])
+', '2026-02-09 16:29:49.531168', true, false, 'origin', null, '[]', '["lastEvent.log.cs1","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (69, 'SentinelOne AI-Based Threat Hunting Alerts', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects threats identified by SentinelOne''s AI and machine learning threat hunting capabilities, including zero-day exploits, fileless attacks, and previously unknown malware variants.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent lateral movement
+2. Review the threat details in SentinelOne console for threat classification and confidence score
+3. Check if the AI detection correlates with any unusual process behavior or network activity
+4. Examine memory dumps if available for fileless attack indicators
+5. Search for similar AI detections across other endpoints in the environment
+6. If confirmed as a zero-day or new variant, submit samples to threat intelligence teams
+7. Update security policies based on the AI detection patterns observed
+', '["https://www.sentinelone.com/platform/ai-powered-prevention/","https://attack.mitre.org/tactics/TA0043/","https://attack.mitre.org/techniques/T1055/"]', '(
+ regexMatch("log.eventDescription", "(?i)(ai detected|machine learning|threat hunt|hunting alert|ai threat|automated detection)") ||
+ oneOf("log.engines", ["AI", "MachineLearning", "Static AI", "Behavioral AI"]) ||
+ contains("log.threatClassificationSource", "AI")
+) &&
+exists("log.endpointDeviceName") &&
+(exists("log.threatId") || exists("log.threatName") || exists("log.threatClassification"))
+', '2026-02-09 16:29:49.676366', true, false, 'origin', null, '[]', '["lastEvent.log.accName","lastEvent.log.endpointDeviceName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (70, 'SentinelOne Behavioral Threat Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects behavioral threat patterns identified by SentinelOne''s AI engine, including suspicious process behaviors, anomalous system calls, and deviations from normal endpoint activity patterns.
+
+Next Steps:
+1. Review the specific behavioral indicator that triggered the alert in log.eventDescription
+2. Identify the affected host and user account from log.syslogHost and log.destinationUser
+3. Check if the behavior is associated with legitimate software or administrative activity
+4. Investigate other recent activities from the same host for signs of compromise
+5. If confirmed malicious, isolate the endpoint and initiate incident response procedures
+6. Review SentinelOne console for additional threat details and recommended remediation actions
+7. Collect memory dumps if process injection or in-memory threats are suspected
+8. Check for persistence mechanisms that may have been established
+', '["https://www.sentinelone.com/platform/behavioral-ai/","https://attack.mitre.org/techniques/T1055/"]', '(regexMatch("log.eventDescription", "(?i)(behavioral|anomaly|suspicious behavior|abnormal|pattern detected|threat behavior|malicious activity)") || regexMatch("log.eventDescription", "(?i)(process injection|code injection|memory manipulation|hollowing)")) && exists("log.syslogHost") && exists("log.eventDescription")', '2026-02-09 16:29:49.810812', true, false, 'origin', null, '[]', '["lastEvent.log.eventDescription","lastEvent.log.syslogHost"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (81, 'SentinelOne Policy Downgraded from Protect to Detect', 3, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when a SentinelOne policy is downgraded from Protect mode to Detect-only mode, which stops automatic threat remediation. This is a critical defense evasion indicator as attackers with console access weaken protection before deploying malware.
+
+Next Steps:
+1. Identify the administrator who changed the policy
+2. Verify through change management if this was authorized
+3. Check for concurrent threat detections on affected endpoints
+4. Restore the Protect policy immediately if unauthorized
+5. Review admin account access for compromise
+6. Scan all affected endpoints for unmitigated threats
+', '["https://support.sentinelone.com/","https://attack.mitre.org/techniques/T1562/001/"]', '(contains("log.eventDescription", "policy") &&
+ ((contains("log.eventDescription", "Detect") && contains("log.eventDescription", "changed")) ||
+ contains("log.eventDescription", "downgrade") ||
+ (contains("log.eventDescription", "Protect") && contains("log.eventDescription", "Detect")))) ||
+(oneOf("log.activityType", ["policy_updated", "policy_changed"]) &&
+ contains("log.eventDescription", "Detect"))
+', '2026-02-09 16:29:51.340676', true, false, 'origin', null, '[]', '["lastEvent.log.activityType","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (71, 'SentinelOne Cloud Workload Protection Alert', 3, 3, 2, 'Defense Evasion, Persistence, Privilege Escalation, Initial Access', 'T1078.004 - Valid Accounts: Cloud Accounts', 'Detects cloud workload protection alerts including suspicious cloud API calls, unauthorized cloud resource access, cloud account compromise, or cloud-native threat detection.
+
+Next Steps:
+1. Review the specific cloud workload alert details in the SentinelOne console
+2. Identify the affected cloud resources (AWS, Azure, GCP) and account involved
+3. Check for any unauthorized changes to cloud configurations or resources
+4. Review cloud provider logs for the time period around the alert
+5. Verify if the activity was authorized or part of legitimate operations
+6. If suspicious, immediately revoke any compromised credentials or access keys
+7. Enable additional cloud security monitoring and alerts if not already configured
+8. Document findings and update incident response procedures as needed
+', '["https://www.sentinelone.com/platform/singularity-cloud-workload-security/","https://attack.mitre.org/techniques/T1078/004/"]', 'exists("log.eventDescription") &&
+contains("log.eventDescription", ["cloud", "aws", "azure", "gcp",
+ "lambda", "s3", "ec2", "workload"]) &&
+contains("log.eventDescription", ["threat detected", "malicious", "compromise",
+ "breach", "attack detected", "unauthorized access"]) &&
+(exists("log.threatId") || exists("log.endpointDeviceName"))
+', '2026-02-09 16:29:49.951108', true, false, 'origin', null, '[]', '["lastEvent.log.accName","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (72, 'SentinelOne Container Security Alert', 3, 3, 2, 'Defense Evasion, Execution', 'T1610 - Deploy Container', 'Detects container-related security events including container drift, unauthorized container deployment, cryptominers in containers, or suspicious container behavior.
+
+Next Steps:
+1. Identify the affected container and host system from the alert details
+2. Review the container runtime logs for additional context
+3. Check if the container is running authorized images from trusted registries
+4. Investigate any network connections or processes spawned by the container
+5. If unauthorized activity is confirmed, isolate the container and host
+6. Review container deployment policies and runtime security configurations
+7. Check for similar alerts across other container environments
+', '["https://www.sentinelone.com/platform/singularity-cloud-workload-security/","https://www.sentinelone.com/resources/cloud-workload-security-for-containers/","https://attack.mitre.org/techniques/T1610/"]', 'exists("log.eventDescription") &&
+contains("log.eventDescription", ["container", "kubernetes", "k8s",
+ "docker", "pod"]) &&
+contains("log.eventDescription", ["drift detected", "cryptominer", "malicious",
+ "breach", "unauthorized container", "container escape"]) &&
+(exists("log.threatId") || exists("log.endpointDeviceName"))
+', '2026-02-09 16:29:50.096116', true, false, 'origin', null, '[]', '["adversary.host","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (73, 'Custom Detection Rule Triggers', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects when custom detection rules configured in SentinelOne trigger, indicating organization-specific threat patterns or policy violations have been identified. Custom rules are tailored to detect specific behaviors or patterns unique to the organization''s security requirements.
+
+Next Steps:
+1. Review the specific custom rule that triggered and understand its purpose
+2. Investigate the affected endpoint (log.syslogHost) for additional suspicious activity
+3. Check if the same custom rule has triggered on other endpoints
+4. Verify if the detection is a false positive based on the custom rule''s logic
+5. If legitimate threat activity, initiate incident response procedures
+6. Consider updating the custom rule if false positives are frequent
+', '["https://docs.sentinelone.com/","https://attack.mitre.org/techniques/T1059/"]', '(contains("log.eventDescription", ["custom rule", "custom detection", "Custom Rules"]) ||
+ equals("log.detectionSource", "CustomRule") ||
+ equals("log.ruleType", "Custom")) &&
+exists("log.syslogHost")
+', '2026-02-09 16:29:50.250725', true, false, 'origin', null, '[]', '["lastEvent.log.eventDescription","lastEvent.log.syslogHost"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (74, 'Deep Visibility Threat Indicators', 3, 3, 2, 'Defense Evasion', 'T1070 - Indicator Removal on Host', 'Detects advanced threat indicators through SentinelOne''s deep visibility monitoring. This rule triggers when specific threat-related events are detected in the SentinelOne logs.
+
+Next Steps:
+1. Review the event description to understand the specific threat indicator
+2. Check the affected host (syslogHost) for signs of compromise
+3. Investigate any associated user accounts (sourceUser, destinationUser)
+4. Review source IP addresses for suspicious origins
+5. Check if this is part of a larger attack campaign
+6. Consider isolating the affected endpoint if threat is confirmed
+', '["https://www.sentinelone.com/blog/rapid-threat-hunting-with-deep-visibility-feature-spotlight/","https://attack.mitre.org/techniques/T1070/"]', 'exists("log.eventDescription") &&
+(
+ contains("log.eventDescription", ["malware detected", "threat detected", "malicious file", "malicious process",
+ "exploit detected", "ransomware detected", "trojan detected", "backdoor detected", "rootkit detected",
+ "cryptominer detected", "worm detected", "spyware detected"]) ||
+ (contains("log.eventDescription", "threat") && oneOf("log.threatClassification", ["Malware", "Exploit", "Ransomware", "Trojan", "PUP"])) ||
+ (contains("log.eventDescription", "malicious") && exists("log.threatId"))
+) &&
+exists("log.syslogHost")
+', '2026-02-09 16:29:50.391111', true, false, 'origin', null, '[]', '["lastEvent.log.eventDescription","lastEvent.log.syslogHost"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (75, 'SentinelOne Endpoint Detection and Response (EDR) Alerts', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Critical EDR alerts from SentinelOne including suspicious endpoint activities, unauthorized system changes, malicious command execution, and advanced persistent threat (APT) indicators. These alerts indicate potential security incidents that require immediate investigation.
+
+Next Steps:
+1. Identify the affected endpoint(s) and user accounts involved
+2. Review the specific threat details and indicators of compromise (IoCs)
+3. Check for any lateral movement or persistence mechanisms
+4. Isolate the affected endpoint(s) if necessary
+5. Collect forensic data and memory dumps if required
+6. Review related security events from the same host in the last 24-48 hours
+7. Verify if the detected activity is legitimate or false positive
+8. If confirmed malicious, initiate incident response procedures
+9. Update security controls and detection rules based on findings
+10. Document the incident and lessons learned
+', '["https://www.sentinelone.com/platform/edr/","https://attack.mitre.org/techniques/T1059/","https://attack.mitre.org/techniques/T1547/"]', '(
+ regexMatch("log.eventDescription", "(?i)(edr|endpoint detection|endpoint alert|endpoint threat|endpoint incident|suspicious endpoint|compromised endpoint|endpoint breach|endpoint attack)") ||
+ regexMatch("log.message", "(?i)(edr alert|endpoint response|incident response|threat response)")
+) &&
+(
+ regexMatch("log.eventDescription", "(?i)(critical|high|severe|malicious|unauthorized|breach)") ||
+ exists("log.destinationUser") ||
+ exists("log.endpointDeviceName")
+) &&
+exists("log.syslogHost")
+', '2026-02-09 16:29:50.520978', true, false, 'origin', null, '[]', '["lastEvent.log.endpointDeviceName","lastEvent.log.syslogHost"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (76, 'SentinelOne IoT Device Compromise Indicator', 3, 3, 2, 'Execution', 'T1203 - Exploitation for Client Execution', 'Detects indicators of IoT device compromise including unauthorized firmware modifications, suspicious network behavior from IoT devices, or anomalous IoT device activity patterns detected by SentinelOne''s Singularity Ranger. This rule triggers when IoT-related threats are identified including compromised embedded systems, firmware backdoors, industrial control system attacks, or SCADA system compromises.
+
+Next Steps:
+1. Isolate the affected IoT device immediately to prevent lateral movement
+2. Review device logs and network traffic to identify the initial compromise vector
+3. Check for firmware modifications or unauthorized configuration changes
+4. Verify if other IoT devices on the same network segment show similar indicators
+5. Update device firmware to latest secure version if available
+6. Consider factory reset and reconfiguration if compromise is confirmed
+7. Review network segmentation to ensure IoT devices are properly isolated
+8. Implement additional monitoring for IoT device communications
+', '["https://www.sentinelone.com/platform/singularity-ranger/","https://attack.mitre.org/techniques/T1203/"]', 'exists("log.eventDescription") &&
+contains("log.eventDescription", ["iot", "embedded", "firmware",
+ "industrial", "scada", "ics", "plc"]) &&
+contains("log.eventDescription", ["compromise", "malicious",
+ "backdoor", "botnet", "exploit", "infection"]) &&
+exists("log.endpointDeviceName")
+', '2026-02-09 16:29:50.665659', true, false, 'origin', null, '[]', '["lastEvent.log.endpointDeviceName","lastEvent.log.eventDescription"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (77, 'Kernel-Level Threat Detection', 3, 3, 3, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects kernel-level threats including rootkits, kernel exploits, driver manipulation, and other low-level system attacks that attempt to compromise the operating system kernel.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Verify the threat detection in SentinelOne console and check threat details
+3. Run a full system scan on the affected endpoint
+4. Check for persistence mechanisms and suspicious kernel modules/drivers
+5. Review system logs for any unauthorized kernel-level changes or driver installations
+6. If rootkit is confirmed, consider reimaging the system after forensic data collection
+7. Update endpoint protection signatures and kernel protection modules
+', '["https://attack.mitre.org/techniques/T1068/","https://attack.mitre.org/techniques/T1014/"]', 'regexMatch("log.eventDescription", "(?i)(kernel|rootkit|driver|ring.?0|system.?level)") &&
+contains("log.eventDescription", ["threat", "malicious", "exploit", "compromise",
+ "detect", "block", "prevent", "isolate"])
+', '2026-02-09 16:29:50.790849', true, false, 'origin', null, '[]', '["lastEvent.log.eventDescription","lastEvent.log.syslogHost"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (78, 'Memory Injection Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects memory injection attempts including DLL injection, process hollowing, reflective DLL injection, and other in-memory attack techniques detected by SentinelOne.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent lateral movement
+2. Identify the injected process and the target process from the alert details
+3. Check for persistence mechanisms on the affected system
+4. Review SentinelOne console for additional threat indicators and related events
+5. Collect memory dump if possible for forensic analysis
+6. Check if the injection technique matches known threat actor TTPs
+7. Review network connections from the affected system for C2 communication
+8. Ensure SentinelOne remediation actions have been applied successfully
+', '["https://attack.mitre.org/techniques/T1055/","https://attack.mitre.org/techniques/T1055/001/"]', 'regexMatch("log.eventDescription", "(?i)(memory.injection|dll.injection|process.injection|reflective.dll|process.hollow|code.injection|thread.hijack|injection.detected|malicious.injection)") ||
+regexMatch("log.eventDescToParse", "(?i)(memory.injection|dll.injection|process.injection|reflective.dll|process.hollow|code.injection|thread.hijack|injection.detected|malicious.injection)")
+', '2026-02-09 16:29:50.930852', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (79, 'SentinelOne Rollback Operation Patterns Detection', 2, 3, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Detects rollback operations in SentinelOne that may indicate ransomware recovery attempts or suspicious rollback activity. Rollback operations are critical system recovery events that should be monitored for both legitimate recovery and potential abuse scenarios.
+
+Next Steps:
+1. Verify if the rollback operation was authorized by checking with the system administrator
+2. Check if there were any ransomware or malware detections on the affected system prior to the rollback
+3. Review the system logs to understand what changes were rolled back
+4. Confirm the identity of the user who initiated the rollback operation
+5. If unauthorized, investigate potential system compromise and consider isolating the affected endpoint
+6. Document the rollback operation and its justification for compliance purposes
+', '["https://www.cybervigilance.uk/insights/sentinelone-how-does-rollback-work","https://attack.mitre.org/techniques/T1490/"]', 'regexMatch("log.eventDescription", ".*[Rr]ollback.*") && (equals("log.activityType", "rollback") || exists("log.rollbackStatus") || equals("log.cat", "SystemEvent"))', '2026-02-09 16:29:51.066689', true, false, 'origin', null, '[]', '["lastEvent.log.endpointDeviceName","lastEvent.log.syslogHost"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (80, 'SentinelOne Suspicious Exclusion Addition', 3, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects suspicious additions to SentinelOne exclusion or allowlist entries, which attackers abuse to prevent detection of their malware or tools after gaining console access.
+
+Next Steps:
+1. Review the specific exclusion or allowlist entry that was added
+2. Identify the administrator who made the change
+3. Check if the excluded path or hash corresponds to known malware
+4. Verify the change through change management records
+5. Remove unauthorized exclusions immediately
+6. Audit the admin account for compromise indicators
+7. Scan endpoints for threats in previously excluded locations
+', '["https://support.sentinelone.com/","https://attack.mitre.org/techniques/T1562/001/"]', '((contains("log.eventDescription", "exclusion") || contains("log.eventDescription", "allowlist") ||
+ contains("log.eventDescription", "whitelist") || contains("log.eventDescription", "exception")) &&
+ (contains("log.eventDescription", "added") || contains("log.eventDescription", "created") ||
+ contains("log.eventDescription", "modified"))) ||
+oneOf("log.activityType", ["exclusion_created", "whitelist_created", "exclusion_modified"])
+', '2026-02-09 16:29:51.216052', true, false, 'origin', null, '[]', '["lastEvent.log.activityType","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (189, 'AWS Config Service Tampering', 3, 2, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies attempts to delete an AWS Config Service resource. An adversary may tamper with Config services in order to reduce visibility into the security posture of an account and / or its workload instances', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html","https://docs.aws.amazon.com/config/latest/APIReference/API_Operations.html"]', 'equals("log.eventSource", "config.amazonaws.com") &&
+oneOf("log.eventName", ["DeleteConfigRule", "DeleteOrganizationConfigRule",
+"DeleteConfigurationAggregator", "DeleteConfigurationRecorder",
+"DeleteConformancePack", "DeleteOrganizationConformancePack",
+"DeleteDeliveryChannel", "DeleteRemediationConfiguration",
+"DeleteRetentionConfiguration"])
+', '2026-02-09 16:32:22.626343', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (83, 'Suspicious Process Tree Analysis', 3, 3, 1, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects suspicious process tree patterns identified by SentinelOne, including unusual parent-child relationships, process hollowing, and malicious process chains commonly used in attacks.
+
+Next Steps:
+1. Review the process tree details in the SentinelOne console to understand the parent-child relationships
+2. Identify the affected host from log.syslogHost and the user account from log.destinationUser
+3. Check if the process chain is associated with legitimate software or administrative activity
+4. Look for indicators of process injection, hollowing, or other malicious techniques
+5. Investigate other recent process creation events on the same host
+6. If confirmed malicious, isolate the endpoint and terminate the suspicious processes
+7. Review the threat storyline in SentinelOne for full attack context
+8. Collect memory dumps if advanced analysis is required
+', '["https://attack.mitre.org/techniques/T1055/","https://attack.mitre.org/techniques/T1057/"]', '(contains("log.eventDescription", ["process tree", "parent", "process chain",
+ "process spawn", "suspicious process", "abnormal process", "process anomaly"]) ||
+ contains("log.threatName", ["process", "injection", "hollow"]) ||
+ contains("log.mitigationMode", "process")) &&
+exists("log.syslogHost")
+', '2026-02-09 16:29:51.656042', true, false, 'origin', null, '[]', '["lastEvent.log.syslogHost","lastEvent.log.threatId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (84, 'SentinelOne Suspicious Script Execution Detected', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects suspicious script execution activities including PowerShell, Python, Bash, or other scripting interpreters that may indicate malicious activity or fileless attacks. SentinelOne''s behavioral detection engine identifies these patterns as potential threats that could compromise system integrity.
+
+Next Steps:
+1. Review the specific script or command that triggered the alert in the SentinelOne console
+2. Check if the script execution is authorized and part of normal operations
+3. Investigate the process tree to understand the parent process and execution chain
+4. Look for encoded or obfuscated commands within the script content
+5. Check for persistence mechanisms or scheduled tasks created by the script
+6. Review network connections initiated by the script process
+7. If confirmed malicious, isolate the affected endpoint and perform threat hunting across the environment
+', '["https://www.sentinelone.com/platform/singularity-cloud-workload-security/","https://attack.mitre.org/techniques/T1059/"]', 'exists("log.eventDescription") &&
+(
+ contains("log.eventDescription", ["malicious script", "suspicious script", "fileless attack", "suspicious process"]) ||
+ (contains("log.eventDescription", ["powershell", "cmd.exe", "bash", "python", "wscript", "cscript"]) &&
+ contains("log.eventDescription", ["encoded", "obfuscated", "download", "bypass", "invoke", "hidden", "base64", "exploit"]))
+) &&
+exists("log.endpointDeviceName")
+', '2026-02-09 16:29:51.810914', true, false, 'origin', null, '[]', '["lastEvent.log.endpointDeviceName","lastEvent.log.eventDescription"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (85, 'Threat Intelligence Matches', 2, 2, 2, 'Execution', 'T1203 - Exploitation for Client Execution', 'Detects matches against threat intelligence feeds including known malicious hashes, IPs, domains, and behavioral patterns associated with APT groups and cybercrime campaigns. This indicates that SentinelOne has identified a file, behavior, or network connection that matches known threat indicators.
+
+Next Steps:
+1. Immediately isolate the affected endpoint to prevent lateral movement
+2. Review the threat intelligence match details to understand the specific indicator that was matched
+3. Check if the same hash or threat indicator has been seen on other endpoints
+4. Investigate the process tree and parent processes that led to this detection
+5. Review network connections from the affected host for potential C2 communications
+6. If a file hash match, search for the same hash across all endpoints
+7. Contact threat intelligence team for additional context on the matched indicator
+8. Preserve forensic evidence before remediation
+9. Review file reputation scores and threat classification details
+10. Analyze the timeline of events leading to the threat intelligence match
+11. Check for any related indicators of compromise (IoCs) in the environment
+12. Verify if this is a false positive by cross-referencing with other security tools
+', '["https://www.sentinelone.com/blog/decrypting-sentinelone-cloud-detection-the-threat-intelligence-engine-in-real-time-cwpp/","https://attack.mitre.org/techniques/T1203/"]', 'exists("log.externalthreatvalue") || (exists("log.filecontenthash") && greaterOrEqual("log.confidencelevel", 90)) || contains("log.dveventtype", "threat_intel") || contains("log.eventDescription", "reputation")', '2026-02-09 16:29:51.946540', true, false, 'origin', null, '[]', '["lastEvent.log.externalthreatvalue","lastEvent.log.filecontenthash","lastEvent.log.syslogHost"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (86, 'SentinelOne Threat Mitigation Failures', 2, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects failed threat mitigation attempts in SentinelOne, which could indicate advanced malware evading remediation, system compromise preventing cleanup, or configuration issues. Failed mitigations require immediate investigation.
+
+Next Steps:
+1. Immediately isolate the affected endpoint to prevent potential spread
+2. Review the specific threat details and mitigation failure reason in SentinelOne console
+3. Check if the agent has the latest version and policies are up to date
+4. Verify system integrity - check for rootkits or system-level compromise
+5. Consider manual remediation using SentinelOne''s threat hunting capabilities
+6. If persistent failures occur, engage incident response team for deep forensic analysis
+7. Document the threat indicators for future detection improvements
+', '["https://support.sentinelone.com/hc/en-us/articles/360004195934-Threat-Mitigation-Status","https://attack.mitre.org/techniques/T1562/"]', '(contains("log.eventDescription", "mitigation") && contains("log.eventDescription", "fail")) ||
+(contains("log.eventDescription", "remediation") && contains("log.eventDescription", "fail")) ||
+contains("log.mitigationStatus", "fail") ||
+equals("log.threatStatus", "mitigation_failed") ||
+(equals("log.activityType", "mitigation") && equals("log.status", "failed"))
+', '2026-02-09 16:29:52.081163', true, false, 'origin', null, '[]', '["lastEvent.log.agentId","lastEvent.log.threatId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (100, 'Meraki IDS High Priority Intrusion Alert', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects high and medium priority intrusion detection alerts from Meraki IDS/IPS system. These alerts indicate potential exploitation attempts, malicious traffic patterns, or known attack signatures detected by the Snort engine.
+
+Next Steps:
+1. Review the specific signature that triggered the alert and assess its severity
+2. Investigate the source IP for additional malicious activity or reputation
+3. Check if the destination system shows signs of compromise
+4. Verify if this is part of a larger attack campaign by correlating with other security events
+5. Consider blocking the source IP if confirmed malicious
+6. Review firewall rules and IPS signatures for potential tuning
+7. Document the incident and update threat intelligence feeds if applicable
+', '["https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples","https://attack.mitre.org/techniques/T1190/"]', 'equals("log.eventType", "security_event") &&
+equals("log.alertType", "ids_alerted") &&
+lessOrEqual("log.priority", 2) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:30:30.231345', true, false, 'origin', null, '[]', '["lastEvent.log.signature","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (87, 'Botnet Command and Control Traffic Detected', 3, 2, 1, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects botnet command and control traffic identified by Cisco ASA''s dynamic filter/botnet database. Message IDs 338001-338002 indicate blacklisted traffic from/to malicious addresses. This could indicate compromised hosts communicating with known botnet infrastructure.
+
+Next Steps:
+1. Immediately isolate the affected host(s) to prevent further communication with C2 infrastructure
+2. Review the source IP address (origin.ip) to identify the compromised internal host
+3. Check the destination IP/domain against threat intelligence sources to confirm malicious nature
+4. Examine other logs from the affected host for signs of initial compromise or lateral movement
+5. Run full antivirus/anti-malware scans on the affected system
+6. Review DNS logs for additional suspicious queries from the same host
+7. Check for any data exfiltration attempts or unusual outbound traffic patterns
+8. Consider reimaging the affected system if compromise is confirmed
+', '["https://www.cisco.com/c/en/us/td/docs/security/asa/special/botnet/asa-botnet.pdf","https://attack.mitre.org/techniques/T1071/"]', 'oneOf("log.messageId", ["338001", "338002"])
+|| regexMatch("log.message", "botnet.*(detected|blocked|dropped)")
+|| contains("log.message", "dynamic filter blacklisted")
+|| contains("log.message", "malicious address")
+', '2026-02-09 16:30:28.066072', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (88, 'IPS Signature Match - Malicious Pattern Detected', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects when ASA IPS features identify malicious patterns in network traffic. Message ID 108003 indicates ESMTP/SMTP connections terminated due to malicious patterns. Also monitors for general IPS/IDS signature matches and threat intelligence hits.
+
+Next Steps:
+1. Review the specific IPS signature that was triggered and understand its severity
+2. Investigate the source IP address for reputation and previous malicious activity
+3. Check if the target system shows any signs of compromise
+4. Review firewall logs for any successful connections from the same source
+5. Consider blocking the source IP if multiple signatures are triggered
+6. Verify that IPS signatures are up-to-date
+7. Document the incident and any actions taken
+', '["https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html","https://attack.mitre.org/techniques/T1190/"]', 'equals("log.messageId", "108003")
+|| (contains("log.message", "malicious pattern") && contains("log.message", ["detected", "terminated", "blocked"]))
+|| (contains("log.message", "IPS") && contains("log.message", "signature") && contains("log.message", ["matched", "triggered", "detected"]))
+|| oneOf("log.action", ["ips_alert", "ids_alert", "threat_detected"])
+', '2026-02-09 16:30:28.342799', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-cisco-asa-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (89, 'ARP Poisoning Attack Detection', 3, 3, 2, 'Credential Access, Collection', 'T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning', 'Detects potential ARP poisoning attacks by monitoring for invalid ARP packets, DHCP snooping violations, and gratuitous ARP abuse. These attacks can enable man-in-the-middle attacks by corrupting the ARP cache of network devices and redirecting network traffic through an attacker-controlled system.
+
+Next Steps:
+1. Identify the source MAC and IP addresses involved in the suspicious ARP activity
+2. Check if the source device is authorized to be on the network segment
+3. Review DHCP snooping and dynamic ARP inspection logs for additional violations
+4. Verify if legitimate network changes (new devices, IP changes) may have triggered the alert
+5. If confirmed malicious, immediately isolate the affected switch port and investigate the compromised device
+6. Review network traffic for signs of data interception, credential harvesting, or traffic redirection
+7. Update switch security configurations (enable port security, DHCP snooping, DAI if not already enabled)
+8. Consider implementing additional network segmentation to limit attack impact
+', '["https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/dynarp.html","https://attack.mitre.org/techniques/T1557/002/"]', '(equals("log.facility", "SW_DAI") && oneOf("log.facilityMnemonic", ["INVALID_ARP", "DHCP_SNOOPING_DENY", "ACL_DENY"]))
+|| (equals("log.facility", "IP") && oneOf("log.facilityMnemonic", ["DUPADDR", "SOURCEGUARD"]))
+|| contains("log.message", ["invalid arp", "arp inspection drop", "dhcp snooping deny", "gratuitous arp", "arp reply not request", "duplicate ip address", "IP source guard deny", "arp packet validation failed"])
+|| (lessOrEqual("log.severity", 3) && contains("log.message", ["arp spoofing", "arp poison", "man in the middle"]))
+', '2026-02-09 16:30:28.510824', true, false, 'origin', null, '[{"indexPattern":"v11-log-cisco-switch-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-10m","count":5}]', '["adversary.ip","adversary.mac"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (90, 'MAC Address Spoofing Detection', 2, 3, 1, 'Initial Access', 'MAC Spoofing', 'Detects potential MAC address spoofing attempts by monitoring for MAC address flapping between ports, duplicate MAC addresses, or MAC addresses appearing on unexpected ports. This could indicate an attacker attempting to impersonate legitimate devices.
+
+Next Steps:
+1. Identify the affected MAC address and ports involved in the flapping
+2. Check if the MAC address belongs to a legitimate device that may be moving between ports
+3. Review switch logs for any unauthorized configuration changes
+4. Verify if port security or dynamic ARP inspection is properly configured
+5. Investigate the source device and check for signs of ARP spoofing tools
+6. Consider implementing port security to limit MAC addresses per port
+7. Enable DHCP snooping and dynamic ARP inspection if not already configured
+', '["https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-catl3fixed.html","https://attack.mitre.org/techniques/T1200/"]', '(equals("log.facility", "SW_MATM") && equals("log.facilityMnemonic", "MACFLAP_NOTIF"))
+|| (equals("log.facility", "SW_DAI") && oneOf("log.facilityMnemonic", ["INVALID_ARP", "DHCP_SNOOPING_DENY"]))
+|| regexMatch("log.message", "(?i)(mac.*flap|duplicate.*mac|mac.*move.*between.*port)")
+|| regexMatch("log.message", "(?i)(Host [0-9a-fA-F:.]+.*is flapping between port)")
+|| (lessOrEqual("log.severity", 4) && regexMatch("log.message", "(?i)(mac.*address.*conflict|duplicate.*address.*detected)"))
+', '2026-02-09 16:30:28.645936', true, false, 'origin', null, '[{"indexPattern":"v11-log-cisco-switch-*","with":[{"field":"origin.mac","operator":"filter_term","value":"{{origin.mac}}"}],"or":null,"within":"now-10m","count":3}]', '["adversary.mac"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (112, 'Azure AD Anomalous Token Detection', 3, 2, 1, 'Credential Access', 'T1528 - Steal Application Access Token', 'Detects Azure Identity Protection alerts for anomalous tokens with unusual lifetime, unfamiliar locations, or other suspicious properties. These indicate potential token theft or manipulation.
+
+Next Steps:
+1. Review the token properties that triggered the anomaly detection
+2. Check the user''s recent sign-in activity for suspicious patterns
+3. Verify the source IP and device used for the authentication
+4. Check for impossible travel or unfamiliar location patterns
+5. If compromise is suspected, revoke all refresh tokens for the user
+6. Force MFA re-registration if MFA token was compromised
+7. Review conditional access policies for token protection gaps
+', '["https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks","https://attack.mitre.org/techniques/T1528/"]', 'contains("log.operationName", "Anomalous Token") ||
+(contains("log.properties", "riskEventType") && contains("log.properties", "anomalousToken"))
+', '2026-02-09 16:31:14.845619', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (91, 'Multiple Failed VPN Authentication Attempts', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects multiple failed VPN authentication attempts from the same source IP address, which could indicate a brute force attack or password guessing attempt against VPN credentials.
+
+Next Steps:
+- Review the source IP address and check if it is known or authorized
+- Check for successful authentication attempts from the same IP after failed attempts
+- Verify if the targeted user accounts exist and are active
+- Consider temporarily blocking the source IP if attack continues
+- Review VPN access logs for any unusual patterns or other indicators
+- Contact the user if the IP is associated with a legitimate user to verify activity
+', '["https://attack.mitre.org/techniques/T1110/","https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html"]', '(equals("log.messageId", "113015") ||
+ equals("log.messageId", "113021") ||
+ equals("log.messageId", "109034") ||
+ equals("log.messageId", "611102")) &&
+exists("origin.ip") &&
+(regexMatch("log.reason", "(?i)(invalid|failed|rejected|authentication)") ||
+ regexMatch("log.message", "(?i)(authentication.*failed|invalid.*password)"))
+', '2026-02-09 16:30:28.806480', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-cisco-asa-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.messageId","operator":"filter_term","value":"113015"}],"or":[{"indexPattern":"v11-log-firewall-cisco-asa-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.messageId","operator":"filter_term","value":"113021"}],"or":null,"within":"now-15m","count":10},{"indexPattern":"v11-log-firewall-cisco-asa-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.messageId","operator":"filter_term","value":"109034"}],"or":null,"within":"now-15m","count":10},{"indexPattern":"v11-log-firewall-cisco-asa-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.messageId","operator":"filter_term","value":"611102"}],"or":null,"within":"now-15m","count":10}],"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (92, 'VLAN Hopping Attack Detection', 3, 3, 2, 'Defense Evasion', 'T1599 - Network Boundary Bridging', 'Detects potential VLAN hopping attacks through switch spoofing or double tagging. Monitors for DTP negotiation attempts, trunk port changes, or multiple VLAN tags that could indicate an attacker trying to gain unauthorized access to other VLANs.
+
+Next Steps:
+1. Immediately identify the affected switch port and connected device
+2. Review switch configuration for DTP enabled ports and disable where not needed
+3. Check trunk port configurations and ensure proper native VLAN settings
+4. Verify VLAN access lists and ensure proper segmentation
+5. Investigate the source MAC address for any previous suspicious activity
+6. Review network topology to assess potential lateral movement paths
+7. Consider implementing VLAN ACLs or private VLANs for additional protection
+8. Document the incident and update switch hardening procedures
+', '["https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-catl3fixed.html","https://attack.mitre.org/techniques/T1599/"]', '(equals("log.facility", "SW_VLAN") && oneOf("log.facilityMnemonic", ["VLAN_INCONSISTENCY", "MACFLAP_NOTIF", "TRUNK_MODE_CHANGE"]))
+|| (equals("log.facility", "DTP") && oneOf("log.facilityMnemonic", ["NONTRUNKPORTON", "DOMAINMISMATCH", "TRUNKPORTON"]))
+|| regexMatch("log.message", "(?i)(received 802.1Q BPDU on non trunk|native vlan mismatch|inconsistent vlan|double tag)")
+|| (lessOrEqual("log.severity", 4) && regexMatch("log.message", "(?i)(vlan.*tag.*tag|switch.*spoofing|dtp.*negotiation)"))
+', '2026-02-09 16:30:29.021128', true, false, 'origin', null, '[]', '["adversary.ip","adversary.mac"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (93, 'Advanced Malware Protection (AMP) Alert Detection', 3, 3, 2, 'Initial Access', 'T1566 - Phishing', 'Detects when Cisco Firepower Advanced Malware Protection (AMP) identifies malware or malicious files, including retrospective detections and high threat score files. This rule triggers on various malware dispositions including confirmed malware, custom detections, retrospective malware (files later identified as malicious), and files with high threat scores (>=70).
+
+Next Steps:
+1. Identify the affected host using the origin.ip and log.deviceName fields
+2. Review the file hash (log.sha256) in threat intelligence databases
+3. Check if the malware was successfully blocked or if remediation is needed
+4. Look for lateral movement attempts from the affected host
+5. Verify if other hosts accessed the same malicious file
+6. Consider isolating the affected system if malware execution is confirmed
+7. Review the file trajectory to understand the infection vector
+8. Update endpoint protection rules to prevent similar infections
+', '["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/file_malware_events_and_network_file_trajectory.html","https://attack.mitre.org/techniques/T1566/"]', 'equals("log.eventType", "MALWARE_EVENT") &&
+(equals("log.disposition", "MALWARE") ||
+ equals("log.disposition", "CUSTOM_DETECTION") ||
+ equals("log.disposition", "RETROSPECTIVE_MALWARE") ||
+ greaterOrEqual("log.threatScore", 70))
+', '2026-02-09 16:30:29.155770', true, false, 'origin', null, '[]', '["lastEvent.log.sha256","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (94, 'Intrusion Prevention System High Priority Events', 3, 3, 3, 'Execution', 'T1203 - Exploitation for Client Execution', 'Detects high priority IPS events from Cisco Firepower indicating potential exploitation attempts, zero-day attacks, or critical vulnerabilities being targeted. These events represent immediate threats that require urgent investigation.
+
+Next Steps:
+1. Immediately isolate the affected system if the attack was successful
+2. Review the specific signature ID and classification to understand the attack vector
+3. Check if the target system shows signs of compromise (unusual processes, network connections, file modifications)
+4. Analyze firewall logs to determine if the attack was blocked or if any malicious traffic passed through
+5. Search for similar attempts from the same source IP across other systems
+6. Update IPS signatures and ensure all systems are patched against the exploited vulnerability
+7. Consider blocking the source IP if it shows persistent malicious behavior
+8. Document the incident and update security controls based on findings
+', '["https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/intrusion-overview.html","https://attack.mitre.org/techniques/T1203/"]', 'equals("log.eventType", "IPS_EVENT") &&
+(equals("log.priority", 1) ||
+ lessOrEqual("log.severity", 2) ||
+ equals("log.impact", "HIGH") ||
+ contains("log.classification", "attempted-admin") ||
+ contains("log.classification", "attempted-user") ||
+ contains("log.classification", "web-application-attack") ||
+ contains("log.classification", "exploit-kit"))
+', '2026-02-09 16:30:29.271077', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (101, 'Meraki Client VPN Brute Force Attempts', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects multiple failed client VPN authentication attempts from the same source IP on Meraki MX appliances, indicating potential brute force attacks against VPN credentials.
+
+Next Steps:
+1. Review the source IP address and check geographic location
+2. Verify if the targeted user account exists and is active
+3. Check for any successful VPN connections from the same IP
+4. Consider blocking the source IP at the MX appliance
+5. Review VPN authentication settings and ensure MFA is enabled
+6. Notify the targeted user if the account is legitimate
+', '["https://documentation.meraki.com/MX/Client_VPN/Client_VPN_Overview","https://attack.mitre.org/techniques/T1110/"]', '(oneOf("log.eventType", ["vpn_auth_failure", "client_vpn_auth_failure"]) ||
+ (contains("log.message", "VPN") && contains("log.message", ["auth fail", "authentication failed", "invalid credentials"]))) &&
+exists("origin.ip")
+', '2026-02-09 16:30:30.391049', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-meraki-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (95, 'Firepower IOC (Indicator of Compromise) Detection', 3, 3, 2, 'Initial Access', 'T1566 - Phishing', 'Detects when Firepower identifies an Indicator of Compromise (IOC), indicating a host may be infected with malware or compromised. IOCs can include file hashes, malware signatures, or behavioral patterns that suggest malicious activity.
+
+Next Steps:
+1. Immediately isolate the affected host from the network to prevent lateral movement
+2. Review the specific IOC details including threat name, SHA256 hash, and file path
+3. Search for the same IOC across other endpoints in your environment
+4. Check if the affected host has made any suspicious network connections recently
+5. Collect memory dumps and disk images for forensic analysis if required
+6. Review user activity logs to identify potential initial compromise vector
+7. Update antivirus signatures and threat intelligence feeds with new IOC data
+8. Perform deep scan of the affected system and related network segments
+9. Consider reimaging the affected system after complete evidence collection
+10. Update security controls to prevent similar future compromises
+', '["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/file_malware_events_and_network_file_trajectory.html","https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1566/"]', '(equals("log.eventType", "AMP_IOC") || equals("log.eventType", "IOC_DETECTED") || contains("log.message", "indication of compromise") || contains("log.message", "IOC")) && exists("origin.ip") && (exists("log.threatName") || exists("log.sha256") || exists("log.fileName"))', '2026-02-09 16:30:29.425739', true, false, 'origin', null, '[]', '["adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (96, 'Threat Intelligence Director (TID) Alert Detection', 3, 3, 2, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects when Cisco Firepower Threat Intelligence Director identifies connections to known malicious indicators including IPs, domains, URLs, and SHA256 hashes from threat feeds. This rule triggers when TID blocks or would block connections based on threat intelligence matches with high confidence scores.
+
+Next Steps:
+- Immediately isolate the affected system if the connection was not blocked
+- Review the specific threat indicator (IP/domain/URL/hash) that triggered the alert
+- Check the threat category and score to understand the severity
+- Investigate all recent network activity from the source IP address
+- Search for similar indicators across other systems in the network
+- Review endpoint logs for signs of malware or suspicious processes
+- If a file hash triggered the alert, locate and quarantine the file
+- Check if other systems have communicated with the same malicious indicator
+- Update firewall rules to ensure the indicator is blocked network-wide
+- Report the incident to the security team for further investigation
+', '["https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/tid_overview.html","https://attack.mitre.org/techniques/T1071/"]', 'equals("log.eventType", "TID_EVENT") &&
+(equals("log.action", "BLOCK") ||
+ equals("log.action", "WOULD_BLOCK") ||
+ exists("log.tidIndicatorType")) &&
+(exists("log.tidCategory") ||
+ greaterOrEqual("log.threatScore", 80))
+', '2026-02-09 16:30:29.586003', true, false, 'origin', null, '[]', '["lastEvent.log.tidIndicator","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (97, 'Command and Control on Non-Standard Ports', 3, 2, 1, 'Command and Control', 'T1571 - Non-Standard Port', 'Detects connections on non-standard ports that may indicate command and control (C2) communication. Identifies HTTP traffic on non-HTTP ports, encrypted traffic on unexpected ports, and application protocol mismatches detected by Firepower''s application identification engine.
+
+Next Steps:
+1. Investigate the internal host initiating the suspicious connection
+2. Review the destination IP against threat intelligence feeds
+3. Analyze the application identification results for protocol anomalies
+4. Check if the destination port is commonly used for C2 frameworks
+5. Examine the connection duration and data transfer patterns
+6. Consider blocking the destination IP and scanning the internal host
+', '["https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/connection-log-fields.html","https://attack.mitre.org/techniques/T1571/"]', 'exists("log.appProto") &&
+exists("origin.ip") &&
+exists("target.ip") &&
+((contains("log.appProto", "HTTP") && !oneOf("target.port", [80, 443, 8080, 8443, 8000, 8888])) ||
+ (contains("log.appProto", "SSL") && !oneOf("target.port", [443, 8443, 993, 995, 465, 636])) ||
+ equals("log.appProto", "unknown-tcp")) &&
+equals("log.initiatorPackets", true)
+', '2026-02-09 16:30:29.766810', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-cisco-firepower-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-1h","count":5}]', '["adversary.ip","target.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (98, 'Meraki Advanced Malware Protection Alert', 3, 3, 2, 'Execution', 'T1204.002 - User Execution: Malicious File', 'Detects when Meraki Advanced Malware Protection (AMP) identifies malicious files being downloaded or executed on the network. This includes retrospective alerts where files previously considered safe are later identified as malicious.
+
+Next Steps:
+1. Immediately isolate the affected system(s) from the network to prevent lateral movement
+2. Review the malware details including file hash, name, and threat severity in the Meraki dashboard
+3. Check if the malicious file was executed or only downloaded
+4. Scan other systems for the same file hash to identify additional infections
+5. Review network traffic logs from the affected IP for suspicious communications
+6. If file was executed, perform full system scan and consider reimaging the affected device
+7. Update endpoint protection signatures and ensure all systems are patched
+8. Document the incident and update security policies if needed
+', '["https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Advanced_Malware_Protection_(AMP)","https://attack.mitre.org/techniques/T1204/002/"]', 'equals("log.eventType", "security_event") &&
+(contains("log.message", "malware") ||
+ contains("log.message", "AMP") ||
+ contains("log.message", "malicious") ||
+ equals("log.action", "malware_blocked") ||
+ contains("log.eventName", "Advanced Malware Protection")) &&
+exists("origin.ip")
+', '2026-02-09 16:30:29.926286', true, false, 'origin', null, '[]', '["adversary.hostname","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (99, 'Air Marshal Rogue Access Point Detection', 3, 3, 2, 'Initial Access', 'T1200 - Hardware Additions', 'Detects when Meraki Air Marshal identifies rogue access points or unauthorized SSIDs in the wireless environment. This could indicate malicious wireless infrastructure attempting to intercept traffic or perform man-in-the-middle attacks.
+
+Next Steps:
+1. Verify if the detected BSSID and SSID are known legitimate access points that may not be properly registered
+2. Check the RSSI value to determine proximity - higher values indicate the rogue AP is closer to your infrastructure
+3. Use wireless scanning tools to physically locate the rogue access point using the BSSID
+4. Review network traffic logs for any suspicious connections to unknown wireless networks
+5. Check if any sensitive data might have been exposed through connections to the rogue AP
+6. Consider implementing MAC address filtering or 802.1X authentication to prevent unauthorized connections
+7. Document the incident and update the wireless security policy if needed
+', '["https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal","https://attack.mitre.org/techniques/T1200/"]', 'equals("log.eventType", "airmarshal_events") &&
+equals("log.type", "rogue_ssid_detected") &&
+exists("log.bssid") &&
+greaterOrEqual("log.rssi", -50)
+', '2026-02-09 16:30:30.091477', true, false, 'origin', null, '[]', '["adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (102, 'Evil Twin Access Point Detection', 3, 3, 1, 'Wireless Security', 'T1557 - Adversary-in-the-Middle', 'Detects evil twin attacks where a rogue access point mimics a legitimate corporate SSID to intercept wireless traffic. Meraki Air Marshal identifies spoofed SSIDs that match corporate network names but originate from unauthorized hardware.
+
+Next Steps:
+1. Verify the detected SSID against authorized access point inventory
+2. Check the BSSID (MAC address) against known Meraki access points
+3. Use Air Marshal containment features to prevent client connections
+4. Physically locate the rogue AP using signal strength triangulation
+5. Check if any clients have connected to the rogue AP
+6. Review network traffic from affected clients for signs of credential theft
+', '["https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal","https://attack.mitre.org/techniques/T1557/"]', 'equals("log.eventType", "airmarshal_events") &&
+(equals("log.type", "ssid_spoofing") ||
+ equals("log.type", "rogue_ssid_detected") ||
+ (contains("log.message", "SSID Spoofing") || contains("log.message", "Evil Twin"))) &&
+exists("log.bssid")
+', '2026-02-09 16:30:30.561264', true, false, 'origin', null, '[]', '["lastEvent.log.bssid","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (103, 'Rogue SSID Detection', 3, 3, 2, 'Initial Access', 'T1200 - Hardware Additions', 'Detects when a rogue SSID is identified in the wireless environment. This could indicate an evil twin attack or unauthorized access point deployment attempting to intercept wireless traffic or credentials.
+
+Next Steps:
+1. Immediately investigate the rogue access point''s physical location using the MAC address
+2. Check if the rogue SSID name matches legitimate corporate SSIDs (potential evil twin attack)
+3. Verify if the rogue AP is broadcasting from an unauthorized location
+4. Review wireless client connection logs for any devices that may have connected to the rogue SSID
+5. Consider performing a physical sweep of the area to locate and remove the unauthorized device
+6. Update wireless intrusion detection policies if needed
+7. Notify security team and facilities management for potential physical security breach
+', '["https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples","https://attack.mitre.org/techniques/T1200/"]', 'equals("log.eventType", "rogue_ssid_detected") ||
+(equals("log.type", "airmarshal_events") &&
+ equals("log.subtype", "rogue_ssid_detected")) ||
+(contains("log.message", "rogue") &&
+ contains("log.message", "SSID"))
+', '2026-02-09 16:30:30.715429', true, false, 'origin', null, '[]', '["adversary.mac"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (104, 'Wireless Intrusion Attempts', 3, 3, 2, 'Reconnaissance', 'T1595.002 - Active Scanning: Vulnerability Scanning', 'Detects wireless intrusion attempts including deauthentication attacks, association floods, and other wireless-specific attack patterns that could compromise the wireless network integrity.
+
+Next Steps:
+1. Review the wireless access point logs for the affected device
+2. Identify the source MAC address and physical location if possible
+3. Check for unauthorized devices or rogue access points in the vicinity
+4. Verify wireless security configurations and update if necessary
+5. Consider implementing additional wireless monitoring and detection capabilities
+6. Document the incident and update security policies if needed
+', '["https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples","https://attack.mitre.org/techniques/T1595/002/"]', 'equals("log.eventType", "wids_alerted") ||
+(equals("log.type", "airmarshal_events") &&
+ (contains("log.subtype", "attack") ||
+ contains("log.subtype", "flood") ||
+ contains("log.subtype", "deauth"))) ||
+(contains("log.message", "deauthentication attack") ||
+ contains("log.message", "association flood") ||
+ contains("log.message", "wireless intrusion"))
+', '2026-02-09 16:30:30.871093', true, false, 'origin', '["adversary.ip","target.mac"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (105, 'Azure AKS Container Security Threat Detection', 3, 3, 2, 'Execution', 'T1610 - Deploy Container', 'Detects suspicious container operations in Azure Kubernetes Service (AKS) including privileged pod creation, container exec commands, and potential container escape attempts. These activities may indicate an attacker attempting to deploy malicious workloads or escape container isolation.
+
+Next Steps:
+1. Review the Kubernetes audit logs for the specific pod or container operation
+2. Check if the container image is from an approved registry
+3. Verify the service account and RBAC permissions used for the operation
+4. Examine pod security context for privileged flags, host network, or host PID access
+5. Review the container command for suspicious payloads or reverse shells
+6. If unauthorized, delete the pod and investigate the cluster for further compromise
+7. Implement Azure Policy for AKS to enforce pod security standards
+8. Enable Microsoft Defender for Containers for runtime protection
+', '["https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction","https://attack.mitre.org/techniques/T1610/"]', '(contains("log.operationName", "Microsoft.ContainerService") ||
+ contains("log.operationName", "MICROSOFT.KUBERNETES")) &&
+(contains("log.operationName", "write") ||
+ contains("log.operationName", "create") ||
+ contains("log.operationName", "exec")) &&
+equals("log.resultType", "Success")
+', '2026-02-09 16:31:13.707278', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.operationName","operator":"filter_match","value":"Container"}],"or":null,"within":"now-30m","count":10}]', '["lastEvent.log.operationName","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (106, 'Azure AD App Registration with High-Privilege API Permissions', 3, 3, 1, 'Persistence', 'T1098.001 - Account Manipulation: Additional Cloud Credentials', 'Detects creation of new Azure AD application registrations which may be used to establish persistence with high-privilege API permissions. Attackers create app registrations with permissions like Mail.ReadWrite, Directory.ReadWrite.All, or RoleManagement.ReadWrite.Directory to maintain access.
+
+Next Steps:
+1. Review the application registration and its requested API permissions
+2. Verify the creator has authorization to register applications
+3. Check if admin consent was granted for the application''s permissions
+4. Review the application''s redirect URIs for suspicious external domains
+5. Examine the application''s credential types (secrets, certificates)
+6. If unauthorized, delete the application registration and revoke any granted consents
+7. Implement app registration policies to restrict who can create applications
+8. Enable admin consent workflow for application permission requests
+', '["https://learn.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals","https://attack.mitre.org/techniques/T1098/001/"]', '(contains("log.operationName", "Add application") ||
+ contains("log.operationName", "Add service principal") ||
+ contains("log.operationName", "Consent to application")) &&
+equals("log.categoryValue", "Administrative")
+', '2026-02-09 16:31:13.876574', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.categoryValue","operator":"filter_term","value":"Administrative"}],"or":null,"within":"now-1h","count":3}]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (107, 'Application Gateway WAF Security Alerts', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects Web Application Firewall alerts from Azure Application Gateway indicating potential web attacks or malicious activity. This rule triggers when WAF blocks or detects suspicious requests that match security rules.
+
+**Next Steps:**
+1. Review the specific WAF rule ID and message details to understand the attack type
+2. Analyze the source IP address for reputation and geographic location
+3. Examine the request URL, headers, and payload for attack indicators
+4. Check for additional requests from the same source IP within the time window
+5. Verify if this is a legitimate application behavior or actual attack attempt
+6. Consider implementing additional WAF rules or IP blocking if confirmed malicious
+7. Review application logs for any successful bypass attempts
+', '["https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs","https://attack.mitre.org/techniques/T1190/"]', '(equals("log.operationName", "ApplicationGatewayFirewallLog") || equals("log.type", "ApplicationGatewayFirewallLog")) &&
+equals("log.action", "Blocked") &&
+exists("log.ruleId")
+', '2026-02-09 16:31:14.041368', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-10m","count":5}]', '["lastEvent.log.ruleId","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (108, 'Azure AD Impossible Travel Sign-In Detection', 3, 2, 1, 'Credential Access', 'T1078 - Valid Accounts', 'Detects Azure AD sign-ins flagged as risky due to impossible travel, anonymous IP usage, or unfamiliar locations. These risk detections indicate potential credential compromise when a user authenticates from geographically impossible locations or through anonymizing services.
+
+Next Steps:
+1. Review the sign-in details including IP addresses and geographic locations
+2. Check if the user employs VPN services that could explain different locations
+3. Verify with the user whether the sign-in attempts are legitimate
+4. Review the risk level and risk detail provided by Azure AD Identity Protection
+5. Check for MFA challenges and their outcomes during the sign-in
+6. If compromised, immediately reset user credentials and revoke active sessions
+7. Enable Conditional Access policies requiring MFA for risky sign-ins
+8. Review Azure AD sign-in logs for other accounts from the same suspicious IPs
+', '["https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks","https://attack.mitre.org/techniques/T1078/"]', 'contains("log.operationName", "Sign-in activity") &&
+(equals("log.properties.riskLevelDuringSignIn", "high") ||
+ equals("log.properties.riskState", "atRisk") ||
+ contains("log.properties.riskEventTypes", "impossibleTravel") ||
+ contains("log.properties.riskEventTypes", "anonymizedIPAddress"))
+', '2026-02-09 16:31:14.200933', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (109, 'Azure Automation Runbook Abuse', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects creation or modification of Azure Automation runbooks which can be abused for code execution with managed identity privileges. Attackers may create runbooks to execute arbitrary code, establish persistence, or perform lateral movement using the automation account''s managed identity.
+
+Next Steps:
+1. Review the runbook content for malicious scripts or commands
+2. Verify the automation account''s managed identity permissions
+3. Check the user creating or modifying the runbook has authorization
+4. Review the runbook schedule for unauthorized execution times
+5. Examine the runbook''s Run As account credentials
+6. If unauthorized, disable the runbook and revoke the automation account''s permissions
+7. Review execution history for already-executed malicious runbooks
+8. Implement RBAC to restrict automation account management
+', '["https://learn.microsoft.com/en-us/azure/automation/automation-runbook-types","https://attack.mitre.org/techniques/T1059/"]', 'contains("log.operationName", "Microsoft.Automation") &&
+(contains("log.operationName", "runbooks/write") ||
+ contains("log.operationName", "runbooks/publish") ||
+ contains("log.operationName", "jobs/write") ||
+ contains("log.operationName", "schedules/write")) &&
+equals("log.resultType", "Success")
+', '2026-02-09 16:31:14.375401', true, false, 'origin', null, '[]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (110, 'Azure AD Password Spray Attack Detection', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects password spray attacks against Azure AD by correlating failed sign-in attempts across multiple usernames from the same source IP within a short time window. Password spraying tries common passwords against many accounts to avoid account lockout thresholds.
+
+Next Steps:
+1. Identify the source IP and check threat intelligence feeds for known malicious sources
+2. Review the list of targeted user accounts for patterns (executives, admins, service accounts)
+3. Check if any of the targeted accounts subsequently had successful logins
+4. Verify that account lockout policies are properly configured
+5. Block the source IP at the network level if confirmed malicious
+6. Enable Azure AD Smart Lockout for brute force protection
+7. Implement Conditional Access policies requiring MFA
+8. Review password policies and enforce complexity requirements
+', '["https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks","https://attack.mitre.org/techniques/T1110/"]', 'contains("log.operationName", "Sign-in activity") &&
+(equals("log.properties.status.errorCode", "50126") ||
+ equals("log.properties.status.errorCode", "50053") ||
+ equals("log.properties.status.errorCode", "50057")) &&
+exists("origin.ip")
+', '2026-02-09 16:31:14.526597', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.properties.status.errorCode","operator":"filter_match","value":"5005"}],"or":null,"within":"now-15m","count":15}]', '["lastEvent.log.operationName","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (111, 'Azure Security Alert Suppression Rule Created', 2, 3, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Detects creation of alert suppression rules in Azure Defender / Microsoft Defender for Cloud. Attackers create suppression rules to hide security alerts generated by their activities.
+
+Next Steps:
+1. Review the suppression rule and what alert types it suppresses
+2. Verify the rule creation was part of an authorized security operations workflow
+3. Check the user identity for legitimate security team membership
+4. Review recent security alerts that may have been suppressed
+5. If unauthorized, delete the suppression rule and review suppressed alerts
+6. Check for other defense evasion activities from the same user
+', '["https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules","https://attack.mitre.org/techniques/T1562/"]', 'regexMatch("log.operationName", "(?i)MICROSOFT\\.SECURITY/ALERTSSUPPRESSIONRULES/WRITE")
+', '2026-02-09 16:31:14.687510', true, false, 'origin', null, '[]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (136, 'Azure Service Principal Credentials Added', 3, 3, 2, 'Persistence', 'T1098.001 - Account Manipulation: Additional Cloud Credentials', 'Detects when new credentials (certificates or secrets) are added to Azure service principals through Azure AD/Entra ID Audit Logs.
+
+**Security Context:**
+Adversaries may add credentials to service principals to maintain persistent access to victim Azure accounts. By hijacking an application with granted permissions through adding rogue secrets or certificates, attackers can access protected data and bypass MFA requirements. This technique is commonly used after initial compromise to establish long-term persistence.
+
+**Detection Logic:**
+This rule monitors AuditLogs for successful "Add service principal" operations, which indicate new credentials being added to service principals. The operation captures both certificate and secret additions.
+
+**Investigation Steps:**
+1. Identify the actor who added the credentials: Check log.propertiesInitiatedBy for the user or service principal
+2. Review the target service principal: Examine log.propertiesTargetResources for the affected service principal name and ID
+3. Verify if the action was authorized: Correlate with change management tickets
+4. Check service principal permissions: Review what resources this service principal can access
+5. Examine recent sign-in activity: Look for unusual authentication patterns using the service principal
+6. Review credential type: Determine if a certificate or secret was added via log.propertiesModifiedProperties
+
+**Recommended Actions:**
+- If unauthorized, immediately revoke the newly added credentials
+- Review and rotate all credentials for the affected service principal
+- Audit all resources accessible by the service principal for signs of compromise
+- Enable alerts for future credential additions to critical service principals
+- Implement conditional access policies and privileged identity management
+
+**MITRE ATT&CK Reference:** T1098.001 - Account Manipulation: Additional Cloud Credentials
+
+**Azure Documentation:**
+- AuditLogs table: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs
+- Service Principal credentials: https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
+', '["https://attack.mitre.org/techniques/T1098/001/","https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs","https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal"]', 'equalsIgnoreCase("log.category", "AuditLogs") &&
+contains("log.operationName", "Add service principal") &&
+(equals("log.resultType", "0") || equalsIgnoreCase("actionResult", "SUCCESS"))
+', '2026-02-09 16:31:18.565801', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (113, 'Azure AD Application Credential Added', 3, 3, 2, 'Persistence', 'T1098.001 - Account Manipulation: Additional Cloud Credentials', 'Detects when new certificates or client secrets are added to Azure AD application registrations. This is the primary Azure AD persistence technique - attackers add credentials to existing apps to maintain access even after password resets.
+
+Next Steps:
+1. Verify the credential addition was authorized by the application owner
+2. Identify the application and its permissions (especially Graph API permissions)
+3. Check the user identity adding the credential for legitimacy
+4. Review the credential type (certificate vs secret) and expiration
+5. Check for subsequent sign-ins using the new application credential
+6. If unauthorized, remove the credential and rotate all app secrets
+7. Review the application''s API permissions for excessive access
+', '["https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal","https://attack.mitre.org/techniques/T1098/001/"]', 'oneOf("log.operationName", ["Add service principal credentials", "Update application - Certificates and secrets management"]) ||
+(contains("log.operationName", "application") && contains("log.properties", "KeyCredentials"))
+', '2026-02-09 16:31:14.980999', true, false, 'origin', null, '[]', '["lastEvent.log.properties.targetResources","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (114, 'Azure AD Privileged App Role Assignment', 3, 3, 2, 'Privilege Escalation', 'T1098.003 - Account Manipulation: Additional Cloud Roles', 'Detects privileged app role assignments to service principals in Azure AD, which is the mechanism used in illicit consent grant attacks. Attackers create or modify applications with high-privilege API permissions to access organizational data.
+
+Next Steps:
+1. Review the application and the specific API permissions granted
+2. Verify the consent was authorized by a legitimate administrator
+3. Check if the application is known and trusted
+4. Review the application publisher and redirect URIs
+5. Check for data access using the application''s permissions
+6. If unauthorized, remove the role assignment and revoke application consent
+7. Review and restrict user consent settings in Azure AD
+', '["https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals","https://attack.mitre.org/techniques/T1098/003/"]', 'contains("log.operationName", "Add app role assignment to service principal") ||
+(contains("log.operationName", "Consent to application") && contains("log.properties", "AppRoleAssignment"))
+', '2026-02-09 16:31:15.125869', true, false, 'origin', null, '[]', '["lastEvent.log.properties.targetResources","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (115, 'AzureHound Reconnaissance Tool Detected', 2, 1, 0, 'Discovery', 'T1087.004 - Account Discovery: Cloud Account', 'Detects AzureHound user agent in Azure AD sign-in logs. AzureHound is the Azure AD data collector for BloodHound, used to enumerate all users, groups, roles, apps, and relationships in the tenant for attack path analysis.
+
+Next Steps:
+1. Identify the user account running AzureHound
+2. Determine if this is an authorized security assessment
+3. Review the scope of data collected (users, groups, roles, apps)
+4. Check for lateral movement or privilege escalation following the enumeration
+5. If unauthorized, revoke the user''s tokens and investigate
+6. Review API permissions that allowed the enumeration
+7. Consider implementing Graph API rate limiting or monitoring
+', '["https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://attack.mitre.org/techniques/T1087/004/"]', 'contains("log.properties", "azurehound") ||
+contains("log.properties", "AzureHound")
+', '2026-02-09 16:31:15.285862', true, false, 'origin', '["adversary.user","adversary.ip"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (116, 'Azure AD Device Code Authentication Flow Detected', 3, 2, 1, 'Initial Access', 'T1078 - Valid Accounts', 'Detects OAuth device code flow authentication in Azure AD. Device code phishing is a growing attack vector where attackers trick users into authenticating on a device the attacker controls, granting the attacker access tokens.
+
+Next Steps:
+1. Verify the device code authentication was initiated by the user on a legitimate device
+2. Check the application requesting the device code for legitimacy
+3. Review the source IP where the token was redeemed
+4. Check for subsequent suspicious activities using the obtained token
+5. If unauthorized, revoke the session and all refresh tokens
+6. Consider blocking device code flow via conditional access policies
+7. Educate users about device code phishing attacks
+', '["https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code","https://attack.mitre.org/techniques/T1078/"]', '(contains("log.properties", "deviceCode") && contains("log.operationName", "Sign-in")) ||
+contains("log.properties", "urn:ietf:params:oauth:grant-type:device_code")
+', '2026-02-09 16:31:15.446209', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (117, 'Azure Disk Snapshot Exfiltration', 3, 2, 1, 'Data Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Detects Azure disk snapshot operations that could be used for data exfiltration, including sharing snapshots across subscriptions, generating SAS URIs for download, or copying snapshots to external storage accounts.
+
+Next Steps:
+1. Identify the disk snapshot and the virtual machine it was taken from
+2. Review the target location or account where the snapshot is being shared
+3. Verify the operator has authorization for cross-subscription snapshot operations
+4. Check if a SAS URI was generated that could allow external download
+5. Review the data sensitivity of the affected virtual machine''s disk
+6. If unauthorized, revoke any generated SAS tokens and delete shared snapshots
+7. Implement Azure Policy to restrict snapshot sharing across subscriptions
+8. Enable diagnostic logging for disk operations
+', '["https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots","https://attack.mitre.org/techniques/T1537/"]', '(contains("log.operationName", "Microsoft.Compute/snapshots") ||
+ contains("log.operationName", "Microsoft.Compute/disks")) &&
+(contains("log.operationName", "beginGetAccess") ||
+ contains("log.operationName", "export")) &&
+equals("log.resultType", "Success")
+', '2026-02-09 16:31:15.591151', true, false, 'origin', null, '[]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (118, 'Azure AD Bulk Privileged Role Assignment Changes', 3, 3, 2, 'Privilege Escalation', 'T1098 - Account Manipulation', 'Detects mass privileged role assignment changes in Azure AD. Multiple role assignments in a short time window indicate an attacker rapidly escalating privileges across multiple accounts for persistence and lateral movement.
+
+Next Steps:
+1. Review all role assignments made in the burst
+2. Identify the admin account making the changes
+3. Check if these changes were part of an approved onboarding or migration
+4. Review the specific roles assigned (Global Admin, Exchange Admin, etc.)
+5. If unauthorized, revert all role assignments and investigate the admin account
+6. Enable Azure PIM for just-in-time role activation
+', '["https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles-assign-roles","https://attack.mitre.org/techniques/T1098/"]', 'contains("log.operationName", "Add member to role") ||
+contains("log.operationName", "Add eligible member to role")
+', '2026-02-09 16:31:15.727148', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (119, 'Azure AD Impossible Travel Sign-In', 3, 2, 1, 'Initial Access', 'T1078 - Valid Accounts', 'Detects Azure Identity Protection impossible travel alerts where a user signs in from geographically distant locations in a timeframe that makes physical travel impossible. This strongly indicates credential theft or session hijacking.
+
+Next Steps:
+1. Contact the user to verify both sign-in locations
+2. Check if a VPN or proxy could explain the geolocation discrepancy
+3. Review the sign-in details (device, browser, app) for both locations
+4. If unauthorized, force password reset and revoke all sessions
+5. Review data access and actions from the suspicious location
+6. Enable location-based conditional access policies
+7. Check for other users with similar patterns from the same locations
+', '["https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks","https://attack.mitre.org/techniques/T1078/"]', 'contains("log.operationName", "Impossible Travel") ||
+(contains("log.properties", "riskEventType") && contains("log.properties", "impossibleTravel"))
+', '2026-02-09 16:31:15.861315', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (120, 'Azure Kubernetes Admission Webhook Modified', 3, 3, 2, 'Persistence', 'T1078.004 - Valid Accounts: Cloud Accounts', 'Detects creation or modification of MutatingAdmissionWebhook or ValidatingAdmissionWebhook configurations in Azure Kubernetes Service. Attackers use admission controllers to inject malicious containers or modify workload specifications.
+
+Next Steps:
+1. Review the webhook configuration and its target service
+2. Verify the webhook was created as part of a legitimate deployment
+3. Check the webhook''s namespace selector and object selector
+4. Examine what resources the webhook intercepts (pods, deployments, etc.)
+5. If unauthorized, delete the webhook and audit all recent pod deployments
+6. Review cluster RBAC for excessive admission controller permissions
+', '["https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/","https://attack.mitre.org/techniques/T1078/004/"]', 'contains("log.operationName", "MICROSOFT.CONTAINERSERVICE") &&
+(contains("log.properties", "MutatingWebhookConfiguration") || contains("log.properties", "ValidatingWebhookConfiguration")) &&
+(contains("log.properties", "create") || contains("log.properties", "update") || contains("log.properties", "patch"))
+', '2026-02-09 16:31:16.010841', true, false, 'origin', null, '[]', '["lastEvent.log.resourceId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (121, 'Azure Kubernetes Secret Write or Delete', 3, 3, 2, 'Credential Access', 'T1552.007 - Unsecured Credentials: Container API', 'Detects write or delete operations on Kubernetes Secrets in Azure Kubernetes Service. Secrets contain sensitive data like service account tokens, TLS certificates, and database credentials. Unauthorized access indicates potential credential theft or data tampering.
+
+Next Steps:
+1. Identify the user or service account accessing the secrets
+2. Review which secrets were accessed, modified, or deleted
+3. Check if the operation was part of a legitimate deployment workflow
+4. Audit the RBAC permissions of the identity performing the action
+5. If unauthorized, rotate all affected secrets immediately
+6. Review pod specifications for secrets mounted as volumes or environment variables
+', '["https://kubernetes.io/docs/concepts/configuration/secret/","https://attack.mitre.org/techniques/T1552/007/"]', 'contains("log.operationName", "MICROSOFT.CONTAINERSERVICE") &&
+contains("log.properties", "secrets") &&
+(contains("log.properties", "create") || contains("log.properties", "update") || contains("log.properties", "delete") || contains("log.properties", "patch"))
+', '2026-02-09 16:31:16.165946', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":5}]', '["lastEvent.log.resourceId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (122, 'Azure Kubernetes Events Deleted', 1, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects deletion of Kubernetes events in Azure Kubernetes Service (AKS). Attackers delete events to cover traces of their activities within the cluster.
+
+Next Steps:
+1. Identify the user or service account that deleted the events
+2. Check for other suspicious Kubernetes operations from the same identity
+3. Review AKS audit logs for activities that occurred before the event deletion
+4. Verify if this was part of a legitimate cluster maintenance operation
+5. If unauthorized, investigate the cluster for signs of compromise
+6. Review RBAC policies to restrict event deletion permissions
+', '["https://learn.microsoft.com/en-us/azure/aks/monitor-aks","https://attack.mitre.org/techniques/T1562/001/"]', 'contains("log.operationName", "MICROSOFT.CONTAINERSERVICE") &&
+(contains("log.properties", "events") && contains("log.properties", "delete"))
+', '2026-02-09 16:31:16.326140', true, false, 'origin', null, '[]', '["lastEvent.log.resourceId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (123, 'Azure AD LAPS Password Recovery', 3, 2, 1, 'Credential Access', 'T1003 - OS Credential Dumping', 'Detects Local Administrator Password Solution (LAPS) password recovery from Entra ID. While LAPS recovery is a legitimate admin operation, excessive or unauthorized recovery attempts indicate credential dumping for lateral movement.
+
+Next Steps:
+1. Verify the user recovering the LAPS password has legitimate need
+2. Check the target device and whether the user is responsible for it
+3. Review the frequency of LAPS password recoveries by this user
+4. Correlate with subsequent RDP or SMB connections to the target device
+5. If unauthorized, rotate the LAPS password and investigate the user''s activities
+6. Review RBAC for LAPS password read permissions
+', '["https://learn.microsoft.com/en-us/entra/identity/devices/howto-manage-local-admin-passwords","https://attack.mitre.org/techniques/T1003/"]', 'contains("log.operationName", "Recover device local administrator password") ||
+(contains("log.operationName", "Read device local administrator password") && exists("log.properties"))
+', '2026-02-09 16:31:16.486258', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":3}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (124, 'Azure AD Federation Settings Modified', 3, 3, 3, 'Credential Access', 'T1556 - Modify Authentication Process', 'Detects modifications to Azure AD domain federation settings. Changing federation configuration is a critical attack technique that enables Golden SAML attacks and domain takeover, allowing attackers to forge authentication tokens for any user.
+
+Next Steps:
+1. Immediately verify the federation modification was authorized
+2. Check the user identity and source IP performing the change
+3. Review the new federation settings for suspicious IdP configurations
+4. Validate the signing certificate in the federation configuration
+5. Check for subsequent sign-ins using federated authentication
+6. If unauthorized, revert the federation changes and investigate all federated sessions
+7. Review all privileged role assignments that occurred after the change
+', '["https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-fed","https://attack.mitre.org/techniques/T1556/"]', 'contains("log.operationName", "Set federation settings on domain") ||
+(contains("log.operationName", "Set domain authentication") && contains("log.properties", "Federated"))
+', '2026-02-09 16:31:16.650983', true, false, 'origin', null, '[]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (125, 'Azure AD Leaked Credentials Detection', 3, 3, 2, 'Credential Access', 'T1078 - Valid Accounts', 'Detects Azure Identity Protection alerts for leaked credentials found on dark web, paste sites, or other sources. This indicates user credentials have been exposed and may be used for unauthorized access.
+
+Next Steps:
+1. Immediately force a password reset for the affected user
+2. Revoke all active sessions and refresh tokens
+3. Review recent sign-in activity for unauthorized access
+4. Check for any data access or configuration changes after the leak
+5. Enable MFA if not already required for the user
+6. Investigate how the credentials were leaked (phishing, malware, reuse)
+7. Check if the same password was used across other services
+', '["https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks","https://attack.mitre.org/techniques/T1078/"]', 'contains("log.operationName", "Leaked Credentials") ||
+(contains("log.properties", "riskEventType") && contains("log.properties", "leakedCredentials"))
+', '2026-02-09 16:31:16.806087', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (126, 'Azure Primary Refresh Token Access Attempt', 3, 3, 1, 'Credential Access', 'T1528 - Steal Application Access Token', 'Detects attempts to access the Primary Refresh Token (PRT) in Azure AD. PRT theft is a high-confidence compromise indicator as PRTs provide SSO access across all Azure AD-integrated applications and can be used to bypass conditional access policies.
+
+Next Steps:
+1. Immediately investigate the user account associated with this alert
+2. Check the device from which the PRT access was attempted
+3. Review sign-in logs for the affected user for anomalous patterns
+4. Check for token replay attacks or sessions from unexpected locations
+5. If compromise is confirmed, revoke all refresh tokens for the user
+6. Re-register the device and force re-authentication
+7. Review conditional access policies for PRT-based bypass vulnerabilities
+', '["https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token","https://attack.mitre.org/techniques/T1528/"]', 'contains("log.operationName", "Primary Refresh Token") ||
+(contains("log.properties", "PRT") && contains("log.properties", "access"))
+', '2026-02-09 16:31:17.045870', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (127, 'Azure AD Resource Owner Password Credentials Flow Detected', 2, 2, 1, 'Credential Access', 'T1078 - Valid Accounts', 'Detects use of the Resource Owner Password Credentials (ROPC) OAuth flow in Azure AD. ROPC sends plain-text credentials directly to the token endpoint, bypassing MFA and conditional access. It is commonly abused by attackers for credential stuffing and automated account compromise.
+
+Next Steps:
+1. Identify the application using ROPC flow and verify its legitimacy
+2. Check if the application has a legitimate need for ROPC (legacy/headless apps)
+3. Review the source IPs making ROPC requests for suspicious patterns
+4. Check for high volumes of failed ROPC requests (credential stuffing)
+5. Migrate the application to a modern auth flow (authorization code, device code)
+6. If unauthorized, block the application and reset affected user passwords
+', '["https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc","https://attack.mitre.org/techniques/T1078/"]', 'contains("log.properties", "urn:ietf:params:oauth:grant-type:password") ||
+(contains("log.operationName", "Sign-in") && contains("log.properties", "ropc"))
+', '2026-02-09 16:31:17.186271', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (128, 'Azure AD Password Spray Attack Detected', 3, 2, 1, 'Credential Access', 'T1110.003 - Brute Force: Password Spraying', 'Detects Azure Identity Protection password spray attack signals. Microsoft''s ML-based detection identifies distributed password spray attempts across multiple accounts using common passwords.
+
+Next Steps:
+1. Identify all affected user accounts in the password spray
+2. Check if any accounts were successfully compromised
+3. Force password resets for all targeted accounts
+4. Review source IPs for known attack infrastructure
+5. Check for successful sign-ins from the same source IPs
+6. Enable smart lockout policies if not already configured
+7. Review MFA enforcement across all targeted accounts
+', '["https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks","https://attack.mitre.org/techniques/T1110/003/"]', 'contains("log.operationName", "Password Spray") ||
+(contains("log.properties", "riskEventType") && contains("log.properties", "passwordSpray"))
+', '2026-02-09 16:31:17.366393', true, false, 'origin', null, '[]', '["lastEvent.log.operationName","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (129, 'Azure Sentinel High/Critical Alert Pattern Detection', 3, 3, 2, 'Threat Detection', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects high-severity or critical alerts from Azure Sentinel that may indicate coordinated attack activity or serious security incidents requiring immediate investigation. This rule identifies new alerts with High or Critical severity levels from Microsoft Sentinel that could represent active threats.
+
+Next Steps:
+1. Review the alert details and affected resources immediately
+2. Correlate with other security events in the environment
+3. Check for signs of lateral movement or privilege escalation
+4. Verify if the alert represents a true positive through manual investigation
+5. Implement containment measures if attack activity is confirmed
+6. Document findings and update incident response procedures
+', '["https://learn.microsoft.com/en-us/azure/sentinel/security-alert-schema","https://attack.mitre.org/techniques/T1562/"]', 'oneOf("log.AlertSeverity", ["High", "Critical"]) &&
+equals("log.VendorName", "Microsoft Sentinel") &&
+equals("log.Status", "New")
+', '2026-02-09 16:31:17.531107', true, false, 'origin', null, '[]', '["lastEvent.log.AlertType","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (130, 'Azure AD New Root Certificate Authority Added', 3, 3, 2, 'Persistence', 'T1556 - Modify Authentication Process', 'Detects when a new root certificate authority is added to the TrustedCAsForPasswordlessAuth configuration in Azure AD. Adding a rogue root CA enables persistent passwordless authentication backdoor access.
+
+Next Steps:
+1. Immediately verify the root CA addition was authorized
+2. Review the certificate details and issuing authority
+3. Check the user identity performing the change
+4. Validate the CA against your organization''s known PKI infrastructure
+5. If unauthorized, remove the root CA immediately
+6. Audit all certificate-based authentications since the CA was added
+7. Review Azure AD authentication methods policies
+', '["https://learn.microsoft.com/en-us/entra/identity/authentication/concept-certificate-based-authentication","https://attack.mitre.org/techniques/T1556/"]', 'contains("log.operationName", "TrustedCAsForPasswordlessAuth") ||
+(contains("log.operationName", "Update organization settings") && contains("log.properties", "certificateAuthorities"))
+', '2026-02-09 16:31:17.685722', true, false, 'origin', null, '[]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (190, 'AWS Configuration Recorder Stopped', 3, 2, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies an AWS configuration change to stop recording a designated set of resources', '["https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/stop-configuration-recorder.html","https://docs.aws.amazon.com/config/latest/APIReference/API_StopConfigurationRecorder.html","https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/"]', 'equals("log.eventSource", "config.amazonaws.com") &&
+equals("log.eventName", "StopConfigurationRecorder")
+', '2026-02-09 16:32:22.765665', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (131, 'Azure AD Temporary Access Pass Registration', 3, 2, 1, 'Credential Access', 'T1078.004 - Valid Accounts: Cloud Accounts', 'Detects registration of Temporary Access Pass (TAP) in Azure AD. TAPs can be used to bypass MFA requirements and are a growing attack vector for initial access and MFA circumvention.
+
+Next Steps:
+1. Verify the TAP was requested through legitimate channels (IT helpdesk)
+2. Check the admin user who created the TAP for legitimacy
+3. Review the target user and reason for TAP issuance
+4. Check for sign-ins using the TAP, especially from unusual locations
+5. Verify MFA registration events following the TAP usage
+6. If unauthorized, revoke the TAP immediately and investigate
+7. Review TAP policy settings for appropriate lifetime and usage limits
+', '["https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass","https://attack.mitre.org/techniques/T1078/004/"]', '(contains("log.operationName", "Admin registered security info") && contains("log.properties", "Temporary Access Pass")) ||
+(contains("log.operationName", "Update user") && contains("log.properties", "TemporaryAccessPass"))
+', '2026-02-09 16:31:17.816412', true, false, 'origin', null, '[]', '["lastEvent.log.properties.targetResources","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (132, 'Azure Key Vault Modified', 3, 3, 2, 'Credential Access', 'T1552 - Unsecured Credentials', 'Identifies modifications to a Key Vault in Azure. The Key Vault is a service that safeguards encryption keys and secrets like certificates, connection strings, and passwords. Because this data is sensitive and business critical, access to key vaults should be secured to allow only authorized applications and users. Adversaries may modify Key Vault configurations to weaken security controls, add unauthorized access policies, or change network rules to facilitate credential theft and unauthorized access to sensitive secrets.', '["https://attack.mitre.org/techniques/T1552/","https://attack.mitre.org/tactics/TA0006/","https://learn.microsoft.com/en-us/azure/key-vault/general/security-features"]', '(equalsIgnoreCase("log.category", "Administrative") || contains("log.category", "Activity")) &&
+(equalsIgnoreCase("log.operationName", "MICROSOFT.KEYVAULT/VAULTS/WRITE") ||
+contains("log.operationName", "Microsoft.KeyVault/vaults/write")) &&
+equals("log.resultType", "0")
+', '2026-02-09 16:31:17.966280', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (133, 'Azure Subscription Permission Elevation via ElevateAccess', 3, 3, 3, 'Privilege Escalation', 'T1078.004 - Valid Accounts: Cloud Accounts', 'Detects the MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION operation which grants a Global Administrator access to ALL Azure subscriptions in the tenant. This is an extremely high-impact action that should be very rare and carefully monitored.
+
+Next Steps:
+1. Immediately verify this action was authorized by a known Global Administrator
+2. Check if a change request or emergency procedure exists for this action
+3. Review what subscription-level changes were made after the elevation
+4. Check for new role assignments at the management group or subscription level
+5. If unauthorized, remove the User Access Administrator role and audit all changes
+6. Enable Azure PIM (Privileged Identity Management) if not already in use
+', '["https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin","https://attack.mitre.org/techniques/T1078/004/"]', 'regexMatch("log.operationName", "(?i)MICROSOFT\\.AUTHORIZATION/ELEVATEACCESS/ACTION")
+', '2026-02-09 16:31:18.095884', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (134, 'Azure Event Hub Deletion', 1, 3, 3, 'Defense Evasion', 'T1562.008 - Impair Defenses: Disable Cloud Logs', 'Detects the deletion of an Azure Event Hub, which is a critical event processing service that ingests and processes large volumes of events, logs, and telemetry data. Event Hubs are commonly used for security monitoring, log aggregation, and SIEM integration. Adversaries may delete Event Hubs to evade detection by disrupting log collection pipelines and preventing security events from reaching monitoring systems.
+
+Threat Context:
+- Event Hubs are often used to stream logs to SIEM solutions
+- Deletion interrupts security monitoring and incident detection capabilities
+- Can be part of anti-forensics activities to cover tracks
+- May indicate an attempt to blind security operations before further attacks
+
+Legitimate Use Cases:
+- Decommissioning unused Event Hubs during cost optimization
+- Infrastructure cleanup during application retirement
+- Migration to new Event Hub namespaces or different logging solutions
+- Testing and development environment cleanup
+
+Suspicious Indicators:
+- Event Hub actively receiving logs suddenly deleted
+- Deletion performed by non-administrative accounts
+- Multiple Event Hubs deleted in quick succession
+- Deletion outside change management windows
+- Deletion from unusual locations or IP addresses
+- Event Hub connected to production SIEM or security monitoring
+
+Next Steps:
+1. Verify if the deletion was authorized via change management process
+2. Identify who performed the deletion (caller) and their role
+3. Check if the Event Hub was actively receiving security logs
+4. Determine the impact on security monitoring and log collection
+5. Review recent authentication activity for the caller account
+6. Check for other suspicious activities in the timeline (diagnostic settings changes, etc.)
+7. Verify if backups of the Event Hub configuration exist
+8. If unauthorized, restore the Event Hub and investigate for account compromise
+9. Review authorization rules and access policies for remaining Event Hubs
+', '["https://attack.mitre.org/techniques/T1562/008/","https://attack.mitre.org/tactics/TA0005/","https://learn.microsoft.com/en-us/azure/event-hubs/monitor-event-hubs","https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log"]', '(equalsIgnoreCase("log.category", "Administrative") || contains("log.category", "Activity")) &&
+(equalsIgnoreCase("log.operationName", "MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE") ||
+contains("log.operationName", "Delete EventHub")) &&
+(equalsIgnoreCase("log.resultType", "0") || equalsIgnoreCase("actionResult", "SUCCESS"))
+', '2026-02-09 16:31:18.250850', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (135, 'Azure Diagnostic Settings Deletion', 1, 3, 3, 'Defense Evasion', 'T1562.008 - Impair Defenses: Disable Cloud Logs', 'Detects the deletion of diagnostic settings in Azure, which are critical for sending platform logs, metrics, and activity data to destinations like Log Analytics workspaces, Event Hubs, or storage accounts. Adversaries delete diagnostic settings to evade detection by disabling security monitoring and audit logging capabilities.
+
+This technique is commonly observed when attackers:
+- Attempt to hide malicious activities from security teams
+- Disable logging before executing destructive operations
+- Remove evidence trails of their presence in the environment
+- Prevent detection of lateral movement or data exfiltration
+
+Legitimate deletions are rare and typically occur only during:
+- Infrastructure decommissioning or major reconfigurations
+- Cost optimization initiatives (but should be heavily scrutinized)
+- Migration to new monitoring solutions
+
+Next Steps:
+1. Immediately verify if the deletion was authorized and documented
+2. Identify who performed the operation and from which IP address
+3. Check if diagnostic settings were immediately recreated (potential test)
+4. Review recent activities on the affected resource for suspicious behavior
+5. Verify if other resources had their diagnostic settings deleted
+6. Restore diagnostic settings immediately to resume monitoring
+7. Investigate the caller''s account for potential compromise
+8. Check for other defense evasion techniques in the timeline
+', '["https://attack.mitre.org/techniques/T1562/008/","https://attack.mitre.org/tactics/TA0005/","https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings","https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log"]', '(equalsIgnoreCase("log.category", "Administrative") || contains("log.category", "Activity")) &&
+(equalsIgnoreCase("log.operationName", "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE") ||
+contains("log.operationName", "Delete diagnostic setting")) &&
+equalsIgnoreCase("log.resultType", "0")
+', '2026-02-09 16:31:18.406489', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (137, 'Azure AD Golden SAML and Federation Domain Abuse', 3, 3, 2, 'Credential Access', 'T1606.002 - Forge Web Credentials: SAML Tokens', 'Detects additions or modifications of federated domains in Azure AD which could indicate Golden SAML attacks. Attackers who compromise AD FS signing certificates or add rogue federation domains can forge SAML tokens to impersonate any user in the organization.
+
+Next Steps:
+1. Immediately verify if the federation domain change was authorized
+2. Review the domain being added and its federation metadata endpoint
+3. Check the AD FS signing certificate for unauthorized modifications
+4. Verify the identity of the administrator making the change
+5. Review Azure AD audit logs for other suspicious tenant-level changes
+6. If unauthorized, immediately remove the federated domain and revoke all active sessions
+7. Rotate the AD FS token signing certificate
+8. Enable Certificate Authority revocation checking for federation certificates
+', '["https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed","https://attack.mitre.org/techniques/T1606/002/"]', '(contains("log.operationName", "Set federation settings on domain") ||
+ contains("log.operationName", "Set domain authentication") ||
+ contains("log.operationName", "Add unverified domain") ||
+ contains("log.operationName", "Add verified domain") ||
+ contains("log.operationName", "Set DomainFederationSettings")) &&
+equals("log.categoryValue", "Administrative")
+', '2026-02-09 16:31:18.721022', true, false, 'origin', null, '[]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (138, 'Azure Active Directory High Risk Sign-in', 3, 3, 2, 'Initial Access', 'T1078 - Valid Accounts', 'Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft''s Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. This rule triggers on ''high'' risk level sign-ins, which indicate strong indicators of compromise such as impossible travel, anonymous IP usage, or leaked credentials.', '["https://attack.mitre.org/techniques/T1078/","https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks","https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"]', 'equalsIgnoreCase("log.category", "SignInLogs") &&
+equalsIgnoreCase("log.properties.RiskLevelDuringSignIn", "high") &&
+equalsIgnoreCase("log.propertiesTokenIssuerType", "AzureAD") &&
+equals("log.resultType", "0")
+', '2026-02-09 16:31:18.861590', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (140, 'Azure Key Vault Excessive Access Detected', 3, 2, 1, 'Collection', 'T1530 - Data from Cloud Storage Object', 'Detects unusual spikes in Azure Key Vault access patterns. Monitors for multiple secret retrieval operations from the same source, which could indicate credential harvesting or data exfiltration attempts.
+
+Next Steps:
+1. Investigate the source IP address and verify if it''s a legitimate system or user
+2. Review the specific secrets/keys being accessed and their criticality
+3. Check for any recent changes to Key Vault access policies
+4. Correlate with user authentication logs to identify the account responsible
+5. Verify if the access pattern aligns with normal business operations
+6. Consider implementing additional access controls or monitoring if suspicious activity is confirmed
+', '["https://learn.microsoft.com/en-us/azure/key-vault/general/logging","https://attack.mitre.org/techniques/T1530/"]', 'equals("log.category", "AuditEvent") &&
+oneOf("log.operationName", ["SecretGet", "SecretList", "KeyGet"])
+', '2026-02-09 16:31:19.397260', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.category","operator":"filter_term","value":"AuditEvent"}],"or":null,"within":"now-10m","count":20}]', '["lastEvent.log.resourceId","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (141, 'MFA Disabled for Privileged Azure AD User', 3, 3, 1, 'Defense Evasion', 'T1556 - Modify Authentication Process', 'Detects when Multi-Factor Authentication (MFA) is disabled for privileged users in Azure AD. This could indicate an attempt to weaken security controls for unauthorized access.
+
+Next Steps:
+1. Verify if the MFA disable action was authorized and legitimate
+2. Check who initiated the change and from which IP address
+3. Review the user''s recent login activity and permissions
+4. Ensure the user account has not been compromised
+5. Re-enable MFA if the change was unauthorized
+6. Consider implementing conditional access policies to prevent unauthorized MFA changes
+', '["https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-reporting","https://attack.mitre.org/techniques/T1556/"]', '(equals("log.operationName", "Disable Strong Authentication") ||
+ (equals("log.operationName", "Update user") && contains("log.properties", "StrongAuthenticationMethod"))) &&
+equals("log.categoryValue", "Administrative")
+', '2026-02-09 16:31:19.526659', true, false, 'origin', null, '[]', '["lastEvent.log.correlationId","lastEvent.log.targetUserPrincipalName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (142, 'Azure Managed Identity Token Abuse', 3, 3, 1, 'Credential Access', 'T1078.004 - Valid Accounts: Cloud Accounts', 'Detects suspicious token acquisition from Azure Instance Metadata Service (IMDS) by managed identities. Attackers who compromise an Azure VM can abuse managed identities to obtain access tokens for Azure resources without credentials, enabling lateral movement across the cloud environment.
+
+Next Steps:
+1. Identify the Azure resource (VM, App Service, Function) where the token was acquired
+2. Review the target resource being accessed with the managed identity token
+3. Check if the managed identity''s permissions follow least privilege principles
+4. Investigate the process or application that requested the token
+5. Review Azure Activity logs for actions performed using the managed identity
+6. If unauthorized, restrict the managed identity''s role assignments immediately
+7. Investigate the source VM for signs of compromise
+8. Implement Conditional Access policies for workload identities
+', '["https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview","https://attack.mitre.org/techniques/T1078/004/"]', 'contains("log.operationName", "Microsoft.ManagedIdentity") &&
+equals("log.categoryValue", "Administrative") &&
+(contains("log.properties.message", "token") ||
+ contains("log.operationName", "tokens"))
+', '2026-02-09 16:31:19.656126', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":5}]', '["lastEvent.log.operationName","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (143, 'Multi-Factor Authentication Disabled for an Azure User', 3, 3, 2, 'Persistence', 'T1556 - Modify Authentication Process', 'Detects when multi-factor authentication (MFA) is disabled for an Azure AD/Entra ID user account through Audit Logs.
+
+**Security Context:**
+Multi-factor authentication is a critical security control that requires users to provide additional verification beyond just a password. Disabling MFA for user accounts significantly weakens authentication security and is a common technique used by adversaries to maintain persistent access. Once MFA is disabled, attackers can authenticate using only compromised credentials without triggering additional verification steps, making detection more difficult.
+
+**Detection Logic:**
+This rule monitors AuditLogs for successful "Disable Strong Authentication" operations, which represent the per-user MFA setting being turned off in Azure AD/Entra ID. This operation is distinct from Conditional Access MFA policies and represents the legacy per-user MFA enforcement method.
+
+**Investigation Steps:**
+1. Identify the disabler: Check log.propertiesInitiatedBy for who disabled MFA
+2. Identify affected user: Examine log.propertiesTargetResources for the user whose MFA was disabled
+3. Verify authorization: Confirm if the MFA disabling was part of legitimate administrative action
+4. Review user privilege: Determine if the affected user has elevated permissions (admins, privileged roles)
+5. Check timing: Analyze if MFA was disabled after suspicious authentication events
+6. Review authentication history: Look for failed authentication attempts before MFA disabling
+7. Check for compromise indicators: Search for unusual sign-in patterns, impossible travel, or risky sign-ins
+8. Examine subsequent logins: Monitor for authentication activity immediately after MFA disabling
+9. Review MFA methods: Check what MFA methods the user had registered before disabling
+10. Correlate with other events: Look for privilege escalation or data access after MFA disabling
+
+**Recommended Actions:**
+- If unauthorized, immediately re-enable MFA for the affected user
+- Force password reset for the affected account
+- Review all authentication activity for the affected user
+- Check for compromised credentials using Azure AD Identity Protection
+- Revoke all active sessions for the affected user
+- Enable Conditional Access policies instead of per-user MFA for better control
+- Implement PIM approval workflows for modifying MFA settings
+- Enable alerts for MFA changes on privileged accounts
+- Audit accounts with permissions to modify user authentication settings
+- Review and restrict who can disable MFA (typically requires User Administrator or higher)
+
+**Modern MFA Management:**
+- **Per-user MFA (legacy)**: This detection targets the legacy per-user MFA setting
+- **Conditional Access**: Modern approach using policies instead of per-user settings
+- **Authentication Methods Policy**: Newer method for managing FIDO2, passwordless, etc.
+
+Organizations should migrate from per-user MFA to Conditional Access policies for more granular control.
+
+**Common Attack Patterns:**
+- Disabling MFA after compromising an administrator account
+- Removing MFA from privileged accounts for easier persistent access
+- Disabling MFA before credential harvesting or lateral movement
+- Insider threats removing MFA from their own accounts
+- Disabling MFA on service accounts to enable automated authentication attacks
+
+**Related Detections:**
+- MFA method removal/changes
+- Conditional Access policy modifications
+- Authentication methods policy changes
+- Privileged role assignments without MFA
+
+**MITRE ATT&CK Reference:** T1556 - Modify Authentication Process
+
+**Azure Documentation:**
+- AuditLogs table: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs
+- Per-user MFA: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates
+', '["https://attack.mitre.org/techniques/T1556/","https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs","https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates","https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-licensing"]', 'equalsIgnoreCase("log.category", "AuditLogs") &&
+equalsIgnoreCase("log.operationName", "Disable Strong Authentication") &&
+(equals("log.resultType", "0") || equalsIgnoreCase("actionResult", "SUCCESS"))
+', '2026-02-09 16:31:19.796075', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (139, 'Azure Defender for Cloud Critical Security Alert', 3, 3, 2, 'Intrusion Detection', 'TA0001 - Initial Access', 'Detects critical severity alerts from Azure Defender for Cloud indicating potential active threats, malware infections, or successful breach attempts that require immediate response.
+
+Next Steps:
+1. Review the full alert details in Azure Defender for Cloud portal
+2. Verify the affected resource and assess the scope of potential compromise
+3. Check for related suspicious activities on the affected resource
+4. Implement immediate containment measures if threat is confirmed
+5. Review security policies and configurations for the affected resource
+6. Document the incident and update security procedures as needed
+', '["https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview","https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-schemas","https://attack.mitre.org/tactics/TA0001/"]', '(equals("log.eventName", "Microsoft.Security/locations/alerts/Activate/action") || contains("log.operationName", "Microsoft.Security")) &&
+equals("log.category", "Security") &&
+oneOf("log.level", ["Critical", "High", "Error"]) &&
+(equals("log.properties.severity", "High") || equals("log.properties.alertSeverity", "High"))
+', '2026-02-09 16:31:19.311503', true, false, 'origin', null, '[]', '["lastEvent.log.correlationId","lastEvent.log.eventDataId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (144, 'Azure PIM Role Activation Anomaly', 3, 3, 1, 'Privilege Escalation', 'T1078 - Valid Accounts', 'Detects unusual Privileged Identity Management (PIM) role activation patterns including activation of high-privilege roles such as Global Administrator or Privileged Role Administrator. Repeated or unusual PIM activations may indicate an attacker leveraging compromised credentials to escalate privileges.
+
+Next Steps:
+1. Verify the user activating the PIM role has legitimate business justification
+2. Review the specific role being activated and its scope
+3. Check the activation justification message provided by the user
+4. Review the activation duration and whether it exceeds normal patterns
+5. Check for unusual source IP or device during the activation
+6. If unauthorized, immediately deactivate the role and disable the user account
+7. Review PIM audit logs for other suspicious activations by the same user
+8. Implement PIM access reviews and require approval for critical roles
+', '["https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure","https://attack.mitre.org/techniques/T1078/"]', '(contains("log.operationName", "Add member to role completed (PIM activation)") ||
+ contains("log.operationName", "Add eligible member to role in PIM completed") ||
+ contains("log.operationName", "Activate PIM role")) &&
+equals("log.categoryValue", "Administrative")
+', '2026-02-09 16:31:19.920746', true, false, 'origin', null, '[{"indexPattern":"v11-log-azure-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.categoryValue","operator":"filter_term","value":"Administrative"}],"or":null,"within":"now-4h","count":3}]', '["lastEvent.log.operationName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (145, 'Storage Account Public Access Enabled', 3, 2, 1, 'Collection', 'T1530 - Data from Cloud Storage Object', 'Detects when public access is enabled on Azure Storage Accounts which could lead to unauthorized data exposure.
+This configuration change creates a significant security risk as it allows anonymous access to stored data.
+
+Next Steps:
+1. Immediately review the affected storage account configuration
+2. Verify if public access was intentionally enabled and properly authorized
+3. Check if any sensitive data is stored in the account
+4. Review access logs for any unauthorized access attempts
+5. Consider disabling public access if not required for business operations
+6. Implement network restrictions and access policies if public access is necessary
+7. Monitor for any data exfiltration activities
+', '["https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema","https://attack.mitre.org/techniques/T1530/"]', 'contains("log.operationName", "Microsoft.Storage/storageAccounts") &&
+(contains("log.operationName", "/write") || contains("log.operationName", "/blobServices/write")) &&
+equals("log.category", "Administrative") &&
+equals("log.actionResult", "accepted") &&
+(contains("log.properties", "allowBlobPublicAccess") || contains("log.properties", "publicAccess"))
+', '2026-02-09 16:31:20.055797', true, false, 'origin', null, '[]', '["lastEvent.log.aadObjectId","lastEvent.log.resourceId"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (146, 'Azure Application Credential Modification', 3, 3, 2, 'Defense Evasion', 'T1098.001 - Account Manipulation: Additional Cloud Credentials', 'Detects when a new credential (certificate or secret) is added to an Azure AD application. Applications can use certificates or secret strings to authenticate when requesting tokens. Adversaries may add additional authentication credentials to existing applications to establish persistence, evade defenses, or enable privilege escalation by impersonating legitimate applications.
+
+This technique is commonly used in post-compromise scenarios where attackers:
+- Add secrets to high-privilege applications to maintain access
+- Create backdoor authentication methods to evade MFA requirements
+- Establish persistence mechanisms that survive password resets
+- Enable token-based authentication for automated attacks
+
+Next Steps:
+1. Verify if the credential modification was authorized and expected
+2. Identify who performed the operation (check InitiatedBy field)
+3. Review the affected application''s permissions and access scope
+4. Check for subsequent suspicious sign-in activity using the application
+5. Audit other applications for similar unauthorized modifications
+6. If unauthorized, immediately remove the suspicious credentials
+7. Review application usage logs for potential abuse
+8. Investigate the source IP address and user agent of the modification
+', '["https://attack.mitre.org/techniques/T1098/001/","https://attack.mitre.org/tactics/TA0005/","https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs","https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities"]', '(equalsIgnoreCase("log.category", "AuditLogs") || contains("log.category", "Audit")) &&
+(contains("log.operationName", "Certificates and secrets management") ||
+equalsIgnoreCase("log.operationName", "Add service principal credentials") ||
+equalsIgnoreCase("log.operationName", "Update application") ||
+equalsIgnoreCase("log.operationName", "Update application - Certificates and secrets management")) &&
+equalsIgnoreCase("log.resultType", "0")
+', '2026-02-09 16:31:20.191064', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (147, 'Azure Subscription Ownership Transfer Detected', 3, 3, 2, 'Identity and Access Management', 'T1078 - Valid Accounts', 'Detects when ownership of an Azure subscription is transferred by monitoring role assignment changes at the subscription level. This could indicate unauthorized access or insider threat activity.
+
+Next Steps:
+1. Verify the legitimacy of the ownership transfer with the subscription administrator
+2. Check if the user performing the transfer is authorized for this action
+3. Review the timing and context of the transfer (business hours, planned change)
+4. Examine other recent activities by the same user or from the same source IP
+5. Validate that proper change management procedures were followed
+6. Check for any unusual activity following the ownership transfer
+7. If unauthorized, immediately revoke the new owner''s access and escalate to security team
+', '["https://learn.microsoft.com/en-us/azure/role-based-access-control/change-history-report","https://attack.mitre.org/techniques/T1078/"]', 'equals("log.operationName", "Microsoft.Authorization/roleAssignments/write") &&
+contains("log.properties", "Owner") &&
+equals("log.category", "Administrative") &&
+contains("log.resourceId", "/subscriptions/") &&
+!contains("log.resourceId", "/resourceGroups/")
+', '2026-02-09 16:31:20.330759', true, false, 'origin', null, '[]', '["lastEvent.log.correlationId","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (148, 'Possible Consent Grant Attack via Azure-Registered Application', 3, 3, 2, 'Initial Access', 'T1078 - Valid Accounts', 'Detects when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide permissions to an application. An adversary may create an Azure-registered application that requests access to data such as contact information, email, or documents. Consent grant attacks are commonly used in phishing campaigns where malicious OAuth applications trick users into granting excessive permissions, enabling data exfiltration or unauthorized access to organizational resources.', '["https://attack.mitre.org/techniques/T1566/","https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-consent-requests","https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth"]', '(equalsIgnoreCase("log.category", "AuditLogs") || contains("log.category", "Audit")) &&
+equalsIgnoreCase("log.operationName", "Consent to application") &&
+equals("log.resultType", "0")
+', '2026-02-09 16:31:20.450405', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (150, 'Azure Diagnostic Settings Tampering', 2, 3, 2, 'Defense Evasion', 'T1562.008 - Impair Defenses: Disable Cloud Logs', 'Detects deletion or modification of Azure diagnostic settings which are used to route platform logs and metrics to monitoring destinations. Attackers may disable diagnostic settings to prevent their activities from being logged and detected.
+
+Next Steps:
+1. Verify if the diagnostic settings change was authorized through change management
+2. Identify which resources lost their diagnostic logging
+3. Review the identity performing the change and confirm authorization
+4. Check if any suspicious activities occurred after logging was disabled
+5. Restore diagnostic settings for affected resources immediately
+6. Implement Azure Policy to enforce diagnostic settings on all resources
+7. Set up alerts for diagnostic settings modifications
+8. Review Azure Activity Log for other defense evasion activities by the same identity
+', '["https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings","https://attack.mitre.org/techniques/T1562/008/"]', 'contains("log.operationName", "Microsoft.Insights/diagnosticSettings") &&
+(contains("log.operationName", "delete") ||
+ contains("log.operationName", "Delete")) &&
+equals("log.resultType", "Success")
+', '2026-02-09 16:31:20.730956', true, false, 'origin', null, '[]', '["lastEvent.log.resourceId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (151, 'Anthos Security Policy Violations', 3, 3, 2, 'Security Control Bypass', 'T1562 - Impair Defenses', 'Detects security-related events in Google Anthos environments including policy violations, authentication failures, and suspicious container activities. Monitors Anthos Service Mesh, Config Management, and Policy Controller events.
+
+Next Steps:
+- Review the specific policy violation details in the event logs
+- Verify if the violation was authorized or represents a legitimate security concern
+- Check the source IP and user account associated with the violation
+- Examine recent configuration changes to Anthos security policies
+- Validate that security controls are properly configured and enforced
+- Consider implementing additional monitoring for the affected resources
+', '["https://cloud.google.com/anthos/docs/concepts/overview","https://attack.mitre.org/techniques/T1562/"]', '(
+ oneOf("log.protoPayload.serviceName", ["anthos.googleapis.com", "anthospolicycontroller.googleapis.com", "anthosservicemesh.googleapis.com"]) ||
+ oneOf("log.resourceType", ["k8s_cluster", "gke_cluster"])
+) &&
+(
+ contains("log.protoPayload.methodName", "Policy") ||
+ oneOf("log.jsonPayload.type", ["admission.k8s.io/violation", "policy.violation", "security.alert"]) ||
+ oneOf("log.severity", ["ERROR", "WARNING"])
+) &&
+(
+ equals("log.protoPayload.response.status", "PERMISSION_DENIED") ||
+ contains("log.protoPayload.status.message", "violation") ||
+ contains("log.protoPayload.status.message", "denied") ||
+ contains("log.jsonPayload.details", "policy")
+)
+', '2026-02-09 16:31:49.431583', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.resourceName","lastEvent.log.resource.labels.project_id"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (152, 'Binary Authorization Bypass Detection', 3, 3, 2, 'Defense Evasion', 'T1553 - Subvert Trust Controls', 'Detects attempts to bypass Binary Authorization controls including use of breakglass deployments, policy violations, and unauthorized container deployments. These events could indicate attempts to deploy untrusted or malicious container images.
+
+Next Steps:
+1. Verify the legitimacy of the breakglass deployment or policy bypass
+2. Review the container image source and verify its authenticity
+3. Check if the user had proper authorization for emergency deployments
+4. Examine the deployment context and business justification
+5. Validate that security policies are restored after emergency deployment
+6. Monitor for any subsequent suspicious activity from deployed containers
+', '["https://cloud.google.com/binary-authorization/docs/audit-logging","https://cloud.google.com/binary-authorization/docs/run/using-breakglass-cloud-run","https://attack.mitre.org/techniques/T1553/"]', '(
+ equals("log.protoPayload.serviceName", "binaryauthorization.googleapis.com") &&
+ (
+ contains("log.logName", "cloudaudit.googleapis.com/system_event") &&
+ (contains("log.protoPayload.response.details", "breakglass") || equals("log.jsonPayload.breakglass", true))
+ )
+) ||
+(
+ equals("log.resourceType", "cloud_run_revision") &&
+ contains("log.logName", "cloudaudit.googleapis.com/system_event") &&
+ (
+ contains("log.protoPayload.response.status.conditions", "ContainerImageUnauthorized") ||
+ equals("log.jsonPayload.policyViolation", true) ||
+ equals("log.protoPayload.metadata.dryRun", true)
+ )
+)
+', '2026-02-09 16:31:49.570574', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.resourceName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (153, 'Cloud Identity Suspicious Sign-ins Detection', 3, 2, 1, 'Initial Access', 'T1078 - Valid Accounts', 'Detects suspicious sign-in attempts to Google Cloud Identity, including logins from unfamiliar locations, unusual IP addresses, or after multiple failed attempts. These could indicate compromised credentials or unauthorized access attempts.
+
+Next Steps:
+1. Verify the legitimacy of the login attempt with the user
+2. Check if the IP address is from a known malicious source
+3. Review recent account activity for signs of compromise
+4. Consider implementing additional MFA if not already enabled
+5. If confirmed malicious, reset user credentials immediately
+6. Review access logs for any unauthorized activities
+', '["https://support.google.com/cloudidentity/answer/4580120?hl=en","https://cloud.google.com/blog/products/identity-security/logs-based-security-alerting-in-google-cloud","https://attack.mitre.org/techniques/T1078/"]', 'equals("log.protoPayload.serviceName", "login.googleapis.com") &&
+(
+ equals("log.protoPayload.metadata.event.type", "Suspicious Login") ||
+ (equals("log.protoPayload.metadata.event.type", "login") && equals("log.protoPayload.metadata.event.parameter.is_suspicious", true)) ||
+ equals("log.protoPayload.metadata.event.parameter.is_suspicious", true)
+)
+', '2026-02-09 16:31:49.745830', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (154, 'GCP probable hijacked account', 3, 3, 2, 'Collection', 'T1560 - Archive Collected Data', 'A user''s account was disabled because Google has detected a suspicious activity indicating it might have been compromised. Hijacked account can be used to perform other attacks like data collection and exfiltration', '["https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1560"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.accountDisabledHijacked")
+', '2026-02-09 16:31:49.925601', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (155, 'GCP detected account with password leak', 3, 3, 2, 'Initial Access', 'T1078 - Valid Accounts', 'A user''s account was disabled because a password leak was detected by google.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1078"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.accountDisabledPasswordLeak")
+', '2026-02-09 16:31:50.111410', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (156, 'GCP account is probably used for spamming', 1, 2, 3, 'Initial Access', 'T1566 - Phishing', 'A user''s account was disabled because Google has become aware that it was used to engage in spamming. Usually, spamming is used to perform other attacks like phishing or spread malware.', '["https://attack.mitre.org/tactics/TA0001","https://attack.mitre.org/techniques/T1566/"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.accountDisabledSpamming") ||
+equals("log.protoPayload.methodName", "google.login.LoginService.accountDisabledSpammingThroughRelay")
+', '2026-02-09 16:31:50.355664', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (157, 'GCP Audit Log Disabling or Tampering', 3, 3, 2, 'Defense Evasion', 'T1562.008 - Impair Defenses: Disable Cloud Logs', 'Detects attempts to disable GCP audit logging including sink deletion, log exclusion filter creation, and audit configuration changes. Attackers may manipulate logging infrastructure to hide their activities from security monitoring.
+
+Next Steps:
+1. Immediately verify if the logging change was authorized
+2. Review the specific sink or exclusion filter that was modified
+3. Check the identity making the change and verify authorization
+4. Assess what log types are no longer being collected
+5. Restore logging configuration and ensure all critical logs are captured
+6. Review activities that may have been hidden during the logging gap
+7. Implement Organization Policy to prevent log sink deletion
+8. Set up alerting on any changes to logging infrastructure
+', '["https://cloud.google.com/logging/docs/audit","https://attack.mitre.org/techniques/T1562/008/"]', '(contains("log.protoPayload.methodName", "DeleteSink") ||
+ contains("log.protoPayload.methodName", "UpdateSink") ||
+ contains("log.protoPayload.methodName", "CreateExclusion") ||
+ contains("log.protoPayload.methodName", "UpdateExclusion") ||
+ contains("log.protoPayload.methodName", "DeleteLog") ||
+ contains("log.protoPayload.methodName", "SetIamPolicy")) &&
+(contains("log.protoPayload.serviceName", "logging.googleapis.com") ||
+ contains("log.resource.type", "logging_sink") ||
+ contains("log.resource.type", "logging_exclusion"))
+', '2026-02-09 16:31:50.520544', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (158, 'GCP Break-Glass Container Workload Deployed', 3, 3, 2, 'Defense Evasion', 'T1548 - Abuse Elevation Control Mechanism', 'Detects deployment of container workloads using the break-glass mechanism to bypass Binary Authorization policy. While legitimate in emergency scenarios, this bypasses security controls and can be abused to deploy malicious or untrusted container images.
+
+Next Steps:
+1. Verify the break-glass deployment was authorized and documented
+2. Review the container image that was deployed
+3. Check the user identity and their authorization level
+4. Validate the business justification for the emergency bypass
+5. Ensure Binary Authorization policies are restored after the emergency
+6. Scan the deployed container for vulnerabilities and malware
+7. Review cluster activity following the deployment
+', '["https://cloud.google.com/binary-authorization/docs/using-breakglass","https://attack.mitre.org/techniques/T1548/"]', '(equals("log.protoPayload.serviceName", "binaryauthorization.googleapis.com") &&
+contains("log.protoPayload.response", "breakglass")) ||
+(contains("log.protoPayload.methodName", "container.clusters") &&
+contains("log.protoPayload.request", "breakglass"))
+', '2026-02-09 16:31:50.680995', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.resourceName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (159, 'GCP BigQuery Data Exfiltration Detection', 3, 1, 1, 'Data Exfiltration', 'T1567 - Exfiltration Over Web Service', 'Detects BigQuery operations that may indicate data exfiltration including large data exports, table copies to external projects, and extract jobs writing to external storage. Attackers may use BigQuery to query and export large datasets from compromised projects.
+
+Next Steps:
+1. Review the BigQuery job details including source and destination datasets
+2. Check the data volume being exported or copied
+3. Verify the destination project or storage bucket is legitimate
+4. Review the identity performing the operation and verify authorization
+5. Check if the query accesses sensitive tables or datasets
+6. If unauthorized, cancel running jobs and revoke the identity''s BigQuery permissions
+7. Implement VPC Service Controls to restrict data export
+8. Enable BigQuery authorized views to restrict data access
+', '["https://cloud.google.com/bigquery/docs/audit-logging","https://attack.mitre.org/techniques/T1567/"]', 'contains("log.protoPayload.serviceName", "bigquery.googleapis.com") &&
+(contains("log.protoPayload.methodName", "jobservice.insert") ||
+ contains("log.protoPayload.methodName", "tableservice.exportdata") ||
+ contains("log.protoPayload.methodName", "datasets.copy"))
+', '2026-02-09 16:31:50.887308', true, false, 'origin', null, '[{"indexPattern":"v11-log-google-*","with":[{"field":"log.protoPayload.authenticationInfo.principalEmail","operator":"filter_term","value":"{{log.protoPayload.authenticationInfo.principalEmail}}"},{"field":"log.protoPayload.serviceName","operator":"filter_term","value":"bigquery.googleapis.com"}],"or":null,"within":"now-30m","count":10}]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (160, 'GCP Cloud Function and Cloud Run Abuse', 2, 2, 1, 'Persistence', 'T1059 - Command and Scripting Interpreter', 'Detects creation or modification of Cloud Functions and Cloud Run services which can be used for persistence, backdoor access, or command execution. Attackers may deploy serverless functions with high-privilege service accounts to maintain access or exfiltrate data.
+
+Next Steps:
+1. Review the function or service code for malicious content
+2. Check the associated service account and its permissions
+3. Verify the deployer identity has authorization
+4. Review the function trigger configuration (HTTP, Pub/Sub, etc.)
+5. Check if the function allows unauthenticated invocations
+6. If unauthorized, delete the function and revoke the service account''s permissions
+7. Review invocation logs for the function
+8. Implement Organization Policy to restrict Cloud Function deployment
+', '["https://cloud.google.com/functions/docs/securing","https://attack.mitre.org/techniques/T1059/"]', '((contains("log.protoPayload.serviceName", "cloudfunctions.googleapis.com") &&
+ (contains("log.protoPayload.methodName", "CreateFunction") ||
+ contains("log.protoPayload.methodName", "UpdateFunction"))) ||
+ (contains("log.protoPayload.serviceName", "run.googleapis.com") &&
+ (contains("log.protoPayload.methodName", "CreateService") ||
+ contains("log.protoPayload.methodName", "ReplaceService"))))
+', '2026-02-09 16:31:51.081449', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (161, 'GCP Cryptomining Instance Launch Detection', 1, 2, 3, 'Resource Hijacking', 'T1496 - Resource Hijacking', 'Detects creation of GPU-accelerated or high-compute GCP instances commonly used for cryptomining. Attackers with compromised GCP credentials frequently launch expensive GPU instances (a2, g2) or compute-optimized instances in unusual regions for cryptocurrency mining operations.
+
+Next Steps:
+1. Verify the identity launching the instance and confirm business justification
+2. Check if GPU instances are normally used in this project
+3. Review the instance''s machine type and attached GPU accelerators
+4. Examine the instance image for known mining software
+5. Check billing dashboards for unexpected cost increases
+6. If unauthorized, stop and delete the instance immediately
+7. Rotate compromised credentials and review IAM bindings
+8. Implement Organization Policy constraints to restrict GPU instance creation
+', '["https://cloud.google.com/compute/docs/machine-types","https://attack.mitre.org/techniques/T1496/"]', 'contains("log.protoPayload.methodName", "compute.instances.insert") &&
+(contains("log.protoPayload.request.machineType", "a2-") ||
+ contains("log.protoPayload.request.machineType", "g2-") ||
+ contains("log.protoPayload.request.machineType", "n1-highmem-96") ||
+ contains("log.protoPayload.request.machineType", "c2d-highcpu") ||
+ contains("log.protoPayload.request.guestAccelerators", "nvidia"))
+', '2026-02-09 16:31:51.275646', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.resourceName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (162, 'GCP Custom Role with Overly Permissive Permissions', 3, 3, 1, 'Privilege Escalation', 'T1098 - Account Manipulation', 'Detects creation or modification of GCP custom IAM roles which may include overly permissive permissions for privilege escalation. Attackers may create custom roles with broad permissions like iam.serviceAccountKeys.create, iam.serviceAccounts.actAs, or compute.instances.setMetadata to escalate privileges.
+
+Next Steps:
+1. Review the custom role definition and its included permissions
+2. Verify the role follows least privilege principles
+3. Check for high-risk permissions like iam.* or resourcemanager.*
+4. Review the identity creating the role and verify authorization
+5. Check which users or service accounts are bound to the role
+6. If overly permissive, modify the role to include only necessary permissions
+7. Implement Organization Policy to restrict custom role creation
+8. Use IAM Recommender to identify and reduce excess permissions
+', '["https://cloud.google.com/iam/docs/creating-custom-roles","https://attack.mitre.org/techniques/T1098/"]', 'contains("log.protoPayload.serviceName", "iam.googleapis.com") &&
+(contains("log.protoPayload.methodName", "CreateRole") ||
+ contains("log.protoPayload.methodName", "UpdateRole"))
+', '2026-02-09 16:31:51.415706', true, false, 'origin', null, '[{"indexPattern":"v11-log-google-*","with":[{"field":"log.protoPayload.authenticationInfo.principalEmail","operator":"filter_term","value":"{{log.protoPayload.authenticationInfo.principalEmail}}"}],"or":null,"within":"now-1h","count":2}]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (163, 'GCP probable Defense Evasion, Logging Sink Deletion', 1, 2, 3, 'Defense Evasion', 'T1562 - Impair Defenses', 'Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics are cross-listed here when those techniques include the added benefit of subverting defenses. Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a log entry arrives, Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink''s export destination. An adversary may delete a Logging sink to evade detection.', '["https://cloud.google.com/logging/docs/export","https://attack.mitre.org/techniques/T1562/","https://attack.mitre.org/tactics/TA0005/"]', 'regexMatch("log.protoPayload.methodName", "((.+)?sink(s)?\\.delete|(.+)?v(\\w+)\\.ConfigServiceV(\\w+)\\.DeleteSink)")
+', '2026-02-09 16:31:51.586614', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (164, 'GCP DLP Re-Identification API Call', 3, 2, 0, 'Collection', 'T1565 - Data Manipulation', 'Detects calls to the DLP re-identification API which reverses data de-identification. This is a sensitive operation that could expose previously protected PII, financial data, or health records. Unauthorized use indicates potential data exfiltration attempts.
+
+Next Steps:
+1. Verify the re-identification request was authorized for the specific use case
+2. Review the data being re-identified and its sensitivity classification
+3. Check the user identity and whether they have legitimate access to this data
+4. Review the destination of the re-identified data
+5. If unauthorized, revoke access and investigate potential data exposure
+6. Review DLP API permissions and restrict re-identification access
+', '["https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify","https://attack.mitre.org/techniques/T1565/"]', 'contains("log.protoPayload.methodName", "ReidentifyContent") ||
+contains("log.protoPayload.methodName", "reidentify")
+', '2026-02-09 16:31:51.706281', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.methodName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (165, 'GCP probable Exfiltration, Logging Sink Modification', 3, 2, 2, 'Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they''ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink''s export destination. An adversary may update a Logging sink to exfiltrate logs to a different export destination.', '["https://cloud.google.com/logging/docs/export#how_sinks_work","https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects.sinks#LogSink","https://attack.mitre.org/techniques/T1537/","https://attack.mitre.org/tactics/TA0010/"]', 'regexMatch("log.protoPayload.methodName", "((.+)?sink(s)?\\.update|(.+)?v(\\w+)\\.ConfigServiceV(\\w+)\\.UpdateSink)")
+', '2026-02-09 16:31:51.855561', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (166, 'GCP probable Impact, Storage Bucket Deleted', 1, 2, 3, 'Impact', 'T1485 - Data Destruction', 'Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach. Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target''s business operations.', '["https://cloud.google.com/logging/docs/buckets","https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1485/"]', 'regexMatch("log.protoPayload.methodName", "(.+)\\.bucket(s)?\\.delete")
+', '2026-02-09 16:31:52.015936', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (167, 'GCP Domain-Wide API Access Granted', 3, 3, 2, 'Privilege Escalation', 'T1098 - Account Manipulation', 'Detects when domain-wide delegation is granted to a service account in Google Workspace. This allows the service account to impersonate any user in the domain and access their data, making it a high-impact privilege escalation vector.
+
+Next Steps:
+1. Verify the domain-wide delegation was authorized by a domain administrator
+2. Review the OAuth scopes granted to the service account
+3. Check the service account''s usage history and associated project
+4. Verify the scopes follow the principle of least privilege
+5. If unauthorized, revoke the delegation immediately
+6. Audit all API calls made by the service account since the delegation was granted
+7. Review Google Workspace admin logs for related changes
+', '["https://cloud.google.com/iam/docs/using-iam-securely","https://attack.mitre.org/techniques/T1098/"]', 'contains("log.protoPayload.methodName", "AUTHORIZE_API_CLIENT_ACCESS") ||
+(contains("log.protoPayload.serviceName", "admin.googleapis.com") && contains("log.protoPayload.methodName", "GrantClientAccess"))
+', '2026-02-09 16:31:52.155979', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.resourceName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (169, 'GCP Network Packet Capture Configuration', 3, 1, 1, 'Credential Access', 'T1040 - Network Sniffing', 'Detects creation or modification of Packet Mirroring configurations in GCP. Attackers use packet mirroring to capture network traffic for credential theft, data exfiltration, or reconnaissance.
+
+Next Steps:
+1. Verify the packet mirroring configuration was authorized for legitimate purposes
+2. Review the mirrored network scope (which subnets, instances, protocols)
+3. Check the collector destination for the mirrored traffic
+4. Identify the user who created the configuration
+5. If unauthorized, delete the packet mirroring policy immediately
+6. Review the mirrored traffic destination for data exfiltration
+7. Check for captured credentials or sensitive data
+', '["https://cloud.google.com/vpc/docs/packet-mirroring","https://attack.mitre.org/techniques/T1040/"]', 'contains("log.protoPayload.methodName", "PacketMirrorings") &&
+(contains("log.protoPayload.methodName", "insert") || contains("log.protoPayload.methodName", "patch") || contains("log.protoPayload.methodName", "create"))
+', '2026-02-09 16:31:52.445702', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.resourceName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (170, 'GCP KMS Key Destruction or Disabling', 1, 3, 3, 'Impact', 'T1552 - Unsecured Credentials', 'Detects destruction or disabling of Cloud KMS key versions which could render encrypted data unrecoverable. Attackers may destroy encryption keys as part of a destructive attack to prevent data recovery or to disrupt operations dependent on encrypted resources.
+
+Next Steps:
+1. Immediately verify if the KMS key operation was authorized
+2. Identify which resources are encrypted with the affected key
+3. Check if the key version is in the scheduled destruction period and can be restored
+4. Review the identity performing the operation and verify authorization
+5. Assess the business impact of the key becoming unavailable
+6. If unauthorized, restore the key version immediately during the destruction grace period
+7. Implement IAM conditions to restrict KMS key destruction permissions
+8. Enable Cloud KMS key rotation policies and cross-region key replication
+', '["https://cloud.google.com/kms/docs/destroy-restore","https://attack.mitre.org/techniques/T1552/"]', 'contains("log.protoPayload.serviceName", "cloudkms.googleapis.com") &&
+(contains("log.protoPayload.methodName", "DestroyCryptoKeyVersion") ||
+ contains("log.protoPayload.methodName", "DisableCryptoKeyVersion") ||
+ contains("log.protoPayload.methodName", "UpdateCryptoKeyPrimaryVersion"))
+', '2026-02-09 16:31:52.601150', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.resourceName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (171, 'GCP probable Privilege Escalation, Kubernetes role bindings created or patched', 1, 2, 3, 'Privilege Escalation', 'T1548 - Abuse Elevation Control Mechanism', 'Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Identifies the creation or patching of potentially malicious role bindings. Users can use role bindings and cluster role bindings to assign roles to Kubernetes subjects (users, groups, or service accounts).', '["https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control","https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1548"]', 'contains("log.protoPayload.methodName", ".rbac") &&
+ regexMatch("log.protoPayload.methodName", ''((.+)\\.)?(cluster)?rolebinding(s)?\\.(create|patch)$'') &&
+ !equals("log.protoPayload.authenticationInfo.principalEmail", "system:addon-manager")
+', '2026-02-09 16:31:52.755706', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (172, 'GKE Kubernetes Admission Webhook Modified', 3, 3, 2, 'Persistence', 'T1078.004 - Valid Accounts: Cloud Accounts', 'Detects creation or modification of admission webhook configurations in Google Kubernetes Engine. Attackers use malicious admission controllers to inject sidecar containers, modify workload specs, or intercept secrets.
+
+Next Steps:
+1. Review the webhook configuration and its target service endpoint
+2. Verify the webhook was deployed as part of a legitimate application
+3. Check the namespace selector and object rules for the webhook
+4. Examine what Kubernetes resources the webhook intercepts
+5. If unauthorized, delete the webhook and audit all recent workload deployments
+6. Review cluster RBAC for webhook management permissions
+', '["https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/","https://attack.mitre.org/techniques/T1078/004/"]', 'contains("log.protoPayload.methodName", "admissionregistration.k8s.io") &&
+(contains("log.protoPayload.methodName", "mutatingwebhookconfigurations") || contains("log.protoPayload.methodName", "validatingwebhookconfigurations")) &&
+(contains("log.protoPayload.methodName", "create") || contains("log.protoPayload.methodName", "update") || contains("log.protoPayload.methodName", "patch"))
+', '2026-02-09 16:31:52.890744', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.resourceName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (173, 'GCP Project Manipulation and Shadow Projects', 2, 3, 3, 'Account Manipulation', 'T1578 - Modify Cloud Compute Infrastructure', 'Detects GCP project creation, deletion, and undelete operations that could indicate shadow project creation for persistence or project deletion for impact. Attackers may create new projects outside organizational controls to host malicious workloads.
+
+Next Steps:
+1. Verify the project creation or deletion was authorized
+2. Check if the new project is within the expected folder hierarchy
+3. Review the project''s billing account association
+4. Examine IAM bindings on the new project for overly permissive access
+5. Check if Organization Policies are applied to the new project
+6. If unauthorized, shut down the project and investigate the creating identity
+7. Implement Organization Policy constraints for project creation
+8. Enable alerts for projects created outside approved folders
+', '["https://cloud.google.com/resource-manager/docs/creating-managing-projects","https://attack.mitre.org/techniques/T1578/"]', 'contains("log.protoPayload.serviceName", "cloudresourcemanager.googleapis.com") &&
+(contains("log.protoPayload.methodName", "CreateProject") ||
+ contains("log.protoPayload.methodName", "DeleteProject") ||
+ contains("log.protoPayload.methodName", "UndeleteProject"))
+', '2026-02-09 16:31:53.040913', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (191, 'AWS EC2 Flow Log Deletion', 3, 2, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (EC2). An adversary may delete flow logs in an attempt to evade defenses', '["https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html","https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/"]', 'equals("log.eventSource", "ec2.amazonaws.com") &&
+equals("log.eventName", "DeleteFlowLogs")
+', '2026-02-09 16:32:22.900581', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (174, 'GCP Secret Manager Bulk Access Detection', 3, 1, 1, 'Credential Access', 'T1552 - Unsecured Credentials', 'Detects bulk access to GCP Secret Manager secrets which may indicate credential harvesting. Attackers who gain access to a GCP project may enumerate and retrieve all stored secrets to obtain API keys, database credentials, and other sensitive data.
+
+Next Steps:
+1. Review which secrets were accessed and their sensitivity classification
+2. Verify the identity accessing the secrets has legitimate need
+3. Check the access pattern for unusual timing or volume
+4. Review the caller''s IP address and user agent for anomalies
+5. Determine if the accessed secrets have been used from unauthorized locations
+6. If unauthorized, rotate all accessed secrets immediately
+7. Review Secret Manager IAM bindings and apply least privilege
+8. Enable VPC Service Controls to restrict secret access
+', '["https://cloud.google.com/secret-manager/docs/audit-logging","https://attack.mitre.org/techniques/T1552/"]', 'contains("log.protoPayload.serviceName", "secretmanager.googleapis.com") &&
+contains("log.protoPayload.methodName", "AccessSecretVersion")
+', '2026-02-09 16:31:53.196255', true, false, 'origin', null, '[{"indexPattern":"v11-log-google-*","with":[{"field":"log.protoPayload.authenticationInfo.principalEmail","operator":"filter_term","value":"{{log.protoPayload.authenticationInfo.principalEmail}}"},{"field":"log.protoPayload.methodName","operator":"filter_term","value":"AccessSecretVersion"}],"or":null,"within":"now-15m","count":5}]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (175, 'GCP Service Account Impersonation Detection', 3, 3, 1, 'Credential Access', 'T1550.001 - Use Alternate Authentication Material: Application Access Token', 'Detects service account impersonation through token generation APIs including GenerateAccessToken, GenerateIdToken, and SignBlob. Attackers may impersonate service accounts to escalate privileges or access resources the service account has been granted.
+
+Next Steps:
+1. Verify the identity performing the impersonation is authorized
+2. Check the target service account and its IAM bindings
+3. Review the permissions available through the impersonated service account
+4. Examine the API calls made using the generated token
+5. Verify if the impersonation is part of a legitimate workload chain
+6. If unauthorized, remove the iam.serviceAccountTokenCreator role from the caller
+7. Review the service account''s access patterns for anomalies
+8. Implement Organization Policy constraints to limit service account impersonation
+', '["https://cloud.google.com/iam/docs/create-short-lived-credentials-direct","https://attack.mitre.org/techniques/T1550/001/"]', '(contains("log.protoPayload.methodName", "GenerateAccessToken") ||
+ contains("log.protoPayload.methodName", "GenerateIdToken") ||
+ contains("log.protoPayload.methodName", "SignBlob") ||
+ contains("log.protoPayload.methodName", "SignJwt")) &&
+contains("log.protoPayload.serviceName", "iamcredentials.googleapis.com")
+', '2026-02-09 16:31:53.355739', true, false, 'origin', null, '[{"indexPattern":"v11-log-google-*","with":[{"field":"log.protoPayload.authenticationInfo.principalEmail","operator":"filter_term","value":"{{log.protoPayload.authenticationInfo.principalEmail}}"}],"or":null,"within":"now-30m","count":10}]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (176, 'GCP probable Password Guessing', 3, 3, 2, 'Credential Access', 'T1110.001 - Brute Force: Password Guessing', 'Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target''s policies on password complexity or use policies that may lock accounts out after a number of failed attempts.', '["https://attack.mitre.org/tactics/TA0006","https://attack.mitre.org/techniques/T1110/001/"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.loginFailure") && exists("log.protoPayload.authenticationInfo.principalEmail")
+', '2026-02-09 16:31:53.495735', true, false, 'origin', null, '[{"indexPattern":"v11-log-google-*","with":[{"field":"log.protoPayload.methodName","operator":"filter_term","value":"google.login.LoginService.loginFailure"},{"field":"log.protoPayload.authenticationInfo.principalEmail","operator":"filter_term","value":"{{log.protoPayload.authenticationInfo.principalEmail}}"}],"or":null,"within":"now-5m","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (177, 'GCP Cloud Storage Data Exfiltration', 3, 1, 1, 'Data Exfiltration', 'T1530 - Data from Cloud Storage Object', 'Detects GCP Cloud Storage operations indicating potential data exfiltration including making buckets publicly accessible, modifying IAM policies to grant allUsers access, or bulk object downloads. These actions may indicate an attacker attempting to exfiltrate data from cloud storage.
+
+Next Steps:
+1. Review the affected bucket and its data classification
+2. Check if the bucket was made publicly accessible
+3. Verify the identity making the change has authorization
+4. Review the IAM policy changes for allUsers or allAuthenticatedUsers bindings
+5. Check for bulk GetObject operations following the policy change
+6. If unauthorized, revert the bucket IAM policy and enable uniform bucket-level access
+7. Review VPC Service Controls for the project
+8. Enable Cloud Storage audit logging for data access events
+', '["https://cloud.google.com/storage/docs/access-control","https://attack.mitre.org/techniques/T1530/"]', 'contains("log.protoPayload.serviceName", "storage.googleapis.com") &&
+(contains("log.protoPayload.methodName", "storage.setIamPermissions") ||
+ contains("log.protoPayload.methodName", "storage.buckets.update") ||
+ contains("log.protoPayload.methodName", "storage.objects.update")) &&
+(contains("log.protoPayload.request.policy.bindings", "allUsers") ||
+ contains("log.protoPayload.request.policy.bindings", "allAuthenticatedUsers") ||
+ contains("log.protoPayload.request.acl", "allUsers"))
+', '2026-02-09 16:31:53.651061', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.resourceName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (178, 'GCP suspicious login blocked', 1, 2, 3, 'Initial Access', 'T1078 - Valid Accounts', 'A suspicious login to a user''s account was detected and blocked by Google Cloud.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1078"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.suspiciousLogin")
+', '2026-02-09 16:31:53.800613', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (179, 'GCP suspicious programmatic login', 1, 2, 3, 'Credential Access', 'T1110 - Brute Force', 'Google Cloud has detected a suspicious programmatic login. Programmatic login can be use to perform brute force attack.', '["https://attack.mitre.org/tactics/TA0006","https://attack.mitre.org/techniques/T1110"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.suspiciousProgrammaticLogin")
+', '2026-02-09 16:31:53.930971', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (180, 'GCP suspicious login from less secure app', 1, 2, 3, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Less secure apps (LSAs) are non-Google apps that can access your Google account with only a username and password. They make your account more vulnerable to hijacking attempts.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1190"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.suspiciousLoginLessSecureApp")
+', '2026-02-09 16:31:54.081040', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (181, 'GCP Workload Identity Federation Abuse', 3, 3, 1, 'Credential Access', 'T1078 - Valid Accounts', 'Detects creation or modification of workload identity pools and providers that enable external identities to access GCP resources. Attackers may create workload identity configurations to grant access to external attacker-controlled identity providers for persistent cloud access.
+
+Next Steps:
+1. Review the workload identity pool and provider configuration
+2. Verify the external identity provider is trusted and authorized
+3. Check the attribute mappings and conditions for overly permissive access
+4. Review which service accounts are bound to the workload identity pool
+5. Verify the change was authorized through security change management
+6. If unauthorized, delete the workload identity pool and revoke associated permissions
+7. Audit all existing workload identity configurations for unauthorized providers
+8. Implement Organization Policy to restrict workload identity pool creation
+', '["https://cloud.google.com/iam/docs/workload-identity-federation","https://attack.mitre.org/techniques/T1078/"]', 'contains("log.protoPayload.serviceName", "iam.googleapis.com") &&
+(contains("log.protoPayload.methodName", "CreateWorkloadIdentityPool") ||
+ contains("log.protoPayload.methodName", "CreateWorkloadIdentityPoolProvider") ||
+ contains("log.protoPayload.methodName", "UpdateWorkloadIdentityPool") ||
+ contains("log.protoPayload.methodName", "UpdateWorkloadIdentityPoolProvider"))
+', '2026-02-09 16:31:54.231322', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.methodName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (182, 'Google Workspace MFA Enforcement Disabled', 3, 3, 1, 'Defense Evasion', 'T1556 - Modify Authentication Process', 'Detects when MFA enforcement is disabled in Google Workspace. Disabling MFA removes a critical security control and enables credential-based attacks against all users in the organization.
+
+Next Steps:
+1. Immediately verify if the MFA policy change was authorized
+2. Identify the admin who made the change and their authorization
+3. Check for brute force or credential stuffing attempts following the change
+4. Re-enable MFA enforcement immediately if unauthorized
+5. Review all sign-ins that occurred while MFA was disabled
+6. Check for other security policy changes from the same admin
+7. Audit admin roles and consider implementing super admin 2SV enforcement
+', '["https://support.google.com/a/answer/9176657","https://attack.mitre.org/techniques/T1556/"]', 'contains("log.protoPayload.methodName", "ENFORCE_STRONG_AUTHENTICATION") ||
+(contains("log.protoPayload.serviceName", "admin.googleapis.com") && contains("log.protoPayload.methodName", "2sv") && contains("log.protoPayload.request", "disable"))
+', '2026-02-09 16:31:54.385470', true, false, 'origin', null, '[]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.methodName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (183, 'Google Cloud Service Account Key Creation Spike', 3, 3, 2, 'Credential Access', 'Account Manipulation', 'Detects spikes in service account key creation which could indicate credential harvesting or preparation for unauthorized access. Service account keys provide long-term credentials that can be used to authenticate as the service account. Multiple key creations by the same user within a short timeframe may indicate malicious activity or preparation for privilege escalation attacks.
+
+Next Steps:
+1. Investigate the user account creating multiple service account keys
+2. Review the service accounts for which keys were created and their permissions
+3. Check if the key creation was authorized and follows organizational policies
+4. Examine subsequent activities performed using these service account credentials
+5. Verify if the keys were created from expected IP addresses and locations
+6. Review access patterns and identify any unusual resource access or API calls
+7. Consider rotating or disabling the created keys if unauthorized activity is confirmed
+', '["https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts","https://attack.mitre.org/techniques/T1098/001/"]', 'equals("log.protoPayload.methodName", "google.iam.admin.v1.CreateServiceAccountKey") &&
+equals("log.protoPayload.serviceName", "iam.googleapis.com")
+', '2026-02-09 16:31:54.535563', true, false, 'origin', null, '[{"indexPattern":"v11-log-google-*","with":[{"field":"log.protoPayload.authenticationInfo.principalEmail","operator":"filter_term","value":"{{log.protoPayload.authenticationInfo.principalEmail}}"}],"or":null,"within":"now-1h","count":5}]', '["lastEvent.log.protoPayload.authenticationInfo.principalEmail","lastEvent.log.protoPayload.methodName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (184, 'GCP 2-step verification disabled', 1, 2, 3, 'Defense Evasion', 'T1562 - Impair Defenses', 'Google Cloud has detected that 2-step verification was disabled for the organization or a user', '["https://attack.mitre.org/tactics/TA0005","https://attack.mitre.org/techniques/T1562/"]', 'equals("log.protoPayload.methodName", "google.login.LoginService.2svDisable")
+', '2026-02-09 16:31:54.675123', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (185, 'AWS IAM Brute Force of Assume Role Policy', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', 'Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1110/","https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities","https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/"]', 'equals("log.eventSource", "iam.amazonaws.com") &&
+equals("log.eventName", "UpdateAssumeRolePolicy") &&
+equals("log.errorCode", "MalformedPolicyDocumentException")
+', '2026-02-09 16:32:22.046334', true, false, 'origin', null, '[{"indexPattern":"v11-log-aws-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (186, 'AWS Management Console Brute Force of Root User Identity', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', 'Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1110/","https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"]', 'equals("log.eventSource", "signin.amazonaws.com") &&
+equals("log.eventName", "ConsoleLogin") &&
+equals("log.userIdentityType", "root") &&
+(exists("log.errorCode") || exists("log.errorMessage"))
+', '2026-02-09 16:32:22.185809', true, false, 'origin', null, '[{"indexPattern":"v11-log-aws-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (187, 'AWS CloudTrail Log Suspended', 3, 2, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies suspending the recording of AWS API calls and log file delivery for the specified trail. An adversary may suspend trails in an attempt to evade defenses', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/stop-logging.html"]', 'equals("log.eventSource", "cloudtrail.amazonaws.com") &&
+equals("log.eventName", "StopLogging")
+', '2026-02-09 16:32:22.325347', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (193, 'AWS S3 Bucket Configuration Deletion', 3, 2, 2, 'Defense Evasion', 'T1070 - Indicator Removal', 'Identifies the deletion of various Amazon Simple Storage Service (S3) bucket configuration components', '["https://attack.mitre.org/techniques/T1070/","https://attack.mitre.org/tactics/TA0005/","https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html","https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketReplication.html","https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketCors.html","https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html","https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketLifecycle.html"]', 'equals("log.eventSource", "s3.amazonaws.com") &&
+oneOf("log.eventName", ["DeleteBucketPolicy", "DeleteBucketReplication",
+"DeleteBucketCors", "DeleteBucketEncryption", "DeleteBucketLifecycle"])
+', '2026-02-09 16:32:23.205749', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (194, 'AWS WAF Access Control List Deletion', 3, 2, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies the deletion of a specified AWS Web Application Firewall (WAF) access control list', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/waf-regional/delete-web-acl.html","https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteWebACL.html"]', 'oneOf("log.eventSource", ["waf.amazonaws.com", "waf-regional.amazonaws.com", "wafv2.amazonaws.com"]) &&
+equals("log.eventName", "DeleteWebACL")
+', '2026-02-09 16:32:23.365484', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (195, 'AWS WAF Rule or Rule Group Deletion', 3, 2, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule or rule group', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/waf/delete-rule-group.html","https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRuleGroup.html"]', 'oneOf("log.eventSource", ["waf.amazonaws.com", "waf-regional.amazonaws.com", "wafv2.amazonaws.com"]) &&
+(equals("log.eventName", "DeleteRule") || equals("log.eventName", "DeleteRuleGroup"))
+', '2026-02-09 16:32:23.525382', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (196, 'AWS EC2 Snapshot Activity', 3, 2, 2, 'Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data from an EC2 fleet. If the permissions were modified, verify the snapshot was not shared with an unauthorized or unexpected AWS account', '["https://attack.mitre.org/tactics/TA0010/","https://attack.mitre.org/techniques/T1537/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-snapshot-attribute.html","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html"]', 'equals("log.eventSource", "ec2.amazonaws.com") &&
+equals("log.eventName", "ModifySnapshotAttribute")
+', '2026-02-09 16:32:23.686140', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (197, 'AWS EC2 VM Export Failure', 3, 2, 2, 'Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information', '["https://attack.mitre.org/techniques/T1537/","https://attack.mitre.org/tactics/TA0010/","https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1005/","https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance"]', 'equals("log.eventSource", "ec2.amazonaws.com") &&
+equals("log.eventName", "CreateInstanceExportTask")
+', '2026-02-09 16:32:23.826345', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (198, 'AWS EC2 Full Network Packet Capture Detected', 3, 2, 2, 'Exfiltration', 'T1020 - Automated Exfiltration', 'Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic', '["https://attack.mitre.org/tactics/TA0010/","https://attack.mitre.org/techniques/T1020/","https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1074/","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorFilter.html","https://github.com/easttimor/aws-incident-response"]', 'equals("log.eventSource", "ec2.amazonaws.com") &&
+(equals("log.eventName", "CreateTrafficMirrorFilter") ||
+equals("log.eventName", "CreateTrafficMirrorFilterRule") ||
+equals("log.eventName", "CreateTrafficMirrorSession") ||
+equals("log.eventName", "CreateTrafficMirrorTarget"))
+', '2026-02-09 16:32:23.985624', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (199, 'AWS RDS Snapshot Export', 3, 2, 2, 'Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot', '["https://attack.mitre.org/tactics/TA0010/","https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html"]', 'equals("log.eventSource", "rds.amazonaws.com") &&
+equals("log.eventName", "StartExportTask")
+', '2026-02-09 16:32:24.165485', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (200, 'AWS CloudTrail Log Updated', 2, 2, 1, 'Impact', 'T1565 - Data Manipulation', 'Identifies an update to an AWS log trail setting that specifies the delivery of log files', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1565/","https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1530/","https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateTrail.html","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/update-trail.html"]', 'equals("log.eventSource", "cloudtrail.amazonaws.com") &&
+equals("log.eventName", "UpdateTrail")
+', '2026-02-09 16:32:24.305385', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (201, 'AWS CloudWatch Log Group Deletion', 3, 2, 2, 'Impact', 'T1485 - Data Destruction', 'Identifies the deletion of a specified AWS CloudWatch log group. When a log group is deleted, all the archived log events associated with the log group are also permanently deleted', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1485/","https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/delete-log-group.html","https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogGroup.html"]', 'equals("log.eventSource", "logs.amazonaws.com") &&
+equals("log.eventName", "DeleteLogGroup")
+', '2026-02-09 16:32:24.486458', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (202, 'AWS CloudWatch Log Stream Deletion', 3, 2, 2, 'Impact', 'T1485 - Data Destruction', 'Identifies the deletion of an AWS CloudWatch log stream, which permanently deletes all associated archived log events with the stream', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1485/","https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/delete-log-stream.html","https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogStream.html"]', 'equals("log.eventSource", "logs.amazonaws.com") &&
+equals("log.eventName", "DeleteLogStream")
+', '2026-02-09 16:32:24.640434', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (203, 'AWS EC2 Encryption Disabled', 3, 2, 2, 'Impact', 'T1565 - Data Manipulation', 'Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default in the current region. Disabling encryption by default does not change the encryption status of your existing volumes', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1565/","https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/disable-ebs-encryption-by-default.html","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html"]', 'equals("log.eventSource", "ec2.amazonaws.com") &&
+equals("log.eventName", "DisableEbsEncryptionByDefault")
+', '2026-02-09 16:32:24.801028', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (204, 'AWS IAM Deactivation of MFA Device', 3, 2, 2, 'Impact', 'T1531 - Account Access Removal', 'Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be deactivated before it can be deleted', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1531/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/deactivate-mfa-device.html","https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html"]', 'equals("log.eventSource", "iam.amazonaws.com") &&
+oneOf("log.eventName", ["DeactivateMFADevice", "DeleteVirtualMFADevice"])
+', '2026-02-09 16:32:25.205887', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (205, 'AWS RDS Cluster Deletion', 3, 2, 2, 'Impact', 'T1485 - Data Destruction', 'Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora database cluster or global database cluster', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1485/","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/delete-db-cluster.html","https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html","https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/delete-global-cluster.html","https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteGlobalCluster.html"]', 'equals("log.eventSource", "rds.amazonaws.com") &&
+oneOf("log.eventName", ["DeleteDBCluster", "DeleteGlobalCluster"])
+', '2026-02-09 16:32:25.302156', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (206, 'AWS Management Console Root Login', 3, 3, 3, 'Initial Access', 'T1078 - Valid Accounts', 'Identifies a successful login to the AWS Management Console by the Root user.
Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases.
Potential false positives
It’s strongly recommended that the root user is not used for everyday tasks, including the administrative ones. Verify whether the IP address, location, and/or hostname should be logging in as root in your environment. Unfamiliar root logins should be investigated immediately. If known behavior is causing false positives, it can be exempted from the rule.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1078/","https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"]', 'equals("log.eventSource", "signin.amazonaws.com") &&
+equals("log.eventName", "ConsoleLogin") &&
+equals("log.userIdentityType", "root")
+', '2026-02-09 16:32:25.445928', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (207, 'AWS IAM Password Recovery Requested', 2, 1, 0, 'Initial Access', 'T1078 - Valid Accounts', 'Identifies AWS IAM password recovery requests. An adversary may attempt to gain unauthorized AWS access by abusing password recovery mechanisms.
Potential false positives
Verify whether the user identity, user agent, and/or hostname should be requesting changes in your environment. Password reset attempts from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1078/","https://www.cadosecurity.com/2020/06/11/an-ongoing-aws-phishing-campaign/"]', 'equals("log.eventSource", "signin.amazonaws.com") &&
+equals("log.eventName", "PasswordRecoveryRequested")
+', '2026-02-09 16:32:25.576265', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (208, 'AWS Route 53 Domain Transfer Lock Disabled', 3, 2, 2, 'Persistence', 'T1098 - Account Manipulation', 'Identifies when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1098/","https://attack.mitre.org/tactics/TA0006/","https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html","https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html"]', 'equals("log.eventSource", "route53.amazonaws.com") &&
+equals("log.eventName", "DisableDomainTransferLock")
+', '2026-02-09 16:32:25.706232', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (209, 'AWS Execution via System Manager', 2, 1, 1, 'Initial Access', 'T1566 - Phishing', 'Identifies the execution of commands and scripts via System Manager. Execution methods such as RunShellScript, RunPowerShellScript, and alike can be abused by an authenticated attacker to install a backdoor or to interact with a compromised instance via reverse-shell using system only commands
Potential false positives
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Suspicious commands from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1566/","https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-plugins.html"]', 'equals("log.eventSource", "ssm.amazonaws.com") &&
+equals("log.eventName", "SendCommand")
+', '2026-02-09 16:32:25.836057', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (210, 'AWS IAM Assume Role Policy Update', 2, 2, 1, 'Initial Access', 'T1078 - Valid Accounts', 'Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may attempt to modify the AssumeRolePolicy of a misconfigured role in order to gain the privileges of that role', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1078/","https://labs.bishopfox.com/tech-blog/5-privesc-attack-vectors-in-aws"]', 'equals("log.eventSource", "iam.amazonaws.com") &&
+equals("log.eventName", "UpdateAssumeRolePolicy")
+', '2026-02-09 16:32:25.981039', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (211, 'AWS Route 53 Domain Transferred to Another Account', 3, 3, 3, 'Persistence', 'T1098 - Account Manipulation', 'Identifies when a request has been made to transfer a Route 53 domain to another AWS account', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1098/","https://attack.mitre.org/tactics/TA0006/","https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html"]', 'equals("log.eventSource", "route53.amazonaws.com") &&
+equals("log.eventName", "TransferDomainToAnotherAwsAccount")
+', '2026-02-09 16:32:26.116118', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (212, 'AWS Root Login Without MFA', 3, 2, 2, 'Initial Access', 'T1078 - Valid Accounts', 'Identifies attempts to login to AWS as the root user without using multi-factor authentication (MFA). Amazon AWS best practices indicate that the root user should be protected by MFA', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1078/","https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"]', 'equals("log.eventSource", "signin.amazonaws.com") &&
+equals("log.eventName", "ConsoleLogin") &&
+equals("log.userIdentityType", "root") &&
+equals("log.additionalEventData.MFAUsed", "no")
+', '2026-02-09 16:32:26.265969', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (213, 'Apache API Endpoint Enumeration Detection', 2, 1, 1, 'Discovery', 'T1087 - Account Discovery', 'Detects rapid sequential API endpoint enumeration by identifying multiple 404/405 responses from the same source IP in a short time window. This indicates an attacker systematically probing for valid API endpoints, hidden resources, or vulnerable paths.
+
+Next Steps:
+1. Review the sequence of requested paths to identify the enumeration pattern
+2. Check if any valid endpoints were discovered during the scan
+3. Assess whether sensitive API documentation or endpoints were exposed
+4. Implement rate limiting on the affected endpoints
+5. Consider deploying a WAF with API protection capabilities
+6. Block the source IP if scanning is confirmed
+', '["https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/","https://attack.mitre.org/techniques/T1087/"]', 'exists("origin.ip") &&
+(equals("log.statusCode", 404) || equals("log.statusCode", 405)) &&
+exists("origin.path") &&
+(
+ contains("origin.path", "/api/") ||
+ contains("origin.path", "/v1/") ||
+ contains("origin.path", "/v2/") ||
+ contains("origin.path", "/v3/") ||
+ contains("origin.path", "/rest/") ||
+ contains("origin.path", "/graphql") ||
+ contains("origin.path", "/swagger") ||
+ contains("origin.path", "/openapi") ||
+ contains("origin.path", "/.env") ||
+ contains("origin.path", "/.git") ||
+ contains("origin.path", "/debug") ||
+ contains("origin.path", "/actuator") ||
+ contains("origin.path", "/healthcheck") ||
+ contains("origin.path", "/metrics")
+)
+', '2026-02-09 16:37:01.731831', true, false, 'origin', '["adversary.ip","target.ip"]', '[{"indexPattern":"v11-log-apache-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.statusCode","operator":"filter_term","value":"404"}],"or":[{"indexPattern":"v11-log-apache-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.statusCode","operator":"filter_term","value":"405"}],"or":null,"within":"now-5m","count":20}],"within":"now-5m","count":20}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (214, 'Apache CVE Path Traversal and RCE Detection', 3, 3, 3, 'Exploitation', 'T1190 - Exploit Public-Facing Application', 'Detects exploitation attempts targeting known Apache HTTP Server CVEs including CVE-2021-41773 and CVE-2021-42013 path traversal/RCE vulnerabilities, as well as other Apache-specific attack patterns that enable remote code execution.
+
+Next Steps:
+1. Immediately verify the Apache version running on the target server
+2. Check if the path traversal or RCE attempt was successful (200 status code)
+3. Review the server for signs of compromise or unauthorized file access
+4. Patch Apache to the latest version immediately
+5. Check for reverse shells or dropped files on the server
+6. Block the source IP and review firewall rules
+', '["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42013","https://attack.mitre.org/techniques/T1190/"]', 'exists("origin.ip") &&
+exists("origin.path") &&
+(
+ contains("origin.path", ".%2e/") ||
+ contains("origin.path", "%2e%2e/") ||
+ contains("origin.path", "%%32%65") ||
+ contains("origin.path", ".%%32%65/") ||
+ contains("origin.path", "%2e%%32%65/") ||
+ contains("origin.path", "%%32%65%%32%65/") ||
+ (contains("origin.path", "/cgi-bin/") && contains("origin.path", "%2e%2e")) ||
+ (contains("origin.path", "/icons/") && contains("origin.path", "%2e%2e")) ||
+ regexMatch("origin.path", "(?i)/cgi-bin/.*\\.(sh|pl|py|cgi)\\?") ||
+ contains("origin.path", "/server-status") ||
+ contains("origin.path", "/server-info")
+)
+', '2026-02-09 16:37:01.872197', true, false, 'origin', null, '[]', '["adversary.ip","adversary.path"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (215, 'Apache Slowloris DoS Attack Detection', 0, 0, 3, 'Denial of Service', 'T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood', 'Detects Slowloris-style slow HTTP denial of service attacks by identifying patterns of incomplete requests, connection timeouts, and excessive concurrent connections from a single source IP. Slowloris exhausts server resources by holding connections open with partial HTTP requests.
+
+Next Steps:
+1. Check Apache connection status and active connection counts
+2. Identify the source IPs with the most concurrent connections
+3. Review Apache error logs for timeout and connection reset messages
+4. Implement connection timeouts and mod_reqtimeout if not already configured
+5. Consider rate limiting connections per IP at the firewall level
+6. Deploy a reverse proxy or CDN with DDoS protection
+', '["https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/","https://attack.mitre.org/techniques/T1499/001/"]', 'exists("origin.ip") &&
+(
+ (exists("log.message") && (
+ contains("log.message", "request failed: error reading the headers") ||
+ contains("log.message", "AH01382") ||
+ contains("log.message", "AH00567") ||
+ contains("log.message", "client denied by server configuration") ||
+ contains("log.message", "Timeout waiting for output from CGI script") ||
+ contains("log.message", "incomplete headers") ||
+ contains("log.message", "request body read timeout")
+ )) ||
+ (exists("log.errorCode") && (
+ equals("log.errorCode", "408") ||
+ equals("log.errorCode", "AH01382") ||
+ equals("log.errorCode", "AH00567")
+ ))
+)
+', '2026-02-09 16:37:02.012276', true, false, 'origin', '["adversary.ip","target.ip"]', '[{"indexPattern":"v11-log-apache-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.message","operator":"filter_match","value":"timeout OR incomplete OR headers OR AH01382 OR AH00567"}],"or":null,"within":"now-5m","count":15}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (216, 'Apache SSRF Attack Detection', 3, 2, 1, 'Server-Side Request Forgery', 'T1090 - Proxy', 'Detects Server-Side Request Forgery (SSRF) attempts by identifying requests containing internal IP addresses, cloud metadata endpoints, or localhost references in URL parameters. Attackers use SSRF to access internal services, cloud instance metadata, or pivot to internal networks.
+
+Next Steps:
+1. Review the full request URL and parameters for internal IP or metadata references
+2. Identify the application endpoint being targeted for SSRF
+3. Check if any internal services were successfully accessed
+4. Review application code for improper URL validation
+5. Block the source IP if confirmed malicious
+6. Implement URL allowlisting and SSRF protections in the application
+', '["https://owasp.org/www-community/attacks/Server_Side_Request_Forgery","https://attack.mitre.org/techniques/T1090/"]', 'exists("origin.ip") &&
+exists("origin.path") &&
+(
+ contains("origin.path", "169.254.169.254") ||
+ contains("origin.path", "metadata.google.internal") ||
+ contains("origin.path", "metadata.azure.com") ||
+ regexMatch("origin.path", "(?i)(url|redirect|next|target|dest|uri|path|file|page|go|return|out|view|load|fetch)=.*(127\\.0\\.0\\.1|localhost|0\\.0\\.0\\.0|10\\.[0-9]+\\.[0-9]+\\.[0-9]+|172\\.(1[6-9]|2[0-9]|3[01])\\.[0-9]+\\.[0-9]+|192\\.168\\.[0-9]+\\.[0-9]+)") ||
+ regexMatch("origin.path", "(?i)(url|redirect|next|target|dest|uri|path|file|page|go|return|out|view|load|fetch)=https?://(127\\.0\\.0\\.1|localhost|0\\.0\\.0\\.0)") ||
+ contains("origin.path", "file:///") ||
+ contains("origin.path", "gopher://") ||
+ contains("origin.path", "dict://") ||
+ contains("origin.path", "ftp://127") ||
+ contains("origin.path", "ftp://localhost")
+)
+', '2026-02-09 16:37:02.167020', true, false, 'origin', null, '[{"indexPattern":"v11-log-apache-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"origin.path","operator":"filter_match","value":"169.254.169.254 OR localhost OR 127.0.0.1 OR metadata OR file:// OR gopher://"}],"or":null,"within":"now-10m","count":3}]', '["adversary.ip","adversary.path"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (217, 'Apache Server-Side Template Injection Detection', 3, 3, 2, 'Code Injection', 'T1059 - Command and Scripting Interpreter', 'Detects Server-Side Template Injection (SSTI) payloads in Apache web server requests. Attackers inject template syntax to execute arbitrary code on the server through template engines like Jinja2, Twig, Freemarker, or Velocity.
+
+Next Steps:
+1. Review the request URL and parameters for template injection payloads
+2. Identify the template engine used by the target application
+3. Check if any payloads were successfully rendered or executed
+4. Review application code for unsafe template rendering
+5. Implement input sanitization and template sandboxing
+6. Block the source IP if confirmed malicious
+', '["https://portswigger.net/research/server-side-template-injection","https://attack.mitre.org/techniques/T1059/"]', 'exists("origin.ip") &&
+exists("origin.path") &&
+(
+ regexMatch("origin.path", "(?i)\\{\\{[0-9]+\\*[0-9]+\\}\\}") ||
+ regexMatch("origin.path", "(?i)\\$\\{[0-9]+\\*[0-9]+\\}") ||
+ regexMatch("origin.path", "(?i)\\{\\{.*config.*\\}\\}") ||
+ regexMatch("origin.path", "(?i)\\{\\{.*__class__.*\\}\\}") ||
+ regexMatch("origin.path", "(?i)\\{\\{.*__import__.*\\}\\}") ||
+ regexMatch("origin.path", "(?i)\\{\\{.*__builtins__.*\\}\\}") ||
+ regexMatch("origin.path", "(?i)\\$\\{.*Runtime.*\\}") ||
+ regexMatch("origin.path", "(?i)\\$\\{.*getRuntime.*\\}") ||
+ regexMatch("origin.path", "(?i)#\\{.*Runtime.*\\}") ||
+ contains("origin.path", "${T(java.lang") ||
+ contains("origin.path", "#{T(java.lang") ||
+ contains("origin.path", "__mro__") ||
+ contains("origin.path", "__subclasses__") ||
+ contains("origin.path", "{{request.") ||
+ contains("origin.path", "${request.")
+)
+', '2026-02-09 16:37:02.331526', true, false, 'origin', null, '[{"indexPattern":"v11-log-apache-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"origin.path","operator":"filter_match","value":"__class__ OR __import__ OR Runtime OR __subclasses__ OR __mro__"}],"or":null,"within":"now-10m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (218, 'Apache Web Shell Access Detection', 3, 3, 2, 'Persistence', 'T1505.003 - Server Software Component: Web Shell', 'Detects access to known web shell file paths and suspicious PHP/JSP/ASP file access patterns that indicate web shell activity. Web shells provide persistent remote access to compromised web servers.
+
+Next Steps:
+1. Immediately investigate the accessed file path on the web server
+2. Check if the file exists and examine its contents for malicious code
+3. Review file creation timestamps and upload vectors
+4. Scan the web directory for additional web shells
+5. Check for lateral movement from the web server
+6. Remove the web shell and patch the upload vulnerability
+', '["https://www.microsoft.com/en-us/security/blog/2021/02/11/web-shell-attacks-continue-to-rise/","https://attack.mitre.org/techniques/T1505/003/"]', 'exists("origin.ip") &&
+exists("origin.path") &&
+(
+ regexMatch("origin.path", "(?i)/(c99|r57|b374k|alfa|wso|madspot|mini|phpspy|cgitelnet|shell|cmd|eval|backdoor|hack|upload|filemanager)\\.(php|jsp|asp|aspx|cgi)") ||
+ regexMatch("origin.path", "(?i)/(wp-content|wp-includes|wp-admin)/.*\\.(php|phtml|php[3-7])\\?.*=") ||
+ regexMatch("origin.path", "(?i)\\.(php|jsp|asp|aspx)\\?(cmd|exec|command|shell|c|e|id|pass)=") ||
+ contains("origin.path", "/webshell") ||
+ contains("origin.path", "/c99.php") ||
+ contains("origin.path", "/r57.php") ||
+ contains("origin.path", "/b374k.php") ||
+ contains("origin.path", "/WSO.php") ||
+ contains("origin.path", "/alfa.php") ||
+ contains("origin.path", "/adminer.php") ||
+ contains("origin.path", "/phpspy.php")
+) &&
+greaterOrEqual("log.statusCode", 200) &&
+lessThan("log.statusCode", 400)
+', '2026-02-09 16:37:02.466959', true, false, 'origin', null, '[]', '["adversary.ip","adversary.path"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (219, 'Apache XXE Injection Attack Detection', 3, 2, 2, 'XML Injection', 'T1190 - Exploit Public-Facing Application', 'Detects XML External Entity (XXE) injection payloads in Apache web server requests. XXE attacks can lead to file disclosure, SSRF, denial of service, and remote code execution by exploiting XML parsers that process external entity definitions.
+
+Next Steps:
+1. Review the request body and headers for XML payloads with external entities
+2. Identify the application endpoint processing XML input
+3. Check if sensitive files were disclosed (e.g., /etc/passwd, web.config)
+4. Disable external entity processing in XML parsers
+5. Implement input validation for XML content
+6. Block the source IP if confirmed malicious
+', '["https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing","https://attack.mitre.org/techniques/T1190/"]', 'exists("origin.ip") &&
+(
+ (exists("origin.path") && (
+ regexMatch("origin.path", "(?i)]*>") ||
+ regexMatch("target.path", "(?i)(onerror|onload|onmouseover|onclick|onfocus|onblur)\\s*=") ||
+ contains("target.path", "javascript:") ||
+ contains("target.path", "vbscript:") ||
+ regexMatch("target.path", "(?i)<(img|svg|body|iframe|input|div|a)\\s+[^>]*(on\\w+)=") ||
+ contains("target.path", "%3Cscript") ||
+ contains("target.path", "%3cscript") ||
+ regexMatch("target.path", "(?i)document\\.(cookie|location|write)") ||
+ regexMatch("target.path", "(?i)(alert|confirm|prompt)\\s*\\(") ||
+ contains("target.path", "<script") ||
+ contains("target.path", "data:text/html")
+)
+', '2026-02-09 16:37:07.071599', true, false, 'origin', null, '[{"indexPattern":"v11-log-iis-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.path","operator":"filter_match","value":"script OR onerror OR onload OR javascript OR alert"}],"or":null,"within":"now-10m","count":5}]', '["adversary.ip","target.path"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (434, 'System Linux: System Log File Deletion', 3, 3, 3, 'Defense Evasion', 'T1070.002 - Indicator Removal', 'Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1070/002/"]', 'regexMatch("log.message", "(/var/run/utmp|/var/log/wtmp|/var/log/btmp|/var/log/lastlog|/var/log/faillog|/var/log/syslog|/var/log/messages|/var/log/secure|/var/log/auth.log|/var/log/boot.log|/var/log/kern.log)") && !contains("log.message", "gzip") && regexMatch("log.message", "(rm |shred -u)")', '2026-02-09 16:51:29.207828', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (250, 'IIS ISAPI Filter Exploitation Attempt', 3, 3, 3, 'Lateral Movement', 'T1210 - Exploitation of Remote Services', 'Detects attempts to exploit ISAPI filter vulnerabilities in IIS, including buffer overflow attempts and malicious extension access patterns. This rule identifies suspicious requests targeting DLL files, script directories, and other ISAPI-related endpoints that could indicate exploitation attempts.
+
+Next Steps:
+1. Analyze the target path and HTTP method to understand the attack vector
+2. Review the response time and status code for signs of successful exploitation
+3. Examine the user agent string for embedded script content or encoding
+4. Check for additional requests from the same IP to identify attack patterns
+5. Verify if the targeted ISAPI extensions are legitimate and properly secured
+6. Review IIS logs for any successful authentication or privilege escalation
+7. Implement additional monitoring for the affected server and check for signs of persistence
+8. Review firewall logs to identify any outbound connections from the compromised system
+', '["https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/","https://attack.mitre.org/techniques/T1210/"]', 'exists("target.path") &&
+greaterOrEqual("log.statusCode", 200) &&
+(
+ (contains("target.path", ".dll") && equals("log.method", "POST")) ||
+ (contains("target.path", "/scripts/") && contains("target.path", ".ida")) ||
+ (contains("target.path", "/scripts/") && contains("target.path", ".idq")) ||
+ (contains("target.path", "/_vti_bin/") && greaterThan("log.responseTime", 5000)) ||
+ (contains("log.userAgent", "<%") || contains("log.userAgent", "%3C%25")) ||
+ (regexMatch("target.path", ".*\\.(printer|idc|stm|shtm|shtml).*") && equals("log.method", "POST"))
+)
+', '2026-02-09 16:37:07.217495', true, false, 'origin', null, '[{"indexPattern":"v11-log-iis-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-10m","count":3}]', '["adversary.ip","target.path"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (251, 'IIS 8.3 Short Filename Enumeration Attack', 3, 2, 1, 'Discovery', 'T1083 - Discovery: File and Directory Discovery', 'Detects attempts to enumerate 8.3 short filenames using the tilde (~) character, which can reveal sensitive file and directory names on IIS servers. This attack technique exploits the Windows 8.3 filename convention to discover files and directories that may not be publicly accessible through normal browsing.
+
+Next Steps:
+1. Review the source IP addresses attempting this enumeration
+2. Check if any sensitive files or directories were successfully discovered
+3. Verify IIS configuration to disable 8.3 filename generation if not needed
+4. Implement request filtering to block requests containing tilde characters
+5. Monitor for subsequent attacks from the same sources
+6. Consider implementing rate limiting for suspicious request patterns
+', '["https://attack.mitre.org/techniques/T1083/","https://soroush.secproject.com/blog/2014/07/iis-short-file-name-disclosure-vulnerability/"]', 'contains("target.path", "~") &&
+(regexMatch("target.path", ".*~[0-9].*") || regexMatch("target.path", ".*~[0-9]\\*.*")) &&
+(equals("log.statusCode", 404) || equals("log.statusCode", 400) || equals("log.statusCode", 200)) &&
+(equals("log.subStatusCode", 0) || equals("log.subStatusCode", 2)) &&
+!regexMatch("target.path", "(?i).*\\.(css|js|jpg|jpeg|png|gif|ico).*")
+', '2026-02-09 16:37:07.361919', true, false, 'origin', '["adversary.ip","target.path"]', '[{"indexPattern":"v11-log-iis-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.path","operator":"filter_match","value":"~"}],"or":null,"within":"now-5m","count":10}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (252, 'IIS Unicode Bypass Directory Traversal Attack', 3, 3, 2, 'Defense Evasion', 'T1027 - Obfuscated Files or Information', 'Detects Unicode encoding bypass attempts including overlong UTF-8 sequences and alternative Unicode representations used to evade security filters and access restricted files. This attack exploits Unicode normalization vulnerabilities in IIS to traverse directories and access sensitive system files.
+
+**Next Steps:**
+1. Examine the full HTTP request including headers and POST data
+2. Check if the attack was successful by reviewing response codes and content lengths
+3. Verify what files or directories were accessed during the attack
+4. Review server logs for any executed commands or accessed sensitive files
+5. Check for other suspicious activity from the same source IP
+6. Implement proper input validation and Unicode normalization
+7. Consider blocking the source IP if attack continues
+', '["https://www.kb.cert.org/vuls/id/111677","https://attack.mitre.org/techniques/T1027/"]', 'contains("target.path", "%c0%af") || contains("target.path", "%c0%ae") ||
+contains("target.path", "%c1%9c") || contains("target.path", "%c0%2f") ||
+contains("target.path", "%c0%5c") || contains("target.path", "%c1%8s") ||
+contains("target.path", "%c1%1c") || contains("target.path", "%c1%af") ||
+contains("target.path", "%e0%80%af") || contains("target.path", "%f0%80%80%af") ||
+contains("target.path", "%u2215") || contains("target.path", "%u2216") ||
+contains("target.path", "%uff0e") || contains("target.path", "..%c0%af") ||
+(contains("target.path", "winnt") && contains("target.path", "system32")) ||
+(contains("target.path", "cmd.exe") || contains("target.path", "command.com"))
+', '2026-02-09 16:37:07.491405', true, false, 'origin', null, '[{"indexPattern":"v11-log-iis-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-5m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (253, 'Virtual Directory Traversal Attack', 3, 3, 2, 'Discovery', 'T1083 - File and Directory Discovery', 'Detects attempts to traverse directories and access files outside the web root through various encoding techniques and traversal sequences. This attack attempts to access files and directories that are stored outside the web root folder by using relative file paths that contain ''../'' or similar sequences. Attackers may use various encoding techniques to bypass security filters.
+
+Next Steps:
+- Review the source IP and user agent for suspicious patterns
+- Check if the requests resulted in successful responses (200, 301, 302 status codes)
+- Examine the full request path and identify what files were being accessed
+- Verify web application security controls and input validation
+- Check for other suspicious activity from the same source IP
+- Review IIS logs for any successful file access outside the web root
+- Consider blocking the source IP if malicious intent is confirmed
+', '["https://owasp.org/www-community/attacks/Path_Traversal","https://attack.mitre.org/techniques/T1083/"]', '(
+ regexMatch("target.path", ".*\\.\\.[\\\\/].*") ||
+ regexMatch("target.path", ".*%2e%2e[\\\\/].*") ||
+ regexMatch("target.path", ".*%252e%252e.*") ||
+ regexMatch("target.path", ".*%c0%ae%c0%ae.*") ||
+ regexMatch("target.path", ".*%e0%80%ae%e0%80%ae.*") ||
+ regexMatch("target.path", ".*/Windows/System32/.*") ||
+ regexMatch("target.path", ".*/boot\\.ini.*") ||
+ regexMatch("target.path", ".*/win\\.ini.*") ||
+ regexMatch("target.path", ".*/web\\.config.*") ||
+ regexMatch("target.path", ".*/applicationHost\\.config.*")
+) &&
+exists("target.ip")
+', '2026-02-09 16:37:07.641931', true, false, 'origin', '["adversary.ip","target.ip"]', '[{"indexPattern":"v11-log-iis-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":3}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (435, 'System Linux: Modification of OpenSSH Binaries', 3, 3, 2, 'Persistence', 'T1543 - Create or Modify System Process', 'Adversaries may modify SSH related binaries for persistence or credential access by patching sensitive functions to enable unauthorized access or by logging SSH credentials for exfiltration.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1543/"]', 'regexMatch("log.message", "libkeyutils.so") && !regexMatch("log.message", "(dpkg|yum|dnf|dnf-automatic)") && regexMatch("log.message", "(/usr/sbin/sshd|/usr/bin/ssh|/usr/bin/sftp|/usr/bin/scp)")', '2026-02-09 16:51:29.367617', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (254, 'IIS Web Shell Upload Detection', 3, 3, 1, 'Initial Access', 'T1505.003 - Server Software Component: Web Shell', 'Detects potential web shell uploads based on suspicious file extensions and POST requests to uncommon paths. This rule identifies POST requests to ASP.NET-related file extensions in suspicious directory paths commonly used for web shell placement.
+
+Next Steps:
+1. Immediately investigate the target server and file path for uploaded web shells
+2. Check file system for recently uploaded .aspx, .asp, .asmx, .ashx, or .axd files
+3. Review IIS logs for additional suspicious requests from the same source IP
+4. Examine the uploaded file content for malicious code
+5. Check for privilege escalation attempts following the upload
+6. Review authentication logs for compromised accounts
+7. Implement file upload restrictions and input validation
+8. Block the source IP if confirmed malicious
+9. Scan the entire web directory for additional web shells
+10. Review recent file modifications on the web server
+', '["https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://attack.mitre.org/techniques/T1505/003/"]', 'equals("log.method", "POST") &&
+exists("target.path") &&
+(
+ contains("target.path", ".aspx") ||
+ contains("target.path", ".asp") ||
+ contains("target.path", ".asmx") ||
+ contains("target.path", ".ashx") ||
+ contains("target.path", ".axd")
+) &&
+(
+ regexMatch("target.path", "(?i)upload") ||
+ regexMatch("target.path", "(?i)temp") ||
+ regexMatch("target.path", "(?i)tmp") ||
+ regexMatch("target.path", "(?i)test") ||
+ regexMatch("target.path", "(?i)shell") ||
+ regexMatch("target.path", "(?i)cmd") ||
+ regexMatch("target.path", "(?i)eval") ||
+ regexMatch("target.path", "(?i)exec") ||
+ regexMatch("target.path", "(?i)webshell") ||
+ regexMatch("target.path", "(?i)backdoor")
+) &&
+greaterOrEqual("log.statusCode", 200) &&
+lessThan("log.statusCode", 300)
+', '2026-02-09 16:37:07.793258', true, false, 'origin', null, '[]', '["adversary.ip","target.path"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (255, 'Kibana Dev Tools Dangerous Query Detection', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects dangerous queries executed via Kibana Dev Tools console including index deletions, security setting changes, user creation, and role modifications. Dev Tools provides direct API access that can be abused by compromised accounts.
+
+Next Steps:
+1. Review the queries executed through Dev Tools
+2. Identify the user account and session
+3. Check if any destructive operations succeeded
+4. Restrict Dev Tools access to authorized administrators
+5. Review Kibana role assignments for over-privileged users
+6. Enable audit logging for Kibana API actions
+', '["https://www.elastic.co/guide/en/kibana/current/console-kibana.html","https://attack.mitre.org/techniques/T1059/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "console") && (
+ contains("log.message", "DELETE /") ||
+ contains("log.message", "_security/user") ||
+ contains("log.message", "_security/role") ||
+ contains("log.message", "_cluster/settings") ||
+ contains("log.message", "_snapshot") ||
+ contains("log.message", "_scripts") ||
+ contains("log.message", "_reindex")
+ )) ||
+ (contains("log.message", "dev_tools") && contains("log.message", "execute"))
+)
+', '2026-02-09 16:37:07.921649', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (256, 'Kibana Mass Report Export Exfiltration Detection', 3, 1, 1, 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 'Detects mass report generation and CSV exports from Kibana that could indicate data exfiltration. Attackers with Kibana access can export large datasets via the reporting feature.
+
+Next Steps:
+1. Review the reports generated and their data content
+2. Verify the user account and export authorization
+3. Check the report download destinations
+4. Restrict reporting permissions to authorized users
+5. Implement data export limits and approval workflows
+6. Monitor for large data downloads from Kibana
+', '["https://www.elastic.co/guide/en/kibana/current/reporting-getting-started.html","https://attack.mitre.org/techniques/T1048/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "reporting") && contains("log.message", "generate")) ||
+ (contains("log.message", "csv_searchsource") && contains("log.message", "created")) ||
+ (contains("log.message", "report") && contains("log.message", "export")) ||
+ (contains("log.message", "/api/reporting/generate") && exists("origin.ip")) ||
+ (contains("log.message", "csv") && contains("log.message", "download"))
+)
+', '2026-02-09 16:37:08.066867', true, false, 'origin', null, '[{"indexPattern":"v11-log-kibana-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.message","operator":"filter_match","value":"reporting OR csv OR export OR generate"}],"or":null,"within":"now-30m","count":5}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (257, 'Kibana Malicious Saved Object Import Detection', 3, 3, 2, 'Code Execution', 'T1059 - Command and Scripting Interpreter', 'Detects potentially malicious saved object imports in Kibana that could include crafted visualizations, dashboards, or scripted fields designed to execute code or exfiltrate data.
+
+Next Steps:
+1. Review the imported saved objects for malicious content
+2. Check for scripted fields in imported index patterns
+3. Verify the import source and user authorization
+4. Remove suspicious saved objects immediately
+5. Review Kibana scripted field permissions
+6. Restrict saved object import to administrator roles
+', '["https://www.elastic.co/guide/en/kibana/current/saved-objects-api-import.html","https://attack.mitre.org/techniques/T1059/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "saved_objects") && contains("log.message", "_import")) ||
+ (contains("log.message", "import") && contains("log.message", "saved object")) ||
+ (contains("log.message", "saved_objects/_bulk_create") && exists("origin.ip")) ||
+ (contains("log.message", "scripted_field") && contains("log.message", "created")) ||
+ (contains("log.message", "visualization") && contains("log.message", "import") && contains("log.message", "script"))
+)
+', '2026-02-09 16:37:08.201941', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (258, 'Potential Session Hijacking Activity', 3, 3, 2, 'Collection', 'T1185 - Browser Session Hijacking', 'Detects potential session hijacking activities based on suspicious authentication patterns, multiple IP addresses using the same session, or rapid location changes that may indicate stolen session tokens.
+
+Next Steps:
+1. Investigate the user account and recent login patterns
+2. Check for concurrent sessions from different IP addresses or locations
+3. Review session activity logs for unusual behavior patterns
+4. Verify if the user reported any suspicious activity
+5. Consider forcing session termination and requiring re-authentication
+6. Check for any recent credential compromise indicators
+7. Review security controls on user workstations and browsers
+', '["https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html","https://attack.mitre.org/techniques/T1185/"]', 'contains("log.actionMessage", "http_request") &&
+exists("origin.user") &&
+(contains("log.actionMessage", "session") ||
+ contains("log.component", "security")) &&
+(equals("actionResult", "failure") ||
+ equals("log.severityLabel", "warning") ||
+ equals("log.severityLabel", "error"))
+', '2026-02-09 16:37:08.331295', true, false, 'origin', null, '[{"indexPattern":"v11-log-kibana-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-1h","count":20},{"indexPattern":"v11-log-kibana-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"origin.ip","operator":"must_not_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":1}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (259, 'XSS Attack Attempt Detection', 3, 3, 1, 'Execution', 'T1059.007 - Cross-Site Scripting', 'Detects potential XSS attack attempts in Kibana through malicious script injection in search queries, field formatters, or visualization titles. This rule identifies common XSS patterns including script tags, JavaScript execution, and event handlers that could indicate an attempt to inject malicious code into Kibana interfaces.
+
+Next Steps:
+1. Review the specific log message and action that triggered this alert
+2. Check the user''s recent activity in Kibana for other suspicious actions
+3. Examine the affected Kibana component for potential compromise
+4. Review Kibana access logs for the source IP and user
+5. Consider blocking the source IP if malicious activity is confirmed
+6. Update Kibana security configurations and input validation
+7. Implement Content Security Policy (CSP) headers to prevent XSS execution
+8. Review and sanitize all user inputs in Kibana dashboards and visualizations
+', '["https://www.elastic.co/guide/en/kibana/current/security-best-practices.html","https://attack.mitre.org/techniques/T1059/007/"]', '(equals("log.component", "visualize") ||
+ equals("log.component", "discover") ||
+ equals("log.component", "security")) &&
+(
+ regexMatch("log.actionMessage", ".*.*.*") ||
+ contains("log.actionMessage", "javascript:") ||
+ contains("log.actionMessage", "onerror=") ||
+ contains("log.actionMessage", "onload=") ||
+ contains("log.actionMessage", " 1000) ||
+ (regexMatch("log.msg", "(?i)KEYS\\s+\\*") && !equals("log.levelEnc", "debug")) ||
+ (regexMatch("log.msg", "(?i)(SCAN|HSCAN|SSCAN|ZSCAN)\\s+\\d+\\s+MATCH\\s+\\*\\s+COUNT\\s+[1-9]\\d{3,}")) ||
+ (regexMatch("log.msg", "(?i)(BGSAVE|SAVE|LASTSAVE)") && regexMatch("log.msg", "(?i)(remote|external|http|ftp)")) ||
+ (regexMatch("log.msg", "(?i)SELECT\\s+\\d+") && regexMatch("log.msg", "(?i)(KEYS\\s+\\*|SCAN\\s+0)")) ||
+ (regexMatch("log.msg", "(?i)MIGRATE\\s+\\d+\\.\\d+\\.\\d+\\.\\d+")) ||
+ (regexMatch("log.msg", "(?i)(GET|HGETALL|SMEMBERS|ZRANGE).*") && regexMatch("log.msg", "(?i)(password|secret|token|api[_-]?key|private[_-]?key)"))
+)
+', '2026-02-09 16:37:16.006831', true, false, 'origin', null, '[{"indexPattern":"v11-log-redis-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-30m","count":10}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (308, 'Redis Lua Script Injection Attack', 3, 3, 3, 'Execution', 'Script Injection', 'Detects potential Lua script injection attacks in Redis including malicious EVAL/EVALSHA commands, script-based exploitation attempts, or suspicious scripting activity.
+
+Next Steps:
+1. Immediately review the Redis logs to identify the source of the suspicious script commands
+2. Check if the Redis instance is exposed to untrusted networks
+3. Verify that Redis authentication is properly configured and strong passwords are in use
+4. Review all Lua scripts loaded into Redis for malicious code
+5. Consider implementing command blacklisting for EVAL/EVALSHA if not required
+6. Monitor for any unauthorized data access or modification following the alert
+7. If compromise is confirmed, rotate Redis passwords and review all stored data for tampering
+', '["https://antirez.com/news/119","https://redis.io/docs/latest/develop/interact/programmability/lua-debugging/","https://attack.mitre.org/techniques/T1059/007/"]', 'exists("log.message") && (
+ contains("log.message", "Cross Protocol Scripting") ||
+ (contains("log.message", "POST") && contains("log.message", "Host:")) ||
+ (contains("log.message", "EVAL") && contains("log.message", ["os.execute", "io.popen", "io.open", "loadfile", "dofile"])) ||
+ contains("log.message", "Lua script attempted to access") ||
+ (contains("log.message", "lua") && contains("log.message", "attack"))
+)
+', '2026-02-09 16:37:16.166915', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (309, 'Redis Persistence Mechanism Abuse Detected', 3, 3, 2, 'Persistence', 'T1505: Server Software Component', 'Detects attempts to abuse Redis persistence mechanisms for maintaining unauthorized access, including suspicious RDB/AOF operations, module loading for backdoors, or configuration changes to establish persistence.
+
+Next Steps:
+1. Immediately review the Redis server configuration changes and module operations
+2. Check if any unauthorized modules were loaded using MODULE LIST command
+3. Examine Redis data directory for suspicious files (crontab, authorized_keys, shell scripts)
+4. Review Redis access logs for the source IP and authentication method used
+5. Verify if RDB/AOF files have been written to unusual locations
+6. Check system cron jobs and SSH authorized_keys for signs of compromise
+7. Consider rotating Redis passwords and implementing ACL restrictions
+8. Enable Redis command logging if not already active for forensic analysis
+', '["https://medium.com/@knownsec404team/rce-exploits-of-redis-based-on-master-slave-replication-ef7a664ce1d0","https://attack.mitre.org/techniques/T1505/"]', 'exists("log.message") && (
+ (regexMatch("log.message", "(?i)CONFIG\\s+SET\\s+(save|appendonly|appendfsync|aof-rewrite)")) ||
+ (regexMatch("log.message", "(?i)MODULE\\s+LOAD\\s+") && !regexMatch("log.message", "(?i)(redis[_-]?search|redis[_-]?graph|redis[_-]?timeseries|redis[_-]?json|redis[_-]?bloom)")) ||
+ (regexMatch("log.message", "(?i)CONFIG\\s+SET\\s+dir\\s+/(root|home|usr|etc|var/spool/cron)")) ||
+ (regexMatch("log.message", "(?i)CONFIG\\s+SET\\s+dbfilename\\s+(crontab|authorized_keys|passwd|shadow|\\.bashrc|\\.profile)")) ||
+ (regexMatch("log.message", "(?i)(BGREWRITEAOF|BGSAVE)") && regexMatch("log.message", "(?i)(ssh|cron|bash|shell)")) ||
+ (equals("log.roleEnc", "master") && regexMatch("log.message", "(?i)Synchronization\\s+with\\s+replica.*module\\s+load")) ||
+ (regexMatch("log.message", "(?i)MODULE\\s+(LIST|UNLOAD)") && equals("log.levelEnc", "error"))
+)
+', '2026-02-09 16:37:16.326627', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (310, 'Redis ACL Manipulation Detection', 3, 3, 2, 'Persistence', 'T1098 - Account Manipulation', 'Detects manipulation of Redis ACL to create backdoor accounts, modify existing user permissions, or disable authentication. Attackers use ACL SETUSER to create persistent access with full privileges.
+
+Next Steps:
+1. Review the ACL changes to identify unauthorized user modifications
+2. List all current Redis users with ACL LIST
+3. Remove unauthorized user accounts
+4. Verify the default user is properly restricted
+5. Check for requirepass/masterauth changes
+6. Implement ACL file persistence and monitoring
+', '["https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/","https://attack.mitre.org/techniques/T1098/"]', 'exists("log.message") &&
+(
+ regexMatch("log.message", "(?i)ACL\\s+SETUSER") ||
+ regexMatch("log.message", "(?i)ACL\\s+DELUSER") ||
+ regexMatch("log.message", "(?i)ACL\\s+SAVE") ||
+ regexMatch("log.message", "(?i)ACL\\s+LOAD") ||
+ regexMatch("log.message", "(?i)CONFIG\\s+SET\\s+requirepass") ||
+ regexMatch("log.message", "(?i)CONFIG\\s+SET\\s+masterauth") ||
+ (contains("log.message", "ACL SETUSER") && contains("log.message", "allcommands")) ||
+ (contains("log.message", "ACL SETUSER") && contains("log.message", "allkeys"))
+)
+', '2026-02-09 16:37:16.476558', true, false, 'origin', null, '[{"indexPattern":"v11-log-redis-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-10m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (311, 'Redis Data Destruction Detection', 1, 3, 3, 'Data Destruction', 'T1485 - Data Destruction', 'Detects Redis data destruction commands including FLUSHALL, FLUSHDB, and DEBUG SLEEP that could indicate an attacker wiping data or preparing for ransomware. These commands irreversibly delete all data from Redis databases.
+
+Next Steps:
+1. Verify if the FLUSH command was authorized
+2. Check if RDB/AOF persistence files are intact for recovery
+3. Identify the source of the destructive command
+4. Restore data from backups immediately if unauthorized
+5. Restrict FLUSH commands via Redis ACL
+6. Monitor for ransom messages or follow-up demands
+', '["https://redis.io/docs/latest/commands/flushall/","https://attack.mitre.org/techniques/T1485/"]', 'exists("log.message") &&
+(
+ regexMatch("log.message", "(?i)FLUSHALL") ||
+ regexMatch("log.message", "(?i)FLUSHDB") ||
+ regexMatch("log.message", "(?i)DEBUG\\s+SET-ACTIVE-EXPIRE") ||
+ (contains("log.message", "CONFIG SET") && contains("log.message", "save") && contains("log.message", "\"\"")) ||
+ regexMatch("log.message", "(?i)CONFIG\\s+SET\\s+appendonly\\s+no")
+)
+', '2026-02-09 16:37:16.631959', true, false, 'origin', null, '[{"indexPattern":"v11-log-redis-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-10m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (312, 'Redis Rogue Replication Attack Detection', 3, 3, 3, 'Exploitation', 'T1210 - Exploitation of Remote Services', 'Detects rogue Redis replication attacks using SLAVEOF or REPLICAOF commands to connect the target Redis instance to an attacker-controlled server. This technique is used to load malicious Redis modules, exfiltrate data, or achieve remote code execution.
+
+Next Steps:
+1. Verify the replication target address is a legitimate Redis master
+2. Check for any loaded modules after the replication command
+3. Review Redis configuration for unauthorized changes
+4. Disconnect from the rogue master using REPLICAOF NO ONE
+5. Check for data exfiltration or corruption
+6. Restrict SLAVEOF/REPLICAOF commands via ACL
+', '["https://redis.io/docs/latest/operate/oss_and_stack/management/replication/","https://attack.mitre.org/techniques/T1210/"]', 'exists("log.message") &&
+(
+ regexMatch("log.message", "(?i)(SLAVEOF|REPLICAOF)\\s+[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+") ||
+ regexMatch("log.message", "(?i)(SLAVEOF|REPLICAOF)\\s+\\w+") ||
+ (contains("log.message", "MASTER <-> REPLICA") && contains("log.message", "sync started")) ||
+ (contains("log.message", "Connecting to MASTER") && !contains("log.message", "already connected")) ||
+ contains("log.message", "FULLRESYNC") ||
+ regexMatch("log.message", "(?i)MODULE\\s+LOAD")
+) &&
+!contains("log.message", "REPLICAOF NO ONE") &&
+!contains("log.message", "SLAVEOF NO ONE")
+', '2026-02-09 16:37:16.781895', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (313, 'Redis Unauthorized Access Pattern Detected', 3, 3, 2, 'Initial Access', 'T1078 - Valid Accounts', 'Detects patterns indicative of unauthorized access attempts to Redis including authentication failures, dangerous command usage without authentication, or attempts to bypass security restrictions. This rule identifies potential Redis security breaches through analysis of log messages for authentication failures, dangerous administrative commands, and unauthorized client activities.
+
+Next Steps:
+1. Verify the legitimacy of the Redis client connection from the identified origin host
+2. Check Redis authentication configuration and ensure AUTH is properly enabled
+3. Review Redis configuration for exposed dangerous commands (FLUSHALL, FLUSHDB, CONFIG)
+4. Investigate if any data was compromised during the unauthorized access attempt
+5. Consider implementing Redis ACLs and restricting dangerous commands
+6. Monitor for data exfiltration attempts from the affected Redis instance
+', '["https://medium.com/@Victor.Z.Zhu/redis-unauthorized-access-vulnerability-simulation-victor-zhu-ac7a71b2e419","https://attack.mitre.org/techniques/T1078/"]', 'exists("log.msg") && (
+ (regexMatch("log.msg", "(?i)(AUTH\\s+failed|invalid\\s+password|authentication\\s+required)")) ||
+ (regexMatch("log.msg", "(?i)(FLUSHALL|FLUSHDB|CONFIG\\s+(GET|SET)|KEYS\\s+\\*|SCAN\\s+0)") && equals("log.severity", "warning")) ||
+ (regexMatch("log.msg", "(?i)CONFIG\\s+SET\\s+(dir\\s+/|dbfilename\\s+authorized_keys)")) ||
+ (regexMatch("log.msg", "(?i)(SAVE|BGSAVE).*ssh|authorized_keys")) ||
+ (regexMatch("log.msg", "(?i)Client\\s+id=\\d+\\s+addr=.*\\s+name=.*\\s+cmd=(flushall|flushdb|config)")) ||
+ (equals("log.severity", "high") && regexMatch("log.msg", "(?i)(Possible\\s+security\\s+attack|unauthorized\\s+client)"))
+)
+', '2026-02-09 16:37:16.916919', true, false, 'origin', null, '[{"indexPattern":"v11-log-redis-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-10m","count":5}]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (314, 'AWS SSM Agent Hijacking - Unauthorized Registration', 3, 3, 3, 'Command and Control', 'T1219 - Remote Access Software', 'Detects unauthorized re-registration of the AWS Systems Manager (SSM) agent with a different AWS account. Attackers with local access to an EC2 instance can re-register the SSM agent to their own AWS account, gaining persistent remote command execution capability through a legitimate AWS service. This technique is particularly dangerous because SSM traffic blends with normal AWS API calls.
+
+Next Steps:
+1. Verify the SSM agent registration is pointing to the correct AWS account
+2. Check the activation code and ID used in the registration
+3. Compare the SSM agent configuration with expected values from your AWS account
+4. Review SSM session history for unauthorized command execution
+5. Check CloudTrail logs for SSM API calls from unexpected accounts
+6. Re-register the SSM agent with your legitimate AWS account
+7. Investigate how the attacker gained local access to the instance
+8. Rotate all credentials accessible from the compromised instance
+', '["https://attack.mitre.org/techniques/T1219/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml","https://www.mitiga.io/blog/new-attack-vector-aws-ssm-agent-as-a-remote-access-trojan"]', 'exists("log.message") &&
+regexMatch("log.message", "(?i)amazon-ssm-agent\\s+.*-register\\s+.*-(code|id|region)")
+', '2026-02-09 16:39:06.621928', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (315, 'Base64 Decode Piped to Shell Execution', 3, 3, 2, 'Defense Evasion', 'T1140 - Deobfuscate/Decode Files or Information', 'Detects base64-encoded content being decoded and piped directly to bash or sh for execution. This is an extremely common technique used by malware droppers, initial access scripts, and post-exploitation frameworks to evade detection by encoding malicious commands. Legitimate use of base64 piped to shell execution is very rare in production environments.
+
+Next Steps:
+1. Capture and decode the base64 payload to understand what was executed
+2. Identify the source of the encoded command (downloaded file, cron job, web request)
+3. Check for persistence mechanisms installed by the decoded payload
+4. Review network connections for C2 communication
+5. Search for similar base64 patterns across all systems
+6. Investigate the user account and parent process chain
+7. Look for file drops or modifications made by the executed payload
+', '["https://attack.mitre.org/techniques/T1140/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)base64\\s+-d.*\\|\\s*(ba)?sh") ||
+ regexMatch("log.message", "(?i)base64\\s+--decode.*\\|\\s*(ba)?sh") ||
+ regexMatch("log.message", "(?i)echo\\s+.*\\|\\s*base64\\s+-d\\s*\\|\\s*(ba)?sh") ||
+ regexMatch("log.message", "(?i)\\|\\s*base64\\s+-(d|decode)\\s*\\|\\s*(ba)?sh"))
+', '2026-02-09 16:39:06.727070', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (316, 'BPFDoor Backdoor Indicators', 3, 3, 3, 'Malware Detection', 'T1205.002 - Traffic Signaling: Socket Filters', 'Detects indicators of the BPFDoor backdoor, a sophisticated Linux malware used by APT groups (particularly Red Menshen/DecisiveArchitect). BPFDoor uses Berkeley Packet Filters (BPF) to monitor network traffic and respond to magic packets, making it extremely stealthy. It hides by deleting its own binary and running from memory, using specific file paths and socket operations.
+
+Next Steps:
+1. THIS IS A HIGH-CONFIDENCE APT INDICATOR - immediately activate incident response
+2. Isolate the affected host but preserve running processes for memory analysis
+3. Check for BPF socket filters attached to network interfaces
+4. Look for processes with deleted binary files (ls -la /proc/*/exe | grep deleted)
+5. Search for BPFDoor-specific files: /var/run/haldrund.pid, /dev/shm/kdmtmpflush
+6. Capture full memory dump before any remediation
+7. Hunt for lateral movement and other compromised hosts
+8. Engage threat intelligence team for APT attribution
+', '["https://attack.mitre.org/techniques/T1205/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml","https://www.trendmicro.com/en_us/research/23/e/bpfdoor-linux-backdoor.html"]', 'exists("log.message") &&
+(contains("log.message", "/var/run/haldrund.pid") ||
+ contains("log.message", "/dev/shm/kdmtmpflush") ||
+ contains("log.message", "kdmtmpflush") ||
+ contains("log.message", "haldrund") ||
+ regexMatch("log.message", "(?i)/tmp/\\.(lock|font|pid)") ||
+ (contains("log.message", "BPF") && contains("log.message", "socket")) ||
+ contains("log.message", "bpfdoor"))
+', '2026-02-09 16:39:06.890835', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (317, 'Bash /dev/tcp Reverse Shell Detected', 3, 3, 3, 'Command and Control', 'T1059.004 - Command and Scripting Interpreter: Unix Shell', 'Detects the classic bash reverse shell pattern using /dev/tcp, including "bash -i >& /dev/tcp/" and "exec 3<>/dev/tcp/" variants. The /dev/tcp pseudo-device is a bash built-in for TCP connections and its use in command lines is almost exclusively malicious. This is one of the most commonly used reverse shell techniques.
+
+Next Steps:
+1. Immediately isolate the affected host from the network
+2. Extract the destination IP and port from the /dev/tcp path
+3. Block the C2 IP at the network perimeter
+4. Identify the user account and process tree that executed the command
+5. Check for initial access vector and persistence mechanisms
+6. Hunt for the same C2 IP across all systems
+7. Perform full forensic analysis of the compromised host
+', '["https://attack.mitre.org/techniques/T1059/004/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_susp_dev_tcp.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)bash\\s+-i\\s+>&\\s*/dev/tcp/") ||
+ regexMatch("log.message", "(?i)exec\\s+\\d+<>/dev/tcp/") ||
+ contains("log.message", "/dev/tcp/"))
+', '2026-02-09 16:39:07.031456', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (318, 'Credential File Copied to Staging Directory', 3, 2, 1, 'Credential Access', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'Detects the copying of credential files (/etc/passwd, /etc/shadow, /etc/gshadow) to world-readable staging directories like /tmp or /dev/shm. This is a direct indicator of credential theft where an attacker stages sensitive files for exfiltration or offline password cracking. Legitimate administrators never copy these files to /tmp.
+
+Next Steps:
+1. Immediately remove the copied credential files from /tmp or /dev/shm
+2. Identify the user account that performed the copy
+3. Check if the shadow file was accessed - if so, assume all local passwords are compromised
+4. Force password resets for all local accounts on the affected system
+5. Investigate how the attacker gained the privileges to read /etc/shadow
+6. Look for exfiltration attempts (scp, curl, nc) from the same host
+7. Check for password cracking tool downloads or execution
+', '["https://attack.mitre.org/techniques/T1552/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)cp\\s+/etc/(passwd|shadow|gshadow)\\s+/tmp") ||
+ regexMatch("log.message", "(?i)cp\\s+/etc/(passwd|shadow|gshadow)\\s+/dev/shm") ||
+ regexMatch("log.message", "(?i)cp\\s+/etc/(passwd|shadow|gshadow)\\s+/var/tmp") ||
+ regexMatch("log.message", "(?i)cat\\s+/etc/(shadow|gshadow)\\s*>\\s*/tmp/") ||
+ regexMatch("log.message", "(?i)cat\\s+/etc/(shadow|gshadow)\\s*>\\s*/dev/shm/"))
+', '2026-02-09 16:39:07.182341', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (319, 'Immutable File Flag Removal via chattr', 1, 3, 2, 'Defense Evasion', 'T1222.002 - File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification', 'Detects the removal of the immutable flag from files using chattr -i. The immutable flag prevents files from being modified or deleted, even by root. Ransomware and rootkits commonly remove this flag before modifying or encrypting protected system files.
+
+Next Steps:
+1. Identify which files had their immutable flag removed
+2. Check if those files were subsequently modified or deleted
+3. Look for ransomware indicators (encryption, ransom notes)
+4. Examine the process and user that executed chattr
+5. Verify the integrity of the affected files
+6. Restore the immutable flag on critical system files
+', '["https://attack.mitre.org/techniques/T1222/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml"]', 'contains("log.message", "chattr") &&
+contains("log.message", "-i")
+', '2026-02-09 16:39:07.331792', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (441, 'System Linux: Potential Protocol Tunneling via EarthWorm', 3, 3, 2, 'Command and Control', 'T1572 - Protocol Tunneling', 'Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems.', '["https://attack.mitre.org/tactics/TA0011/","https://attack.mitre.org/techniques/T1572/"]', 'contains("log.message", "-s") && contains("log.message", "-d") && contains("log.message", "rssocks")', '2026-02-09 16:51:30.327138', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (320, 'Cryptocurrency Mining Command Line Indicators', 1, 2, 3, 'Resource Hijacking', 'T1496 - Resource Hijacking', 'Detects cryptocurrency mining software execution based on distinctive command-line arguments. This includes mining-specific parameters such as --cpu-priority, --donate-level, stratum+tcp://, --algo=rx/0, and other Monero/XMR mining indicators. Unauthorized crypto mining is a common objective of automated Linux exploits and worms.
+
+Next Steps:
+1. Identify and terminate the mining process immediately
+2. Determine the mining pool and wallet address being used
+3. Check CPU utilization to confirm active mining
+4. Investigate how the miner was installed (exploit, compromised credentials, malicious package)
+5. Search for persistence mechanisms (cron jobs, systemd services, init scripts)
+6. Check for additional compromised hosts mining to the same pool
+7. Remove all mining-related files and restore system to clean state
+8. Patch the vulnerability that led to the initial compromise
+', '["https://attack.mitre.org/techniques/T1496/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml"]', 'exists("log.message") &&
+(contains("log.message", "--donate-level") ||
+ contains("log.message", "stratum+tcp://") ||
+ contains("log.message", "stratum+ssl://") ||
+ contains("log.message", "stratum+tls://") ||
+ contains("log.message", "--coin=") ||
+ regexMatch("log.message", "(?i)--algo=(rx/0|cn/|randomx|cryptonight)") ||
+ contains("log.message", "--cpu-priority") ||
+ contains("log.message", "--threads=") ||
+ regexMatch("log.message", "(?i)(xmrig|xmr-stak|cpuminer|minerd|cgminer|bfgminer|ethminer|nbminer|t-rex)") ||
+ contains("log.message", "pool.minexmr.com") ||
+ contains("log.message", "pool.hashvault.pro"))
+', '2026-02-09 16:39:07.486686', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (321, 'Cryptocurrency Mining Pool Connection', 1, 2, 3, 'Resource Hijacking', 'T1496 - Resource Hijacking', 'Detects network connections or DNS lookups to known cryptocurrency mining pool hostnames. This covers major Monero, Bitcoin, and Ethereum mining pools. Connections to these hosts from production servers are almost always indicators of unauthorized cryptocurrency mining.
+
+Next Steps:
+1. Identify the process making connections to mining pools
+2. Terminate the mining process and remove associated files
+3. Block mining pool domains and IPs at the firewall/proxy
+4. Check for persistence mechanisms maintaining the miner
+5. Investigate the initial compromise vector
+6. Audit other systems for similar mining pool connections
+7. Review DNS logs for mining pool lookups from other hosts
+', '["https://attack.mitre.org/techniques/T1496/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml"]', 'exists("log.message") &&
+regexMatch("log.message", "(?i)(pool\\.minergate\\.com|xmrpool\\.eu|moneropool\\.com|monerohash\\.com|minexmr\\.com|pool\\.hashvault\\.pro|xmr\\.nanopool\\.org|xmr\\.2miners\\.com|pool\\.supportxmr\\.com|xmr-eu1\\.nanopool\\.org|xmr-eu2\\.nanopool\\.org|xmr-us-east1\\.nanopool\\.org|xmr-us-west1\\.nanopool\\.org|xmr-asia1\\.nanopool\\.org|randomxmonero\\.auto|gulf\\.moneroocean\\.stream|xmr\\.herominers\\.com|pool\\.xmr\\.pt|xmr\\.f2pool\\.com|xmrpool\\.net|xmr-eu\\.dwarfpool\\.com|monero\\.crypto-pool\\.fr|mine\\.c3pool\\.com)")
+', '2026-02-09 16:39:07.611500', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (322, 'Process Memory Injection via dd', 3, 3, 2, 'Defense Evasion', 'T1055.009 - Process Injection: Proc Memory', 'Detects the use of dd to write to /proc/PID/mem, which is a process injection technique. By writing directly to a process''s memory space through the proc filesystem, attackers can inject malicious code into legitimate running processes to evade detection and gain the process''s privileges.
+
+Next Steps:
+1. Identify the target process whose memory was written to
+2. Examine the source data being injected into the process
+3. Check if the target process is a privileged or security-sensitive process
+4. Review the injecting process and its parent chain
+5. Dump and analyze the target process memory for injected code
+6. Investigate the system for additional process injection attempts
+', '["https://attack.mitre.org/techniques/T1055/009/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_dd_process_injection.yml"]', 'contains("log.message", "dd ") &&
+regexMatch("log.message", "/proc/[0-9]+/mem")
+', '2026-02-09 16:39:07.767041', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (323, 'Download and Execute from Staging Directory', 3, 3, 3, 'Execution', 'T1105 - Ingress Tool Transfer', 'Detects the pattern of downloading a file using curl or wget to /tmp or /dev/shm and then executing it. This is one of the most common multi-stage attack patterns where an attacker downloads a payload from their infrastructure to a staging directory and immediately executes it. This pattern is seen in cryptocurrency miners, botnet agents, and initial compromise payloads.
+
+Next Steps:
+1. Identify the URL from which the file was downloaded
+2. Block the download URL and associated domain at the proxy/firewall
+3. Retrieve and analyze the downloaded file (if still present) for malware analysis
+4. Check for persistence mechanisms installed by the payload
+5. Review network connections for C2 communication
+6. Hunt for the same download URL or file hash across all systems
+7. Investigate the initial access vector that led to the download command
+', '["https://attack.mitre.org/techniques/T1105/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)(curl|wget)\\s+.*-o\\s+(/tmp/|/dev/shm/|/var/tmp/)") ||
+ regexMatch("log.message", "(?i)(curl|wget)\\s+.*>\\s*(/tmp/|/dev/shm/|/var/tmp/)") ||
+ regexMatch("log.message", "(?i)(curl|wget)\\s+.*(/tmp/|/dev/shm/).*&&.*chmod.*\\+x") ||
+ regexMatch("log.message", "(?i)(curl|wget)\\s+.*\\|\\s*(ba)?sh") ||
+ regexMatch("log.message", "(?i)(curl|wget)\\s+.*(/tmp/|/dev/shm/).*&&.*/tmp/"))
+', '2026-02-09 16:39:07.922334', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (324, 'ESXi VM Process Kill - Ransomware Precursor', 2, 3, 3, 'Impact', 'T1529 - System Shutdown/Reboot', 'Detects the use of esxcli to kill virtual machine processes on VMware ESXi hypervisors. This is a critical pre-encryption step used by ransomware groups (ESXiArgs, Royal, LockBit, BlackBasta) to shut down VMs before encrypting their VMDK files. The esxcli vm process kill command is the standard method used by ESXi ransomware variants.
+
+Next Steps:
+1. THIS IS A CRITICAL ALERT - immediately isolate the ESXi host from the network
+2. Check if ransomware encryption has already begun (look for .encrypted, .locked extensions on datastores)
+3. Identify all VMs that were killed and assess business impact
+4. Determine how the attacker gained access to the ESXi host (CVE exploitation, stolen credentials)
+5. Verify ESXi host integrity and check for dropped ransomware binaries
+6. Check for ransom notes on datastores
+7. Do NOT restart VMs until forensic analysis is complete
+8. Activate incident response and business continuity procedures
+', '["https://attack.mitre.org/techniques/T1529/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml","https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)esxcli\\s+vm\\s+process\\s+kill") ||
+ regexMatch("log.message", "(?i)vim-cmd\\s+vmsvc/power\\.off") ||
+ regexMatch("log.message", "(?i)esxcli\\s+vm\\s+process\\s+list"))
+', '2026-02-09 16:39:08.066746', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (325, 'Suspicious Process Execution from /tmp Directory', 3, 3, 2, 'Execution', 'T1036 - Masquerading', 'Detects process execution from the /tmp directory, which is a world-writable location commonly used by attackers to stage and execute malware. Legitimate applications rarely execute from /tmp. This pattern is seen in initial access payloads, cryptocurrency miners, reverse shells, and automated exploitation tools.
+
+Next Steps:
+1. Identify the specific binary or script executing from /tmp
+2. Calculate the file hash and check against threat intelligence feeds
+3. Determine how the file was placed in /tmp (downloaded, transferred, compiled)
+4. Review the process''s network connections and child processes
+5. Check for persistence mechanisms that reference the /tmp file
+6. Remove the malicious file and any associated persistence
+7. Investigate the initial access vector that led to the file placement
+', '["https://attack.mitre.org/techniques/T1036/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)exec(ve)?.*(/tmp/|/var/tmp/|/dev/shm/)") ||
+ regexMatch("log.message", "(?i)/tmp/[a-zA-Z0-9._-]+\\s+(started|running|executed)") ||
+ regexMatch("log.message", "(?i)sh\\s+-c\\s+/tmp/") ||
+ regexMatch("log.message", "(?i)bash\\s+/tmp/") ||
+ regexMatch("log.message", "(?i)chmod\\s+\\+x\\s+/tmp/.*&&.*/tmp/"))
+', '2026-02-09 16:39:08.207093', true, false, 'origin', null, '[{"indexPattern":"v11-log-linux-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-15m","count":2}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (326, 'Shell History File Deletion', 1, 3, 1, 'Defense Evasion', 'T1070.003 - Indicator Removal: Clear Command History', 'Detects deletion, truncation, or clearing of shell history files (.bash_history, .zsh_history, .sh_history). Attackers delete history files to remove evidence of their commands after compromising a system. This is a common anti-forensic technique used during post-exploitation.
+
+Next Steps:
+1. Identify the user account that deleted the history file
+2. Check for remaining shell history in other locations (syslog, auditd)
+3. Review SIEM/remote log data for the commands that were likely being hidden
+4. Investigate what activities preceded the history deletion
+5. Look for other anti-forensic indicators (log clearing, timestamp manipulation)
+6. Check for persistence mechanisms and ongoing compromise
+7. Correlate with other alerts from the same host
+', '["https://attack.mitre.org/techniques/T1070/003/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)(rm|shred|unlink)\\s+.*\\.(bash_history|zsh_history|sh_history|history)") ||
+ regexMatch("log.message", "(?i)>\\s*~/?\\.?(bash_history|zsh_history|sh_history)") ||
+ regexMatch("log.message", "(?i)cat\\s+/dev/null\\s*>.*\\.(bash_history|zsh_history)") ||
+ regexMatch("log.message", "(?i)truncate\\s+.*\\.(bash_history|zsh_history)") ||
+ contains("log.message", "HISTFILE=/dev/null") ||
+ contains("log.message", "unset HISTFILE") ||
+ contains("log.message", "set +o history") ||
+ contains("log.message", "HISTSIZE=0"))
+', '2026-02-09 16:39:08.351829', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (327, 'Java Process Spawning Suspicious Child Process', 3, 3, 3, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects Java processes spawning suspicious child processes such as bash, sh, curl, wget, or python. This pattern is a strong indicator of exploitation of Java applications including Log4Shell (CVE-2021-44228), Confluence RCE vulnerabilities, and Java deserialization attacks. Legitimate Java applications rarely spawn shell processes.
+
+Next Steps:
+1. Immediately isolate the affected Java application server
+2. Identify the specific Java application being exploited (check the Java process arguments)
+3. Review application logs for exploitation payloads (JNDI lookups, deserialization gadgets)
+4. Check for Log4j vulnerabilities in all Java dependencies
+5. Inspect what commands were executed by the spawned child process
+6. Look for reverse shells, webshells, or persistence mechanisms
+7. Patch the vulnerable application immediately
+8. Hunt for the same exploitation pattern across other Java application servers
+', '["https://attack.mitre.org/techniques/T1059/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml","https://www.lunasec.io/docs/blog/log4j-zero-day/"]', 'exists("log.message") &&
+regexMatch("log.message", "(?i)java.*child.*(bash|/bin/sh|curl|wget|python|perl|ruby|nc |ncat)") ||
+(contains("log.message", "java") &&
+ regexMatch("log.message", "(?i)(Runtime\\.getRuntime|ProcessBuilder|exec\\(|/bin/bash|/bin/sh)"))
+', '2026-02-09 16:39:08.492019', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (328, 'LD_PRELOAD Library Injection in System Logs', 3, 3, 2, 'Persistence', 'T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking', 'Detects modifications to /etc/ld.so.preload or LD_PRELOAD usage in system logs, indicating dynamic linker hijacking for persistence or credential interception.
+
+Next Steps:
+1. Examine /etc/ld.so.preload for unauthorized shared library entries
+2. Analyze the referenced shared library for malicious code
+3. Check for LD_PRELOAD in environment variables and shell profiles
+4. Identify the user and process that made the modification
+5. Remove malicious preload entries and libraries
+6. Audit running processes for injected libraries
+', '["https://attack.mitre.org/techniques/T1574/006/"]', '(contains("log.message", "ld.so.preload") || contains("log.message", "LD_PRELOAD")) &&
+(contains("log.message", "modified") || contains("log.message", "write") ||
+ contains("log.message", "export LD_PRELOAD") || contains("log.message", "changed") ||
+ contains("log.message", "opened for writing"))
+', '2026-02-09 16:39:08.641507', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (329, 'Linux Hack Tool Execution', 3, 3, 2, 'Execution', 'T1588.002 - Obtain Capabilities: Tool', 'Detects execution of known offensive security and hacking tools on Linux systems. This includes C2 frameworks (Cobalt Strike, Sliver, Havoc, Merlin), post-exploitation tools (LinPEAS, pspy, Chisel), credential attack tools (Hydra, John, Hashcat, Mimikatz), network attack tools (CrackMapExec, Impacket, Responder), and vulnerability scanners (sqlmap, Nikto, ncrack). The presence of these tools on a production system is a strong indicator of compromise.
+
+Next Steps:
+1. Immediately isolate the affected host from the network
+2. Identify the user account executing the tool and determine if it is compromised
+3. Check how the tool was installed (downloaded, transferred, compiled on host)
+4. Review process history and network connections for scope of attack
+5. Search for additional compromised hosts using the same tools
+6. Collect forensic artifacts from the system
+7. Remove the offensive tools and remediate the compromise
+8. Reset credentials for any accounts accessed from the compromised host
+', '["https://attack.mitre.org/techniques/T1588/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml"]', 'exists("log.message") &&
+regexMatch("log.message", "(?i)(crackmapexec|cme\\s|evil-winrm|sliver-client|sliver-server|havoc|merlin|msfconsole|msfvenom|meterpreter|pspy|pspy64|linpeas|linpeas\\.sh|winpeas|linenum|linux-exploit-suggester|les\\.sh|linux-smart-enumeration|lse\\.sh|hydra|john |johntheripper|hashcat|ncrack|medusa|patator|sqlmap|sqlninja|nikto|gobuster|feroxbuster|dirbuster|dirb |ffuf |wfuzz|nuclei |subfinder|amass |masscan|nmap\\s|responder|impacket|secretsdump|chisel|ligolo|bloodhound-python|sharphound|rubeus|mimikatz|lazagne|enum4linux|smbmap|cracklord|thc-hydra)")
+', '2026-02-09 16:39:08.781918', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (330, 'Linux Log File Clearing', 1, 3, 2, 'Defense Evasion', 'T1070.002 - Indicator Removal: Clear Linux or Mac System Logs', 'Detects commands used to delete or overwrite Linux log files in /var/log. Attackers frequently clear logs to cover their tracks after compromising a system. Commands like rm, shred, unlink, and truncation of log files are indicators of anti-forensic activity.
+
+Next Steps:
+1. Identify the user account and process that deleted the log files
+2. Check for any remaining log entries before the clearing event
+3. Review remote syslog backups or SIEM data for the deleted timeframe
+4. Investigate what the attacker was trying to hide
+5. Look for other anti-forensic activities (history deletion, timestamp manipulation)
+6. Check for active compromise indicators on the system
+7. Preserve all remaining forensic artifacts immediately
+8. Consider the system compromised and investigate lateral movement
+', '["https://attack.mitre.org/techniques/T1070/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_clear_logs.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)(rm|shred|unlink)\\s+(-rf?\\s+)?/var/log") ||
+ regexMatch("log.message", "(?i)>\\s*/var/log/(syslog|auth\\.log|messages|secure|wtmp|btmp|lastlog)") ||
+ regexMatch("log.message", "(?i)truncate\\s+(-s\\s+0\\s+)?/var/log/") ||
+ regexMatch("log.message", "(?i)cat\\s+/dev/null\\s*>\\s*/var/log/"))
+', '2026-02-09 16:39:08.926981', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (331, 'Outbound Connection to Known Malware C2 Ports', 3, 2, 2, 'Command and Control', 'T1571 - Non-Standard Port', 'Detects outbound network connections to ports commonly used by malware for command and control callbacks. Ports like 4444 (Metasploit default), 5555 (Android Debug Bridge abuse), 6789 (Cobalt Strike), 8531 (fake WSUS), and others are well-known C2 callback ports. While some may have legitimate uses, outbound connections to these ports from servers warrant investigation.
+
+Next Steps:
+1. Identify the process making the outbound connection
+2. Determine the destination IP address and verify it is not a known legitimate service
+3. Check the destination IP against threat intelligence feeds
+4. Capture network traffic to analyze the C2 protocol
+5. Investigate the process tree and how the connecting process was started
+6. Block the destination IP at the firewall
+7. Search for the same destination IP across all monitored systems
+8. Check for persistence mechanisms associated with the C2 agent
+', '["https://attack.mitre.org/techniques/T1571/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)(connect|established|connection).*\\b(4444|4445|5555|6666|6667|6789|7443|8531|9001|9090|1337|31337|12345)\\b") ||
+ regexMatch("log.message", "(?i)outbound.*(4444|5555|6789|8531|9001)") ||
+ regexMatch("log.message", "(?i)destination.*port.*(4444|4445|5555|6666|6789|8531)"))
+', '2026-02-09 16:39:09.066872', true, false, 'origin', null, '[{"indexPattern":"v11-log-linux-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (332, 'Named Pipe Creation in Suspicious Location', 2, 2, 1, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects creation of named pipes (FIFOs) in /tmp or /dev/shm using mkfifo. Named pipes in temporary directories are commonly used by attackers and malware for inter-process communication during exploitation. This technique was notably used in the Barracuda ESG exploitation campaign.
+
+Next Steps:
+1. Identify the named pipe file and examine its location
+2. Determine which processes are reading from and writing to the pipe
+3. Check for associated reverse shell or data exfiltration activity
+4. Review the parent process that executed mkfifo
+5. Look for other indicators of web application exploitation
+6. Remove the named pipe and investigate the full attack chain
+', '["https://attack.mitre.org/techniques/T1059/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml","https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"]', 'contains("log.message", "mkfifo") &&
+contains("log.message", ["/tmp/", "/dev/shm/", "/var/tmp/"])
+', '2026-02-09 16:39:09.211835', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (333, 'Netcat Reverse Shell Detected', 3, 3, 3, 'Command and Control', 'T1059 - Command and Scripting Interpreter', 'Detects netcat (nc/ncat/netcat) being used with -c or -e flags to spawn a shell, which is the most common method of establishing a reverse shell on Linux systems. This is almost never used legitimately and is a strong indicator of active compromise.
+
+Next Steps:
+1. Immediately isolate the affected host from the network
+2. Identify the user and parent process that executed netcat
+3. Determine the destination IP and port of the reverse shell connection
+4. Check for initial access vectors (webshell, exploited service, stolen credentials)
+5. Search for persistence mechanisms installed by the attacker
+6. Review network connections from the host for additional C2 channels
+7. Hunt for the same destination IP across all monitored systems
+', '["https://attack.mitre.org/techniques/T1059/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml"]', 'exists("log.message") &&
+regexMatch("log.message", "(?i)(nc|ncat|netcat)\\s+.*-(e|c)\\s+(/bin/)?(ba)?sh")
+', '2026-02-09 16:39:09.356771', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (334, 'Ngrok Tunnel Communication Detected', 3, 2, 2, 'Command and Control', 'T1572 - Protocol Tunneling', 'Detects connections to ngrok tunnel infrastructure (tunnel.*.ngrok.com, *.ngrok.io, *.ngrok-free.app). Ngrok is a legitimate tunneling service that is frequently abused by attackers to establish reverse tunnels from compromised systems, bypassing firewalls and NAT. Its use on production servers is almost always unauthorized and indicates either C2 communication, data exfiltration, or unauthorized remote access.
+
+Next Steps:
+1. Identify the process establishing the ngrok tunnel
+2. Determine what service or port is being exposed through the tunnel
+3. Check if ngrok is authorized for use in the environment
+4. Terminate the ngrok process and remove the binary
+5. Block ngrok domains at the DNS/proxy level
+6. Investigate what the attacker was accessing through the tunnel
+7. Check for the ngrok configuration file for tunnel details
+8. Hunt for ngrok usage on other systems
+', '["https://attack.mitre.org/techniques/T1572/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)tunnel\\..*\\.ngrok\\.com") ||
+ contains("log.message", ".ngrok.io") ||
+ contains("log.message", ".ngrok-free.app") ||
+ contains("log.message", "ngrok.com/api") ||
+ regexMatch("log.message", "(?i)ngrok\\s+(http|tcp|tls|start)"))
+', '2026-02-09 16:39:09.486706', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (669, 'Windows: Microsoft Build Engine Started an Unusual Process', 3, 3, 2, 'Defense Evasion', 'T1027 - Obfuscated Files or Information', 'An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1027/"]', 'regexMatch("log.winlogEventDataProcessName", "(csc.exe|iexplore.exe|powershell.exe)") && regexMatch("log.winlogEventDataParentProcessName", "MSBuild.exe")', '2026-02-09 16:57:25.017103', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (335, 'OMIGOD SCX Agent Exploitation Detected', 3, 3, 3, 'Exploitation', 'T1068 - Exploitation for Privilege Escalation', 'Detects exploitation of the OMIGOD vulnerability (CVE-2021-38647) in the Azure Open Management Infrastructure (OMI) SCX agent. This critical vulnerability allows unauthenticated remote code execution as root via the SCXcore RunAsProvider ExecuteShellCommand method.
+
+Next Steps:
+1. Immediately patch the OMI agent on the affected system
+2. Check for unauthorized processes spawned from the SCX agent path
+3. Review commands executed through the OMI agent
+4. Examine network connections to the OMI listener port (5985/5986)
+5. Check for persistence mechanisms installed by the attacker
+6. Audit all Azure VMs running the OMI agent for this vulnerability
+', '["https://attack.mitre.org/techniques/T1068/","https://attack.mitre.org/techniques/T1190/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml","https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure"]', '(
+ contains("log.message", "/var/opt/microsoft/scx") ||
+ contains("log.message", "/opt/omi/") ||
+ contains("log.message", "SCXcore")
+) &&
+(
+ contains("log.message", "ExecuteShellCommand") ||
+ contains("log.message", "RunAsProvider") ||
+ (contains("log.message", "omicli") && contains("log.message", "exec"))
+)
+', '2026-02-09 16:39:09.627198', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (336, 'Perl Reverse Shell Detected', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects Perl-based reverse shell execution patterns using fdopen with Socket library. This is a well-known post-exploitation technique where attackers use Perl''s built-in networking capabilities to establish a reverse shell connection back to their command and control server.
+
+Next Steps:
+1. Immediately isolate the affected system from the network
+2. Identify the destination IP and port of the reverse shell connection
+3. Determine how the attacker gained initial access to execute Perl
+4. Check for other compromised systems connecting to the same C2 address
+5. Review process tree to identify the parent process that spawned Perl
+6. Examine the system for persistence mechanisms and lateral movement
+', '["https://attack.mitre.org/techniques/T1059/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml"]', 'contains("log.message", "perl") &&
+(
+ (contains("log.message", "fdopen") && contains("log.message", "Socket")) ||
+ (contains("log.message", "socket") && contains("log.message", "connect") && contains("log.message", "open") && contains("log.message", "STDIN"))
+)
+', '2026-02-09 16:39:09.767845', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (337, 'PHP Reverse Shell Detected', 3, 3, 3, 'Command and Control', 'T1059 - Command and Scripting Interpreter', 'Detects PHP being used to establish a reverse shell via fsockopen or similar network functions. This is commonly seen on compromised web servers where an attacker leverages PHP''s built-in socket functions to create a reverse connection. The presence of php -r with fsockopen in command lines is a strong indicator of active exploitation.
+
+Next Steps:
+1. Immediately isolate the affected web server from the network
+2. Identify the webshell or vulnerable application that triggered the PHP reverse shell
+3. Check for uploaded PHP files in web-accessible directories
+4. Review web server access logs for the initial exploitation request
+5. Determine the destination C2 IP and block it at the firewall
+6. Audit all PHP files on the server for additional webshells
+7. Patch the vulnerable application and restore from clean backup
+', '["https://attack.mitre.org/techniques/T1059/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml"]', 'exists("log.message") &&
+regexMatch("log.message", "(?i)php\\s+-r\\s+.*fsockopen")
+', '2026-02-09 16:39:09.907293', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (338, 'Shell Script Persistence via profile.d', 2, 3, 2, 'Persistence', 'T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification', 'Detects creation or modification of shell scripts in /etc/profile.d/. Scripts in this directory are executed by every user at login, making it a powerful persistence mechanism. Attackers drop malicious scripts here to maintain persistent access and execute commands in the context of every user session.
+
+Next Steps:
+1. Identify the new or modified script in /etc/profile.d/ and examine its contents
+2. Check if the script was created by a legitimate package installation or administrator
+3. Compare the script against known-good baselines from package manager
+4. Review the user and process that created or modified the script
+5. Remove unauthorized scripts from /etc/profile.d/
+6. Check for other persistence mechanisms on the same system
+', '["https://attack.mitre.org/techniques/T1546/004/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml"]', 'contains("log.message", "/etc/profile.d/") &&
+(
+ contains("log.message", ["created", "modified", "written", "installed"]) ||
+ (contains("log.message", [" cp ", " mv ", "tee ", "cat "]) && contains("log.message", "/etc/profile.d/")) ||
+ (contains("log.message", "chmod") && contains("log.message", "/etc/profile.d/"))
+)
+', '2026-02-09 16:39:10.056562', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (339, 'Python PTY Shell Spawn - Interactive Shell Upgrade', 3, 3, 2, 'Execution', 'T1059.006 - Command and Scripting Interpreter: Python', 'Detects the use of Python''s pty module to spawn an interactive TTY shell. This is a standard post-exploitation technique where an attacker upgrades a basic reverse shell to a fully interactive terminal. The command "python -c ''import pty; pty.spawn(\"/bin/bash\")''" is taught in every penetration testing course and is a strong indicator of active hands-on-keyboard exploitation.
+
+Next Steps:
+1. The system is actively being exploited - immediately isolate the host
+2. Identify the parent process (likely a reverse shell or webshell)
+3. Check for the initial access vector that gave the attacker shell access
+4. Review all commands executed in the spawned interactive shell
+5. Look for privilege escalation attempts following the shell upgrade
+6. Check for lateral movement from this host
+7. Collect memory dump and disk forensic artifacts
+', '["https://attack.mitre.org/techniques/T1059/006/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)python[23]?\\s+-c\\s+.*import\\s+pty.*pty\\.spawn") ||
+ contains("log.message", "import pty;pty.spawn") ||
+ contains("log.message", "import pty; pty.spawn"))
+', '2026-02-09 16:39:10.197334', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (442, 'System Linux: Namespace Manipulation Using Unshare', 3, 3, 2, 'Privilege Escalation', 'T1543 - Create or Modify System Process', 'Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1543/"]', 'contains("log.message", "unshare") && !contains("log.message", "/usr/bin/snap") && !regexMatch("log.message", "(\\/usr\\/bin\\/udevadm|\\/lib\\/systemd\\/systemd-udevd|\\/usr\\/bin\\/unshare)")', '2026-02-09 16:51:30.486997', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (341, 'Comprehensive Reverse Shell Detection', 3, 3, 3, 'Command and Control', 'T1059.004 - Command and Scripting Interpreter: Unix Shell', 'Detects multiple reverse shell patterns in Linux system logs including bash, netcat, python, perl, ruby, socat, awk, xterm, and telnet variants. Reverse shells are one of the most common post-exploitation techniques used by attackers to establish interactive command and control channels from a compromised host back to their infrastructure.
+
+Next Steps:
+1. Immediately isolate the affected host from the network
+2. Identify the source process and user that spawned the reverse shell
+3. Determine the destination IP and port of the outbound connection
+4. Check for webshell presence or initial access vector that led to the reverse shell
+5. Review all processes and network connections on the compromised host
+6. Search for lateral movement from this host to other systems
+7. Collect forensic artifacts (memory dump, disk image) before remediation
+8. Block the C2 IP at the firewall and hunt for it across all systems
+', '["https://attack.mitre.org/techniques/T1059/004/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shell_susp_rev_shells.yml","https://www.revshells.com/"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)bash\\s+-i\\s+>&\\s*/dev/tcp/") ||
+ regexMatch("log.message", "(?i)exec\\s+\\d+<>/dev/tcp/") ||
+ regexMatch("log.message", "(?i)(nc|ncat|netcat)\\s+.*\\s+-(e|c)\\s+(/bin/)?(ba)?sh") ||
+ regexMatch("log.message", "(?i)python[23]?\\s+-c\\s+.*socket.*pty.*spawn") ||
+ regexMatch("log.message", "(?i)python[23]?\\s+-c\\s+.*socket.*connect.*subprocess") ||
+ regexMatch("log.message", "(?i)perl\\s+-e\\s+.*socket.*INET.*exec") ||
+ regexMatch("log.message", "(?i)perl\\s+-MIO\\s+-e") ||
+ regexMatch("log.message", "(?i)php\\s+-r\\s+.*fsockopen") ||
+ regexMatch("log.message", "(?i)ruby\\s+-rsocket\\s+-e") ||
+ regexMatch("log.message", "(?i)ruby\\s+-e\\s+.*TCPSocket") ||
+ regexMatch("log.message", "(?i)socat\\s+.*exec.*tcp") ||
+ regexMatch("log.message", "(?i)socat\\s+.*tcp.*exec") ||
+ regexMatch("log.message", "(?i)awk\\s+.*\\/inet\\/tcp\\/") ||
+ regexMatch("log.message", "(?i)xterm\\s+-display\\s+\\d+") ||
+ regexMatch("log.message", "(?i)telnet\\s+.*\\|\\s*/bin/(ba)?sh") ||
+ regexMatch("log.message", "(?i)mkfifo\\s+/tmp/.*&&.*nc\\s+") ||
+ regexMatch("log.message", "(?i)mknod\\s+/tmp/.*&&.*nc\\s+"))
+', '2026-02-09 16:39:10.472050', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (342, 'Reverse Shell Patterns in System Logs', 3, 3, 3, 'Execution', 'T1059.004 - Command and Scripting Interpreter: Unix Shell', 'Detects common reverse shell patterns in system logs including bash TCP redirects, netcat shells, python socket connections, and other common reverse shell one-liners.
+
+Next Steps:
+1. Immediately isolate the affected system
+2. Identify the destination IP and port of the reverse shell
+3. Determine the initial access vector
+4. Check for data exfiltration or lateral movement
+5. Block the C2 IP at the network perimeter
+6. Perform full incident response on the host
+', '["https://attack.mitre.org/techniques/T1059/004/"]', 'regexMatch("log.message", "(?i)bash\\s+-i\\s+>&\\s+/dev/tcp/") ||
+regexMatch("log.message", "(?i)python[23]?\\s+-c\\s+.*socket.*connect") ||
+regexMatch("log.message", "(?i)nc\\s+(-e|--exec)\\s+/bin/(ba)?sh") ||
+regexMatch("log.message", "(?i)socat\\s+.*exec.*tcp") ||
+regexMatch("log.message", "(?i)perl\\s+-e\\s+.*socket.*INET") ||
+regexMatch("log.message", "(?i)php\\s+-r\\s+.*fsockopen") ||
+regexMatch("log.message", "(?i)ruby\\s+-rsocket") ||
+regexMatch("log.message", "(?i)mkfifo\\s+/tmp/.*\\|.*nc\\s+")
+', '2026-02-09 16:39:10.606388', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (343, 'Root Certificate Installation Detected', 2, 3, 1, 'Defense Evasion', 'T1553.004 - Subvert Trust Controls: Install Root Certificate', 'Detects the installation of root certificates on Linux systems using update-ca-certificates or update-ca-trust. Attackers install rogue root certificates to enable TLS interception (man-in-the-middle attacks), bypass certificate pinning, or establish trust for malicious code signing.
+
+Next Steps:
+1. Identify which certificate was installed and its issuer
+2. Verify if the certificate installation was authorized
+3. Check /usr/local/share/ca-certificates/ and /etc/pki/ca-trust/source/ for new certificates
+4. Examine the process and user that triggered the certificate installation
+5. Look for signs of TLS interception or MITM activity
+6. Remove unauthorized certificates and update the trust store
+', '["https://attack.mitre.org/techniques/T1553/004/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml"]', 'contains("log.message", ["update-ca-certificates", "update-ca-trust"]) &&
+!contains("log.message", ["apt", "yum", "dnf", "dpkg"])
+', '2026-02-09 16:39:10.757972', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (344, 'Security Tools Disabled or Stopped', 2, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects commands used to stop, disable, or remove security tools on Linux systems. This includes firewalls (iptables, firewalld, ufw, nftables), EDR agents (falcon-sensor, cbdaemon, mdatp), SELinux/AppArmor enforcement, and other security services. Attackers disable security tools early in the kill chain to avoid detection during subsequent exploitation phases.
+
+Next Steps:
+1. Immediately verify if the security tool disabling was authorized
+2. Check if the affected security tools are currently running
+3. Re-enable any disabled security tools immediately
+4. Investigate the user account and process that issued the command
+5. Look for subsequent malicious activity that the attacker was trying to hide
+6. Check for persistence mechanisms that disable security tools at boot
+7. Verify SELinux/AppArmor enforcement status
+8. Review other hosts for similar security tool disabling patterns
+', '["https://attack.mitre.org/techniques/T1562/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)systemctl\\s+(stop|disable|mask)\\s+(iptables|firewalld|ufw|nftables|falcon-sensor|cbdaemon|cbsensor|mdatp|clamd|ossec|wazuh|auditd|rsyslog|syslog-ng|apparmor)") ||
+ regexMatch("log.message", "(?i)service\\s+(iptables|firewalld|ufw|falcon-sensor|cbdaemon|auditd|rsyslog|apparmor)\\s+stop") ||
+ contains("log.message", "setenforce 0") ||
+ contains("log.message", "setenforce Permissive") ||
+ regexMatch("log.message", "(?i)aa-teardown") ||
+ regexMatch("log.message", "(?i)apparmor_parser\\s+-R") ||
+ regexMatch("log.message", "(?i)(apt|yum|dnf|rpm)\\s+.*(remove|erase)\\s+(iptables|firewalld|falcon-sensor|clamav|ossec|wazuh|auditd)"))
+', '2026-02-09 16:39:10.902131', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (345, 'Ruby Reverse Shell Detected', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects Ruby-based reverse shell execution patterns using TCPSocket. Attackers use Ruby''s TCPSocket class to establish a reverse shell connection, redirecting stdin/stdout/stderr to a remote socket for interactive command execution.
+
+Next Steps:
+1. Immediately isolate the affected system from the network
+2. Identify the destination IP and port of the reverse shell connection
+3. Determine how the attacker gained initial access to execute Ruby
+4. Check for other compromised systems connecting to the same C2 address
+5. Review process tree to identify the parent process that spawned Ruby
+6. Examine the system for persistence mechanisms and lateral movement
+', '["https://attack.mitre.org/techniques/T1059/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml"]', 'contains("log.message", "ruby") &&
+(
+ contains("log.message", "TCPSocket") ||
+ (contains("log.message", "socket") && contains("log.message", "spawn"))
+) &&
+contains("log.message", ["/bin/sh", "/bin/bash", "exec"])
+', '2026-02-09 16:39:11.063049', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (443, 'System Linux: A user has been added to the administrators group', 3, 3, 2, 'Privilege Escalation', 'T1484 - Domain Policy Modification', 'Detects when a user has been added to the administrators group (sudo) on a Linux system.', '["https://attack.mitre.org/tactics/TA0004","https://attack.mitre.org/techniques/T1484/"]', 'regexMatch("log.message", "(((adduser|useradd|usermod)(.+)([Aa]dded user|new user|add)(.+)to(.+)group)(.+)sudo)") && contains("log.message", "usermod -aG sudo")', '2026-02-09 16:51:30.647303', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (346, 'Suspicious Access to Sensitive System Files', 3, 3, 2, 'Credential Access', 'T1003.008 - OS Credential Dumping: /etc/passwd and /etc/shadow', 'Detects suspicious access to critical system files including /etc/passwd, /etc/shadow, /etc/sudoers, /etc/crontab, and sensitive directories like /boot, /bin, /sbin. While system administrators may legitimately access these files, unusual access patterns can indicate credential theft, privilege escalation, or system tampering.
+
+Next Steps:
+1. Verify the user account accessing the sensitive files and their authorization
+2. Check the specific command used (cat, vi, nano, cp, scp)
+3. Determine if this aligns with legitimate administrative activity
+4. Review the access context - was it from an interactive session or automated process?
+5. Check for concurrent suspicious activities (reverse shells, lateral movement)
+6. If unauthorized, immediately reset affected credentials
+7. Audit file permissions on sensitive files
+', '["https://attack.mitre.org/techniques/T1003/008/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)(cat|less|more|head|tail|vi|vim|nano|emacs|sed|awk)\\s+/etc/(shadow|gshadow)") ||
+ regexMatch("log.message", "(?i)(vi|vim|nano|emacs|sed)\\s+/etc/(passwd|sudoers|crontab)") ||
+ regexMatch("log.message", "(?i)(vi|vim|nano|emacs|sed)\\s+/etc/ssh/sshd_config") ||
+ regexMatch("log.message", "(?i)(cp|scp|rsync)\\s+/etc/(shadow|gshadow|passwd)"))
+', '2026-02-09 16:39:11.211998', true, false, 'origin', null, '[{"indexPattern":"v11-log-linux-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (347, 'Setcap Privilege Escalation via cap_setuid', 3, 3, 2, 'Privilege Escalation', 'T1548 - Abuse Elevation Control Mechanism', 'Detects the use of setcap to grant cap_setuid or other dangerous capabilities to binaries. Linux capabilities allow splitting root privileges into distinct units. The cap_setuid capability allows a process to change its UID, effectively gaining root access. Attackers use setcap to create persistent privilege escalation backdoors that are harder to detect than traditional SUID bits.
+
+Next Steps:
+1. Identify the binary that was granted dangerous capabilities
+2. Determine if this is a legitimate administrative action
+3. Check the binary''s integrity against package manager records
+4. Remove unauthorized capabilities: setcap -r /path/to/binary
+5. Search for other binaries with dangerous capabilities: getcap -r / 2>/dev/null
+6. Investigate how the attacker gained the privileges needed to run setcap
+7. Check if the capability-enhanced binary has been used for privilege escalation
+', '["https://attack.mitre.org/techniques/T1548/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml","https://gtfobins.github.io/"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)setcap\\s+.*cap_setuid") ||
+ regexMatch("log.message", "(?i)setcap\\s+.*cap_setgid") ||
+ regexMatch("log.message", "(?i)setcap\\s+.*cap_sys_admin") ||
+ regexMatch("log.message", "(?i)setcap\\s+.*cap_sys_ptrace") ||
+ regexMatch("log.message", "(?i)setcap\\s+.*cap_dac_override") ||
+ regexMatch("log.message", "(?i)setcap\\s+.*cap_net_raw") ||
+ regexMatch("log.message", "(?i)setcap\\s+.*cap_net_admin"))
+', '2026-02-09 16:39:11.356679', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (348, 'Shellshock Exploitation Attempt Detected', 3, 3, 3, 'Exploitation', 'T1505.003 - Server Software Component: Web Shell', 'Detects the Shellshock (CVE-2014-6271) exploitation pattern in system logs. The characteristic () { :; }; sequence in environment variables exploits a bash vulnerability that allows arbitrary command execution. Despite being discovered in 2014, Shellshock is still actively exploited against unpatched systems.
+
+Next Steps:
+1. Immediately patch bash on the affected system if vulnerable
+2. Identify the attack vector (CGI script, DHCP client, SSH ForceCommand)
+3. Determine if the exploitation was successful and what commands were executed
+4. Check for follow-up malware installation or persistence
+5. Review network logs for the source of the attack
+6. Scan all systems for the Shellshock vulnerability
+', '["https://attack.mitre.org/techniques/T1505/003/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shellshock.yml","https://nvd.nist.gov/vuln/detail/CVE-2014-6271"]', 'regexMatch("log.message", "\\(\\)\\s*\\{\\s*:;\\s*\\};")
+', '2026-02-09 16:39:11.502542', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (349, 'SSH Authorized Key Injection via System Logs', 3, 3, 1, 'Persistence', 'T1098.004 - Account Manipulation: SSH Authorized Keys', 'Detects unauthorized modifications to SSH authorized_keys files as seen in system logs, indicating potential persistence via injected SSH public keys.
+
+Next Steps:
+1. Review the authorized_keys file for unauthorized keys
+2. Identify the user and process that made the change
+3. Check SSH login logs for connections using the new key
+4. Remove unauthorized keys and rotate credentials
+5. Monitor for subsequent connections from unknown sources
+', '["https://attack.mitre.org/techniques/T1098/004/"]', 'contains("log.message", "authorized_keys") &&
+(contains("log.message", "modified") || contains("log.message", "write") ||
+ contains("log.message", "opened for writing") || contains("log.message", "changed"))
+', '2026-02-09 16:39:11.663111', true, false, 'origin', null, '[{"indexPattern":"v11-log-linux-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"},{"field":"log.message","operator":"filter_match","value":"authorized_keys"}],"or":null,"within":"now-1h","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (350, 'Sudo Privilege Escalation Attempts', 3, 3, 2, 'Privilege Escalation', 'T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching', 'Detects unauthorized sudo usage attempts and privilege escalation through sudo command execution. This rule identifies failed sudo attempts including users not in sudoers file, authentication failures, and command restrictions.
+
+Next Steps:
+1. Verify the legitimacy of the user attempting sudo access
+2. Review the specific command that was attempted
+3. Check if this is part of a broader privilege escalation campaign
+4. Examine system logs for additional suspicious activity from this user/host
+5. Consider implementing additional sudo restrictions if unauthorized access attempts persist
+6. Correlate with other authentication events from the same user or host
+', '["https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html","https://attack.mitre.org/techniques/T1548/003/"]', 'contains("log.message", "sudo") && (contains("log.message", "NOT in sudoers") || contains("log.message", "authentication failure") || contains("log.message", "command not allowed")) && exists("origin.host")', '2026-02-09 16:39:11.812675', true, false, 'origin', null, '[{"indexPattern":"v11-log-linux-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-10m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (696, 'Windows: PowerShell PSReflect Script', 2, 3, 1, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1059/"]', 'regexMatch("log.message", "(New-InMemoryModule|Add-Win32Type|psenum|DefineDynamicAssembly|DefineDynamicModule|Reflection.TypeAttributes|Reflection.Emit.OpCodes|Reflection.Emit.CustomAttributeBuilder|Runtime.InteropServices.DllImportAttribute)")', '2026-02-09 16:57:29.062478', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (351, 'SUID/SGID Bit Set on Binary - Potential Backdoor', 3, 3, 2, 'Privilege Escalation', 'T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid', 'Detects the use of chmod to set SUID (u+s) or SGID (g+s) bits on binaries, especially after a chown to root. Attackers use SUID/SGID bits to create backdoors that allow any user to execute a binary with root privileges. This is a well-known persistence and privilege escalation technique.
+
+Next Steps:
+1. Identify the binary that had the SUID/SGID bit set
+2. Determine if this is a known system binary or a dropped malicious file
+3. Check the binary''s contents and compare against package manager originals
+4. Review who set the SUID/SGID bit and their authorization level
+5. Remove the SUID/SGID bit from unauthorized binaries (chmod u-s g-s)
+6. Search for other SUID/SGID binaries that may have been modified: find / -perm -4000
+7. Investigate how the attacker gained root access to set the bit
+', '["https://attack.mitre.org/techniques/T1548/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)chmod\\s+.*[ug]\\+s\\s+") ||
+ regexMatch("log.message", "(?i)chmod\\s+[46][0-7]{3}\\s+") ||
+ regexMatch("log.message", "(?i)chmod\\s+.*4755\\s+") ||
+ regexMatch("log.message", "(?i)chmod\\s+.*2755\\s+") ||
+ regexMatch("log.message", "(?i)chmod\\s+.*6755\\s+"))
+', '2026-02-09 16:39:11.967086', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (352, 'Suspicious Package Installation Detected', 2, 2, 1, 'Execution', 'T1072 - Software Deployment Tools', 'Detects the installation of offensive security tools or suspicious packages via apt, yum, or dnf. Packages like nmap, netcat, wireshark, proxychains, socat, and similar tools are commonly installed by attackers during post-exploitation for reconnaissance, pivoting, and lateral movement.
+
+Next Steps:
+1. Verify if the package installation was authorized by system administrators
+2. Identify the user who installed the package and their access context
+3. Check for other reconnaissance or exploitation activity from the same user
+4. Review if the tools were actually used after installation
+5. Remove unauthorized tools and restrict package installation privileges
+6. Investigate how the attacker obtained privileges to install packages
+', '["https://attack.mitre.org/techniques/T1072/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml"]', 'contains("log.message", ["apt install", "apt-get install", "yum install", "dnf install"]) &&
+contains("log.message", ["nmap", "netcat", "ncat", "wireshark", "tshark", "proxychains", "socat", "masscan", "hydra", "john", "hashcat", "aircrack", "ettercap", "responder", "mimikatz", "crackmapexec", "enum4linux"])
+', '2026-02-09 16:39:12.107949', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (353, 'SSH Brute Force Attempts', 3, 3, 2, 'Credential Access', 'T1110.001 - Brute Force: Password Guessing', 'Detects multiple failed SSH authentication attempts from the same source IP address, indicating a potential brute force attack against SSH services. This rule identifies patterns where an attacker attempts to guess passwords by making repeated login attempts.
+
+Next Steps:
+1. Immediately block the attacking IP address at the firewall level
+2. Review SSH logs for the timeframe to identify targeted usernames
+3. Check if any successful logins occurred from the same IP after failed attempts
+4. Verify SSH configuration follows security best practices (disable root login, use key-based authentication)
+5. Consider implementing fail2ban or similar intrusion prevention tools
+6. Monitor for lateral movement if any accounts were compromised
+7. Review other systems for similar brute force attempts from the same IP
+8. Consider adding the IP to threat intelligence feeds if confirmed malicious
+', '["https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html","https://attack.mitre.org/techniques/T1110/001/"]', 'contains("log.message", "Failed password") && contains("log.message", "ssh") && exists("origin.ip")', '2026-02-09 16:39:12.238043', true, false, 'origin', null, '[{"indexPattern":"v11-log-linux-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.message","operator":"filter_match","value":"Failed password"}],"or":null,"within":"now-5m","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (354, 'Malicious Systemd Timer Creation', 2, 3, 2, 'Persistence', 'T1053.006 - Scheduled Task/Job: Systemd Timers', 'Detects creation or enablement of systemd timer units through system logs, which attackers use for persistent scheduled execution of malicious payloads.
+
+Next Steps:
+1. Review the timer unit and associated service unit file contents
+2. Check the ExecStart directive for suspicious binaries or scripts
+3. Verify the timer was created by an authorized administrator
+4. Compare against baseline of known legitimate timers
+5. If unauthorized, disable the timer and investigate
+', '["https://attack.mitre.org/techniques/T1053/006/"]', '(contains("log.message", "systemd") || contains("log.message", "systemctl")) &&
+contains("log.message", ".timer") &&
+(contains("log.message", "enabled") || contains("log.message", "Created symlink")) &&
+!contains("log.message", ["logrotate", "man-db", "fstrim", "apt-daily", "snapd", "certbot", "unattended-upgrades"])
+', '2026-02-09 16:39:12.381816', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (355, 'Timestomping of Service Files Detected', 1, 3, 1, 'Defense Evasion', 'T1070.006 - Indicator Removal: Timestomp', 'Detects the use of touch -t to modify timestamps on .service files. Attackers use timestomping to make malicious systemd service files appear as if they were created during system installation, hiding persistence mechanisms from forensic analysis.
+
+Next Steps:
+1. Identify the specific .service files that were timestomped
+2. Examine the contents of those service files for malicious commands
+3. Compare file timestamps with package manager records (dpkg/rpm)
+4. Check if the service files reference suspicious executables
+5. Review systemd unit files for unauthorized additions
+6. Verify the integrity of all service files against known-good baselines
+', '["https://attack.mitre.org/techniques/T1070/006/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_touch_susp.yml"]', 'contains("log.message", "touch") &&
+contains("log.message", "-t") &&
+contains("log.message", ".service")
+', '2026-02-09 16:39:12.521919', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (356, 'Triple Cross eBPF Rootkit Installation Detected', 3, 3, 3, 'Malware Detection', 'T1014 - Rootkit', 'Detects installation of the Triple Cross eBPF rootkit. This rootkit uses the Linux Traffic Control (tc) subsystem with qdisc and filter commands to install eBPF programs that can hide processes, files, and network connections while providing a backdoor. The characteristic pattern is sudo tc with qdisc/filter subcommands.
+
+Next Steps:
+1. Immediately isolate the affected system from the network
+2. Check for eBPF programs loaded in the kernel (bpftool prog list)
+3. Examine tc qdisc and filter configurations for malicious entries
+4. Review loaded kernel modules and eBPF programs
+5. Check for hidden processes, files, and network connections
+6. Consider reimaging the system as rootkit removal is unreliable
+', '["https://attack.mitre.org/techniques/T1014/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml","https://github.com/h3xduck/TripleCross"]', 'contains("log.message", "sudo") &&
+contains("log.message", " tc ") &&
+(contains("log.message", "qdisc") || contains("log.message", "filter"))
+', '2026-02-09 16:39:12.666738', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (357, 'Webshell Activity - Web Server Spawning Suspicious Commands', 3, 3, 3, 'Persistence', 'T1505.003 - Server Software Component: Web Shell', 'Detects web server processes (httpd, nginx, apache2, tomcat, java) spawning reconnaissance or system commands such as whoami, ifconfig, uname, id, cat, crontab, wget, curl. This pattern strongly indicates an active webshell being used by an attacker to execute commands on the compromised server.
+
+Next Steps:
+1. Immediately isolate the web server from the network
+2. Identify the specific webshell file by reviewing web server access logs around the alert time
+3. Search for recently created or modified files in web-accessible directories
+4. Check for uploaded files with PHP, JSP, ASP, or CGI extensions
+5. Review the commands executed through the webshell to assess scope of compromise
+6. Look for lateral movement or data exfiltration from this host
+7. Patch the vulnerability that allowed the webshell upload
+8. Restore web application files from a clean, verified backup
+', '["https://attack.mitre.org/techniques/T1505/003/","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml"]', 'exists("log.message") &&
+(regexMatch("log.message", "(?i)(httpd|nginx|apache2|tomcat|catalina|java).*child process.*(whoami|ifconfig|uname|id |cat |crontab|wget |curl )") ||
+ regexMatch("log.message", "(?i)(httpd|nginx|apache2|tomcat|catalina)\\[\\d+\\].*exec.*(whoami|ifconfig|uname|/bin/id|/bin/cat|/bin/sh|/bin/bash|wget|curl)") ||
+ (contains("log.message", ["httpd", "nginx", "apache2", "tomcat"]) &&
+ contains("log.message", ["whoami", "ifconfig", "uname -a", "/etc/passwd", "id;", "cat /etc"])))
+', '2026-02-09 16:39:12.822317', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (358, 'Kafka Connect Malicious Connector Detection', 3, 3, 2, 'Code Execution', 'T1059 - Command and Scripting Interpreter', 'Detects deployment of potentially malicious Kafka Connect connectors. Attackers can deploy connectors to exfiltrate data to external systems, inject malicious data, or execute code through custom connector plugins.
+
+Next Steps:
+1. Review the connector configuration and plugin class
+2. Verify the connector deployment was authorized
+3. Check the connector source/sink endpoints for legitimacy
+4. Remove unauthorized connectors immediately
+5. Restrict Kafka Connect REST API access
+6. Implement connector class allowlisting
+', '["https://kafka.apache.org/documentation/#connect","https://attack.mitre.org/techniques/T1059/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "connector") && contains("log.message", "created")) ||
+ (contains("log.message", "connector") && contains("log.message", "Starting")) ||
+ contains("log.message", "ConnectorConfig") ||
+ (contains("log.message", "PUT /connectors/") && contains("log.message", "config")) ||
+ (contains("log.message", "POST /connectors") && !contains("log.message", "status")) ||
+ (contains("log.message", "connector.class") && (
+ contains("log.message", "FileStreamSink") ||
+ contains("log.message", "FileStreamSource") ||
+ contains("log.message", "S3Sink") ||
+ contains("log.message", "HttpSink")
+ ))
+)
+', '2026-02-09 16:39:12.962654', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (359, 'Kafka Unauthorized Producer Spoofing Detection', 1, 3, 2, 'Data Manipulation', 'T1565.001 - Data Manipulation: Stored Data Manipulation', 'Detects unauthorized message production to Kafka topics that could indicate data injection or message spoofing. Monitors for producer authorization failures and unusual producer registrations.
+
+Next Steps:
+1. Identify the unauthorized producer client and source host
+2. Review the messages produced to verify data integrity
+3. Check Kafka ACLs for producer permissions
+4. Block unauthorized producers via ACL configuration
+5. Implement idempotent producer settings for critical topics
+6. Review topic data for injected or manipulated messages
+', '["https://kafka.apache.org/documentation/#producerconfigs","https://attack.mitre.org/techniques/T1565/001/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "TOPIC_AUTHORIZATION_FAILED") && contains("log.message", "Produce")) ||
+ (contains("log.message", "not authorized to") && contains("log.message", "Write")) ||
+ (equals("log.severity", "ERROR") && contains("log.message", "ProduceRequest") && contains("log.message", "authorization")) ||
+ (contains("log.message", "transactional.id") && contains("log.message", "authorization"))
+)
+', '2026-02-09 16:39:13.092622', true, false, 'origin', null, '[{"indexPattern":"v11-log-kafka-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"},{"field":"log.message","operator":"filter_match","value":"TOPIC_AUTHORIZATION_FAILED OR not authorized OR ProduceRequest"}],"or":null,"within":"now-10m","count":5}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (360, 'Kafka Topic Deletion Detection', 1, 3, 3, 'Data Destruction', 'T1485 - Data Destruction', 'Detects Kafka topic deletion operations that could result in message data loss. Topic deletion is a destructive operation that permanently removes all messages and partitions.
+
+Next Steps:
+1. Verify if the topic deletion was authorized
+2. Identify the user or service that initiated the deletion
+3. Check if any dependent applications were affected
+4. Review if message data can be recovered from other consumers
+5. Restrict topic deletion via Kafka ACLs
+6. Implement topic deletion protection for critical topics
+', '["https://kafka.apache.org/documentation/#topicconfigs","https://attack.mitre.org/techniques/T1485/"]', 'exists("log.message") &&
+(
+ contains("log.message", "Topic deletion") ||
+ (contains("log.message", "DeleteTopics") && !contains("log.message", "TOPIC_AUTHORIZATION_FAILED")) ||
+ contains("log.message", "Deleting topic") ||
+ (contains("log.message", "topic") && contains("log.message", "marked for deletion")) ||
+ contains("log.message", "TopicDeletion")
+)
+', '2026-02-09 16:39:13.237029', true, false, 'origin', null, '[{"indexPattern":"v11-log-kafka-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-10m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (361, 'NATS Unauthorized Route Poisoning Detection', 2, 3, 3, 'Network Manipulation', 'T1557 - Adversary-in-the-Middle', 'Detects unauthorized route advertisements and cluster join attempts in NATS. Attackers inject rogue routes to intercept messages, disrupt cluster operations, or perform man-in-the-middle attacks.
+
+Next Steps:
+1. Verify the connecting route/node is an authorized cluster member
+2. Review the cluster route configuration
+3. Check for any unauthorized servers in the cluster
+4. Disconnect unauthorized routes immediately
+5. Implement route authentication and TLS verification
+6. Monitor cluster topology for unexpected changes
+', '["https://docs.nats.io/running-a-nats-service/configuration/clustering","https://attack.mitre.org/techniques/T1557/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "route") && contains("log.message", "added")) ||
+ (contains("log.message", "route") && contains("log.message", "connected")) ||
+ (contains("log.message", "cluster") && contains("log.message", "unauthorized")) ||
+ (contains("log.message", "gateway") && contains("log.message", "unknown")) ||
+ (contains("log.message", "leaf node") && contains("log.message", "unauthorized")) ||
+ (equals("log.severity", "ERROR") && contains("log.message", "route") && contains("log.message", "TLS"))
+)
+', '2026-02-09 16:39:13.372724', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (363, 'NATS Credential Theft Detection', 3, 2, 1, 'Credential Access', 'T1528 - Steal Application Access Token', 'Detects credential theft attempts in NATS including repeated authentication failures, token replay attempts, and unauthorized credential access patterns that go beyond simple JWT validation failures.
+
+Next Steps:
+1. Review the authentication failure patterns and source hosts
+2. Check if any stolen credentials were successfully used
+3. Rotate compromised credentials immediately
+4. Review NATS account and user configurations
+5. Implement IP-based access restrictions
+6. Monitor for lateral movement using stolen credentials
+', '["https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro","https://attack.mitre.org/techniques/T1528/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "authentication") && contains("log.message", "failed")) ||
+ (contains("log.message", "Authorization") && contains("log.message", "Violation")) ||
+ (contains("log.message", "nkey") && contains("log.message", "not found")) ||
+ (contains("log.message", "token") && contains("log.message", "expired")) ||
+ (contains("log.message", "credentials") && contains("log.message", "invalid")) ||
+ (contains("log.message", "bad client credentials") && exists("origin.ip"))
+)
+', '2026-02-09 16:39:13.583614', true, false, 'origin', null, '[{"indexPattern":"v11-log-nats-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"},{"field":"log.message","operator":"filter_match","value":"authentication failed OR Authorization Violation OR credentials invalid"}],"or":null,"within":"now-10m","count":10}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (364, 'NATS Wildcard Subscription Monitoring Detection', 3, 1, 1, 'Collection', 'T1040 - Network Sniffing', 'Detects NATS ">" wildcard subscriptions that capture all messages across all subjects. This pattern is used by attackers to intercept and monitor all messaging traffic within the NATS cluster.
+
+Next Steps:
+1. Identify the client that created the wildcard subscription
+2. Verify if the subscription is from a legitimate monitoring service
+3. Review the account and user permissions for the subscriber
+4. Remove unauthorized wildcard subscriptions
+5. Implement subject-level ACLs to restrict subscriptions
+6. Monitor the subscriber for data exfiltration
+', '["https://docs.nats.io/nats-concepts/subjects#wildcards","https://attack.mitre.org/techniques/T1040/"]', 'exists("log.message") &&
+(
+ regexMatch("log.message", "(?i)subscribe\\s+>") ||
+ (contains("log.message", "SUB >") && !contains("log.message", "system")) ||
+ (contains("log.message", "subscription") && contains("log.message", ">") && !contains("log.message", "_INBOX")) ||
+ (contains("log.message", "wildcard") && contains("log.message", "subscription"))
+)
+', '2026-02-09 16:39:13.727650', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (365, 'Traefik Docker/Kubernetes Provider Exploitation Detection', 3, 3, 3, 'Container Exploitation', 'T1610 - Deploy Container', 'Detects exploitation of Traefik''s Docker or Kubernetes provider integration. Attackers can manipulate container labels or Kubernetes annotations to inject malicious routing rules, redirect traffic, or gain access to internal services.
+
+Next Steps:
+1. Review recent Docker/Kubernetes label and annotation changes
+2. Check for unauthorized routing rules in Traefik configuration
+3. Verify container deployments are from authorized registries
+4. Review Traefik provider configuration for excessive permissions
+5. Restrict Docker socket access and Kubernetes RBAC
+6. Monitor for unauthorized traffic routing changes
+', '["https://doc.traefik.io/traefik/providers/docker/","https://attack.mitre.org/techniques/T1610/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "provider") && contains("log.message", "docker") && contains("log.message", "error")) ||
+ (contains("log.message", "provider") && contains("log.message", "kubernetes") && contains("log.message", "error")) ||
+ (contains("log.message", "label") && contains("log.message", "traefik") && contains("log.message", "changed")) ||
+ (contains("log.message", "router") && contains("log.message", "added") && !contains("log.message", "middleware")) ||
+ (contains("log.message", "service") && contains("log.message", "created") && contains("log.message", "docker")) ||
+ (contains("log.message", "ingress") && contains("log.message", "updated") && contains("log.message", "traefik"))
+)
+', '2026-02-09 16:39:13.867023', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (366, 'Traefik SSRF via Service Discovery Detection', 3, 2, 1, 'Server-Side Request Forgery', 'T1090 - Proxy', 'Detects SSRF attempts through Traefik service discovery mechanisms. Attackers manipulate service registrations or routing rules to force Traefik to proxy requests to internal services or cloud metadata endpoints.
+
+Next Steps:
+1. Review the request for internal IP or metadata endpoint references
+2. Check Traefik routing rules for unauthorized backend targets
+3. Verify service discovery configurations for tampering
+4. Implement IP allowlisting for backend services
+5. Block access to metadata endpoints at the network level
+6. Block the source IP if confirmed malicious
+', '["https://owasp.org/www-community/attacks/Server_Side_Request_Forgery","https://attack.mitre.org/techniques/T1090/"]', 'exists("origin.ip") &&
+(
+ (exists("origin.path") && (
+ contains("origin.path", "169.254.169.254") ||
+ contains("origin.path", "metadata.google.internal") ||
+ regexMatch("origin.path", "(?i)https?://(127\\.0\\.0\\.1|localhost|0\\.0\\.0\\.0)") ||
+ contains("origin.path", "file:///") ||
+ contains("origin.path", "gopher://")
+ )) ||
+ (exists("log.message") && (
+ regexMatch("log.message", "(?i)backend.*127\\.0\\.0\\.1") ||
+ regexMatch("log.message", "(?i)backend.*169\\.254\\.169\\.254") ||
+ (contains("log.message", "service") && contains("log.message", "localhost"))
+ ))
+)
+', '2026-02-09 16:39:14.007307', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (367, 'Admin Account Compromise Indicators', 3, 3, 2, 'Defense Evasion, Persistence, Privilege Escalation, Initial Access', 'T1078 - Valid Accounts', 'Detects multiple failed admin login attempts followed by a successful login from the same IP address, indicating potential account compromise through credential stuffing or brute force attacks.
+
+Next Steps:
+1. Review the source IP address and check if it''s from an expected location
+2. Contact the admin user to verify if the login was legitimate
+3. Check for any suspicious activities performed after the successful login
+4. Review other authentication logs from the same IP address
+5. Consider implementing IP-based access controls for admin accounts
+6. Enable multi-factor authentication if not already configured
+7. Reset the compromised admin account password if unauthorized access is confirmed
+', '["https://attack.mitre.org/techniques/T1078/","https://docs.fortinet.com/document/fortigate/7.4.1/fortios-log-message-reference/160372/list-of-log-types-and-subtypes"]', 'equals("log.logid", "0100032001") &&
+equals("log.type", "event") &&
+equals("log.subtype", "system") &&
+equals("log.logdesc", "Admin login successful") &&
+exists("origin.ip") &&
+exists("log.user")
+', '2026-02-09 16:41:54.437750', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortigate-traffic-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.logdesc","operator":"filter_term","value":"Admin login failed"},{"field":"log.user","operator":"filter_term","value":"{{log.user}}"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (368, 'Fortinet Antivirus Malware Outbreak Detection', 3, 3, 2, 'Initial Access', 'T1566 - Phishing', 'Detects potential malware outbreak when multiple antivirus detections occur from the same source or targeting multiple destinations in a short time period. This could indicate a widespread infection attempt or a compromised system attempting to spread malware.
+
+Next Steps:
+1. Identify the specific malware detected by reviewing the virus field in the alert details
+2. Isolate the affected source IP addresses to prevent further spread
+3. Check if the blocked malware attempts indicate successful infections on any endpoints
+4. Review antivirus logs for the specific virus signature to understand the threat
+5. Scan all systems that communicated with the identified source IPs
+6. Update antivirus signatures and ensure all endpoints are protected
+7. Consider blocking the source IP at the perimeter if it''s external
+8. Document all affected systems and remediation actions taken
+', '["https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/198726/antivirus","https://attack.mitre.org/techniques/T1566/"]', 'equals("log.type", "utm") &&
+equals("log.subtype", "virus") &&
+equals("action", "blocked") &&
+(exists("origin.ip") || exists("target.ip"))
+', '2026-02-09 16:41:54.583358', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortigate-traffic-*","with":[{"field":"log.type","operator":"filter_term","value":"utm"},{"field":"log.subtype","operator":"filter_term","value":"virus"},{"field":"action","operator":"filter_term","value":"blocked"}],"or":null,"within":"now-1h","count":5}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (369, 'FortiGate Admin Login from Unusual Source', 3, 2, 1, 'Initial Access', 'T1078 - Valid Accounts', 'Detects FortiGate admin logins from unusual or external IP addresses. Successful administrative access from non-management networks may indicate credential compromise.
+
+Next Steps:
+1. Verify the login was performed by a legitimate administrator
+2. Check the geographic location of the source IP
+3. Review actions performed during the admin session
+4. Verify if trusted host restrictions are configured for admin accounts
+5. Enable MFA for administrator accounts if not already active
+6. If unauthorized, disable the account and audit recent changes
+', '["https://docs.fortinet.com/document/fortigate/7.4.1/fortios-log-message-reference/160372/list-of-log-types-and-subtypes","https://attack.mitre.org/techniques/T1078/"]', 'equals("log.logid", "0100032001") &&
+equals("log.type", "event") &&
+equals("log.subtype", "system") &&
+equals("log.logdesc", "Admin login successful") &&
+exists("origin.ip") &&
+!inCIDR("origin.ip", "10.0.0.0/8") &&
+!inCIDR("origin.ip", "172.16.0.0/12") &&
+!inCIDR("origin.ip", "192.168.0.0/16") &&
+!inCIDR("origin.ip", "127.0.0.0/8")
+', '2026-02-09 16:41:54.727193', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (370, 'Data Loss Prevention Trigger', 3, 2, 1, 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 'Detects attempts to exfiltrate sensitive data that triggers DLP policies. This includes detection of credit card numbers, social security numbers, PII, financial records, and other regulated data attempting to leave the network.
+
+Next Steps:
+1. Identify the source IP and user associated with the DLP violation
+2. Review the DLP profile that was triggered to understand what type of sensitive data was involved
+3. Check if this is part of a pattern of data exfiltration attempts from the same source
+4. Verify if the blocked action was legitimate business activity or potential data theft
+5. Review other logs from the same source IP for suspicious activities
+6. Contact the user if needed to understand the context of the attempted data transfer
+7. Consider implementing additional access controls if unauthorized access to suspected
+', '["https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/153498/data-loss-prevention","https://attack.mitre.org/techniques/T1048/"]', '(equals("log.subtype", "dlp") && equals("log.action", "blocked")) ||
+(contains("log.msg", "DLP sensor")) ||
+(contains("log.msg", "sensitive data detected")) ||
+(exists("log.dlp_profile") && equals("log.dlp_action", "block")) ||
+(contains("log.msg", "Data pattern matched"))
+', '2026-02-09 16:41:54.862436', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortigate-traffic-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.subtype","operator":"filter_term","value":"dlp"}],"or":null,"within":"now-1h","count":3}]', '["lastEvent.log.dlp_profile","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (371, 'FortiGate VPN Authentication Brute Force', 3, 2, 1, 'Credential Access', 'T1133 - External Remote Services', 'Detects multiple SSL-VPN or IPsec VPN authentication failures from the same source IP on FortiGate, indicating brute force or credential stuffing attacks against remote access services.
+
+Next Steps:
+1. Investigate the source IP and check threat intelligence databases
+2. Review if the targeted user accounts exist and are active
+3. Check for any successful VPN connections following the failures
+4. Consider blocking the source IP or geo-restricting VPN access
+5. Enable MFA for VPN access if not already configured
+6. Check if the VPN portal is exposed to the internet unnecessarily
+', '["https://docs.fortinet.com/document/fortigate/7.4.1/fortios-log-message-reference/160372/list-of-log-types-and-subtypes","https://attack.mitre.org/techniques/T1133/"]', 'equals("log.type", "event") &&
+(equals("log.subtype", "vpn") || contains("log.msg", "vpn")) &&
+(contains("log.msg", ["ssl-login-fail", "tunnel-down", "negotiation-error", "auth-fail"]) ||
+ contains("log.logdesc", ["SSL VPN login fail", "IPsec phase1 negotiation failed", "VPN tunnel down"])) &&
+exists("origin.ip")
+', '2026-02-09 16:41:55.007696', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortigate-traffic-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (372, 'Fortinet IPS Critical Severity Detection', 3, 3, 2, 'Execution', 'T1203 - Exploitation for Client Execution', 'Detects critical severity IPS events indicating active exploitation attempts or severe security threats targeting the network.
+
+Next Steps:
+1. Immediately investigate the source IP address and determine if it''s malicious
+2. Check if the attack was successfully blocked by reviewing firewall logs
+3. Identify the specific vulnerability or attack pattern that triggered the IPS alert
+4. Review other security events from the same source IP across all systems
+5. Consider blocking the source IP at the perimeter if multiple critical attacks are detected
+6. Update IPS signatures and verify all systems are patched against the detected vulnerability
+7. Document the incident and notify the security team if this is part of a larger campaign
+', '["https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/331728/ips-sensors","https://attack.mitre.org/techniques/T1203/"]', 'contains("log.msg", "type=utm") && contains("log.msg", "subtype=ips") && (contains("log.msg", "severity=critical") || contains("log.msg", "severity=high")) && contains("log.msg", "action=blocked")', '2026-02-09 16:41:55.147127', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortigate-traffic-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (697, 'Windows: PowerShell Kerberos Ticket Request', 3, 2, 1, 'Credential Access', 'T1059 - Command and Scripting Interpreter', 'Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1059/"]', 'regexMatch("log.message", "(KerberosRequestorSecurityToken)")', '2026-02-09 16:57:29.208224', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (373, 'FortiSandbox Malicious File Detection', 3, 3, 2, 'Execution', 'T1204 - User Execution', 'Detects when FortiSandbox identifies a file as malicious based on behavioral analysis and static scanning. This indicates active malware attempting to infiltrate the network through file transfers or downloads.
+
+Next Steps:
+- Immediately isolate the source IP address and affected systems
+- Identify the file hash and search for other instances across the network
+- Review network traffic from the source IP for additional suspicious activity
+- Check if the malicious file was successfully blocked or if remediation is needed
+- Update endpoint protection signatures with the identified file hash
+- Investigate the user account associated with the file download/transfer
+- Document the incident and notify the security team for further analysis
+', '["https://docs.fortinet.com/document/fortisandbox/4.4.0/administration-guide/274898/how-files-determined-to-be-suspicious-low-medium-or-high","https://attack.mitre.org/techniques/T1204/"]', '(equals("log.subtype", "sandbox") && equals("log.verdict", "malicious")) ||
+(contains("log.msg", "sandbox verdict: malicious")) ||
+(equals("log.risk", "high") && equals("log.subtype", "sandbox")) ||
+(contains("log.msg", "FortiSandbox detected malware")) ||
+(contains("log.msg", "verdict=malicious")) ||
+(contains("log.msg", "subtype=sandbox") && contains("log.msg", "malicious"))
+', '2026-02-09 16:41:55.296635', true, false, 'origin', null, '[]', '["lastEvent.log.filehash","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (374, 'FortiWeb Authentication Bypass Attempt Detected', 3, 3, 1, 'Defense Evasion, Persistence, Privilege Escalation, Initial Access', 'T1078 - Valid Accounts', 'Detects authentication bypass attempts including direct access to protected resources, authentication flow manipulation, and credential stuffing attacks on FortiWeb protected applications.
+
+Next Steps:
+1. Review the source IP address and check if it''s from a known location or VPN service
+2. Examine the specific authentication bypass technique attempted (check log.attack_type and log.msg fields)
+3. Verify if any successful authentication occurred from the same IP address
+4. Check for other attack patterns from the same source IP in the last 24 hours
+5. Consider blocking the source IP if multiple bypass attempts are confirmed
+6. Review application logs for any successful unauthorized access
+7. Validate that authentication mechanisms are properly configured and up to date
+', '["https://docs.fortinet.com/document/fortiweb/7.2.2/log-message-reference/252057/event","https://attack.mitre.org/techniques/T1078/","https://attack.mitre.org/techniques/T1190/"]', 'exists("origin.ip") &&
+equals("log.type", "attack") &&
+(
+ equals("log.subtype", "account-lockout-detection") ||
+ contains("log.msg", "authentication") ||
+ contains("log.msg", "Authentication") ||
+ contains("log.msg", "bypass") ||
+ contains("log.msg", "unauthorized access") ||
+ equals("log.attack_type", "auth_bypass") ||
+ contains("log.trigger_policy", "auth")
+) &&
+oneOf("action", ["deny", "alert", "block"])
+', '2026-02-09 16:41:55.436697', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortiweb-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (375, 'FortiWeb File Upload Security Violation Detected', 3, 3, 2, 'Resource Development', 'T1608 - Stage Capabilities: Upload Malware', 'Detects file upload security violations including malicious file uploads, oversized files, restricted file types, and potential web shell upload attempts on FortiWeb protected applications. These violations could indicate attempts to upload malicious files, web shells, or bypass upload restrictions.
+
+Next Steps:
+1. Review the blocked file upload attempt details, including file name, type, and size
+2. Check if the source IP has made multiple file upload attempts in a short period
+3. Examine the web application logs for the specific URL path being targeted
+4. Verify if the file upload restriction policy is appropriate for the application
+5. If malicious activity is confirmed, consider blocking the source IP temporarily
+6. Review other requests from the same source IP for reconnaissance patterns
+7. Check if similar file upload attempts have been made to other applications
+', '["https://docs.fortinet.com/document/fortiweb/7.2.2/log-message-reference/252057/event","https://attack.mitre.org/techniques/T1608/","https://attack.mitre.org/techniques/T1505/003/"]', 'exists("origin.ip") &&
+(
+ contains("log.msg", "file upload") ||
+ contains("log.msg", "File upload") ||
+ contains("log.msg", "malicious file") ||
+ contains("log.msg", "file type") ||
+ contains("log.msg", "file size") ||
+ contains("log.msg", "anti-virus") ||
+ contains("log.msg", "upload violation") ||
+ contains("log.msg", "upload blocked")
+)
+', '2026-02-09 16:41:55.567321', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortiweb-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (376, 'FortiWeb SQL Injection Attack Detection', 3, 3, 2, 'Web Application Attack', 'T1190 - Exploit Public-Facing Application', 'Detects SQL injection attacks identified by FortiWeb WAF signatures. Multiple SQLi attempts from the same source indicate a targeted attack against database-backed applications.
+
+Next Steps:
+1. Review the specific SQL injection payloads to assess severity
+2. Check if the target application is vulnerable to the attempted injection
+3. Verify the attack was blocked by FortiWeb
+4. Review application logs for any successful SQLi exploitation
+5. Investigate the source IP for additional attack patterns
+6. Update WAF signatures and consider implementing parameterized queries
+', '["https://docs.fortinet.com/document/fortiweb/7.4.3/administration-guide/210196/blocking-known-attacks","https://attack.mitre.org/techniques/T1190/"]', 'oneOf("action", ["deny", "block", "alert_deny", "alert"]) &&
+(regexMatch("log.msg", "(?i)(sql.*inject|union.*select|concat.*0x|xp_cmdshell|information_schema|benchmark.*sleep|extractvalue|updatexml|load_file|into.*outfile)") ||
+ contains("log.attack_type", "sql_injection") ||
+ contains("log.signature", "SQL Injection"))
+', '2026-02-09 16:41:55.712275', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortiweb-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (377, 'FortiWeb SSRF Attack Detection', 3, 2, 1, 'Web Application Attack', 'T1190 - Exploit Public-Facing Application', 'Detects Server-Side Request Forgery (SSRF) attacks identified by FortiWeb. SSRF attacks force the server to make requests to internal resources, potentially accessing cloud metadata services, internal APIs, or other restricted endpoints.
+
+Next Steps:
+1. Review the SSRF payload to identify the target internal resource
+2. Check if cloud metadata endpoints (169.254.169.254) were targeted
+3. Verify the application is not vulnerable to SSRF
+4. Review application code for user-controlled URL parameters
+5. Implement URL allowlisting for server-side requests
+6. Check for any successful SSRF exploitation in application logs
+', '["https://docs.fortinet.com/document/fortiweb/7.4.3/administration-guide/210196/blocking-known-attacks","https://attack.mitre.org/techniques/T1190/"]', 'oneOf("action", ["deny", "block", "alert_deny", "alert"]) &&
+(regexMatch("log.msg", "(?i)(ssrf|server.*side.*request.*forg|169\\.254\\.169\\.254|metadata.*api|internal.*service|localhost|127\\.0\\.0\\.1.*redirect|0x7f000001|file:///|gopher://)") ||
+ contains("log.attack_type", "ssrf") ||
+ contains("log.signature", "SSRF"))
+', '2026-02-09 16:41:55.862301', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortiweb-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (378, 'FortiWeb Web Shell Upload Detection', 3, 3, 3, 'Persistence', 'T1505.003 - Server Software Component: Web Shell', 'Detects web shell upload attempts blocked or detected by FortiWeb. Web shells provide persistent remote access and command execution on compromised web servers.
+
+Next Steps:
+1. Verify if the upload attempt was blocked or if it succeeded
+2. Review the uploaded file name and extension for known web shell patterns
+3. Scan the web server for existing web shells that may have been uploaded earlier
+4. Check the upload endpoint for proper file validation controls
+5. Review the source IP for additional attack attempts
+6. If a web shell was successfully uploaded, immediately isolate the server
+', '["https://docs.fortinet.com/document/fortiweb/7.4.3/administration-guide/210196/blocking-known-attacks","https://attack.mitre.org/techniques/T1505/003/"]', 'oneOf("action", ["deny", "block", "alert_deny", "alert"]) &&
+(regexMatch("log.msg", "(?i)(web.*shell|backdoor.*upload|cmd.*shell|reverse.*shell|\.php.*upload|\.asp.*upload|\.jsp.*upload|c99|r57|china.*chopper|weevely|b374k)") ||
+ (contains("log.attack_type", "file_upload") && contains("log.msg", ["shell", "backdoor", "malicious"])) ||
+ regexMatch("log.msg", "(?i)(file.*upload.*violat|upload.*restrict|dangerous.*file.*type)"))
+', '2026-02-09 16:41:56.004881', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (379, 'FortiWeb OWASP Top 10 Violation Attempts', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects attempts to exploit OWASP Top 10 vulnerabilities including injection flaws, broken authentication, sensitive data exposure, XXE, broken access control, security misconfiguration, and more. This rule triggers when FortiWeb blocks or alerts on attack attempts that match known OWASP Top 10 vulnerability patterns.
+
+Next Steps:
+1. Review the blocked request details in FortiWeb logs to understand the attack vector
+2. Check if the source IP has attempted multiple different attack types
+3. Verify if the targeted application has any known vulnerabilities
+4. Consider blocking the source IP if attacks persist
+5. Review application security headers and WAF rules for the targeted resource
+6. Check for any successful requests from the same source IP before the block
+7. Analyze the specific OWASP category and implement additional protections
+8. Review application code for the detected vulnerability type
+', '["https://docs.fortinet.com/document/fortiweb-cloud/23.3.0/user-guide/552829/known-attacks","https://owasp.org/www-project-top-ten/","https://attack.mitre.org/techniques/T1190/"]', 'oneOf("action", ["deny", "alert_deny", "block", "blocked"]) &&
+regexMatch("log.msg", "(?i)(injection|traversal|xxe|xml external entity|broken auth|sensitive data|security misconfig|owasp|sqli|xss|csrf|command injection|path traversal|lfi|rfi|deserialization)")
+', '2026-02-09 16:41:56.147214', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortiweb-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (380, 'FortiWeb Web Application Attack Detection', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects SQL injection, XSS, and other web application attacks blocked by FortiWeb WAF based on signature or syntax-based detection. These attacks attempt to exploit vulnerabilities in web applications to gain unauthorized access, steal data, or compromise application integrity.
+
+Next Steps:
+1. Review the specific attack type and payload in the FortiWeb logs
+2. Check if the source IP has a history of malicious activity
+3. Verify if the targeted application has known vulnerabilities
+4. Review application logs for any successful exploitation attempts
+5. Consider blocking the source IP if attacks persist
+6. Ensure WAF rules are up-to-date and properly configured
+7. Implement additional application-level security controls if needed
+8. Check for any bypass attempts or evasion techniques being used
+', '["https://docs.fortinet.com/document/fortiweb/7.6.0/administration-guide/981691/syntax-based-sql-xss-injection-detection","https://attack.mitre.org/techniques/T1190/"]', 'equals("action", "deny") &&
+(
+ equals("log.type", "attack") ||
+ equals("log.subtype", "waf") ||
+ oneOf("log.attack_type", ["SQL Injection", "Cross Site Scripting", "XSS", "SQLi"]) ||
+ contains("log.message", "sql injection") ||
+ contains("log.message", "SQL injection") ||
+ contains("log.message", "cross site scripting") ||
+ contains("log.message", "Cross Site Scripting") ||
+ contains("log.message", "xss") ||
+ contains("log.message", "XSS") ||
+ contains("log.message", "sqli") ||
+ contains("log.message", "SQLi") ||
+ equals("log.main_type", "SQL/XSS Syntax Based Detection")
+)
+', '2026-02-09 16:41:56.287116', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-fortiweb-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"action","operator":"filter_term","value":"deny"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (381, 'GitHub Action Secret Access Activity', 3, 3, 1, 'Collection', 'T1552 - Unsecured Credentials', 'Detects access, modification, or suspicious activities related to GitHub Action secrets. This could indicate attempts to steal credentials, API keys, or other sensitive information stored in repository or organization secrets.
+
+Next Steps:
+1. Review the GitHub audit logs to identify who accessed or modified the secrets
+2. Check if the user performing the action has legitimate business need for secret access
+3. Verify if any secrets were exposed in workflow logs or outputs
+4. Rotate any potentially compromised secrets immediately
+5. Review repository and organization permissions to ensure proper access controls
+6. Check for any unusual API calls or automated scripts accessing secrets
+7. Enable secret scanning alerts if not already configured
+8. Consider implementing additional controls like environment-specific secrets and approval workflows
+', '["https://docs.github.com/en/actions/security-guides/encrypted-secrets","https://attack.mitre.org/techniques/T1552/"]', 'oneOf("log.action", ["secret.create", "secret.update", "secret.remove"]) ||
+oneOf("log.action", ["actions.secret.create", "actions.secret.update", "actions.secret.remove", "dependabot.secret.create", "dependabot.secret.update", "dependabot.secret.remove"])
+', '2026-02-09 16:41:56.417751', true, false, 'origin', null, '[{"indexPattern":"v11-log-github-*","with":[{"field":"log.repositoryName","operator":"filter_term","value":"{{log.repositoryName}}"},{"field":"log.action","operator":"filter_match","value":"secret"}],"or":null,"within":"now-1h","count":3}]', '["lastEvent.log.action","lastEvent.log.repositoryName","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (382, 'GitHub CODEOWNERS File Modification', 2, 3, 1, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects modifications to CODEOWNERS files which define required reviewers for code changes. Attackers may modify CODEOWNERS to remove review requirements for sensitive paths, enabling them to merge malicious code without proper review.
+
+Next Steps:
+1. Review the CODEOWNERS file changes and identify removed or modified ownership rules
+2. Check if critical paths (workflows, configs, secrets) lost their code owners
+3. Verify the committer is an authorized repository administrator
+4. Review PRs merged after the CODEOWNERS change for unreviewed code
+5. Check if branch protection still requires CODEOWNERS review
+6. If unauthorized, revert the CODEOWNERS change and review recent merges
+7. Implement branch protection rules requiring CODEOWNERS approval
+8. Set up alerts on changes to repository configuration files
+', '["https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners","https://attack.mitre.org/techniques/T1562/001/"]', '(equals("log.action", "git.push") || equals("log.action", "repo.update_file")) &&
+exists("log.senderLogin") &&
+contains("log.commitMessage", "CODEOWNERS")
+', '2026-02-09 16:41:56.557312', true, false, 'origin', null, '[{"indexPattern":"v11-log-github-*","with":[{"field":"log.repositoryName","operator":"filter_term","value":"{{log.repositoryName}}"},{"field":"log.senderLogin","operator":"filter_term","value":"{{log.senderLogin}}"}],"or":null,"within":"now-24h","count":2}]', '["lastEvent.log.repositoryName","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (383, 'GitHub Dependabot Configuration Poisoning', 2, 3, 1, 'Supply Chain Compromise', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 'Detects modifications to dependabot.yml configuration files that could redirect dependency updates to malicious registries or introduce malicious packages. Attackers may modify the Dependabot configuration to substitute legitimate dependencies with malicious alternatives.
+
+Next Steps:
+1. Review the dependabot.yml changes for suspicious registry configurations
+2. Check if custom registries point to legitimate package repositories
+3. Verify the committer is an authorized repository maintainer
+4. Review recently opened Dependabot PRs for unexpected dependency changes
+5. Check if any malicious packages were introduced through dependency updates
+6. If malicious, revert the configuration and audit all recent dependency changes
+7. Implement CODEOWNERS to require review for configuration file changes
+8. Enable dependency review for pull requests
+', '["https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates","https://attack.mitre.org/techniques/T1195/002/"]', '(equals("log.action", "git.push") || equals("log.action", "repo.update_file")) &&
+exists("log.senderLogin") &&
+contains("log.commitMessage", "dependabot")
+', '2026-02-09 16:41:56.687351', true, false, 'origin', null, '[{"indexPattern":"v11-log-github-*","with":[{"field":"log.repositoryName","operator":"filter_term","value":"{{log.repositoryName}}"},{"field":"log.senderLogin","operator":"filter_term","value":"{{log.senderLogin}}"}],"or":null,"within":"now-24h","count":2}]', '["lastEvent.log.repositoryName","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (384, 'GitHub App Installation Token Suspicious Access', 2, 2, 1, 'Credential Access', 'T1528 - Steal Application Access Token', 'Detects suspicious GitHub App installation and token activity from unexpected sources. Attackers who steal GitHub App private keys can generate installation tokens for any organization that installed the app, gaining broad access to repositories.
+
+Next Steps:
+1. Review the GitHub App installation and its configured permissions
+2. Verify the installation was authorized by an organization administrator
+3. Check the App''s webhook delivery history for unexpected endpoints
+4. Review repository access granted by the App installation
+5. Examine recent API calls made using the App''s installation token
+6. If compromised, revoke the App installation and rotate its private key
+7. Review all repositories the App had access to for unauthorized changes
+8. Implement IP allow-listing for the GitHub App
+', '["https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app","https://attack.mitre.org/techniques/T1528/"]', '(equals("log.action", "integration_installation.create") ||
+ equals("log.action", "integration_installation.repositories_added") ||
+ equals("log.action", "integration_installation.unsuspend")) &&
+exists("log.senderLogin")
+', '2026-02-09 16:41:56.832339', true, false, 'origin', null, '[]', '["lastEvent.log.action","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (385, 'GitHub Environment Protection Rule Bypass', 2, 3, 1, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects changes to GitHub environment protection rules including removal of required reviewers, wait timers, or branch restrictions. Attackers may modify these protections to deploy malicious code to production environments without approval.
+
+Next Steps:
+1. Verify the environment protection change was authorized
+2. Review the specific protections that were modified or removed
+3. Check which deployment environment was affected (production, staging)
+4. Review recent deployments to the affected environment
+5. Verify the repository admin making the change
+6. If unauthorized, restore the environment protection rules immediately
+7. Review deployment logs for unauthorized deployments during the protection gap
+8. Implement required reviewers for critical environment changes
+', '["https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment","https://attack.mitre.org/techniques/T1562/001/"]', '(equals("log.action", "environment.update_protection_rule") ||
+ equals("log.action", "environment.delete_protection_rule") ||
+ equals("log.action", "environment.update") ||
+ equals("log.action", "environment.delete")) &&
+exists("log.senderLogin")
+', '2026-02-09 16:41:56.982773', true, false, 'origin', null, '[]', '["lastEvent.log.repositoryName","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (386, 'GitHub Mass Repository Cloning Detection', 3, 2, 1, 'Collection', 'T1213 - Data from Information Repositories', 'Detects when multiple repositories are cloned or accessed in a short time period, which could indicate data exfiltration or reconnaissance activities. This rule monitors for patterns of repository access that exceed normal user behavior, potentially indicating an insider threat or compromised account attempting to steal source code.
+
+Next Steps:
+1. Review the user account activity to determine if this is legitimate behavior
+2. Check if the user typically accesses multiple repositories as part of their role
+3. Verify if the account shows signs of compromise (unusual login locations, times, or authentication methods)
+4. Review which repositories were accessed and determine their sensitivity
+5. Contact the user to verify the activity if suspicious
+6. Consider temporarily suspending the account if malicious activity is confirmed
+7. Review access logs for the specific repositories that were cloned
+8. Check for any data downloads or exports from the same user session
+', '["https://docs.github.com/en/webhooks/webhook-events-and-payloads#push","https://attack.mitre.org/techniques/T1213/"]', '(equals("log.action", "clone") ||
+ equals("log.action", "git.clone") ||
+ equals("log.action", "git.fetch")) &&
+exists("log.repositoryName") &&
+exists("log.senderLogin")
+', '2026-02-09 16:41:57.122256', true, false, 'origin', null, '[{"indexPattern":"v11-log-github-*","with":[{"field":"log.senderLogin","operator":"filter_term","value":"{{log.senderLogin}}"},{"field":"log.action","operator":"filter_match","value":"clone fetch"}],"or":null,"within":"now-30m","count":10}]', '["lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (387, 'GitHub Repository Visibility Changed to Public', 3, 2, 1, 'Data Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Detects when a private repository''s visibility is changed to public, potentially exposing proprietary source code, credentials, and sensitive configuration. This is a critical event that can lead to data exposure and intellectual property theft.
+
+Next Steps:
+1. Immediately verify if the visibility change was authorized
+2. Review the repository contents for secrets, credentials, and proprietary code
+3. Check if the repository was cloned or forked after becoming public
+4. Scan the repository for exposed API keys, passwords, and tokens
+5. If unauthorized, immediately revert the repository to private
+6. Rotate any secrets or credentials found in the repository
+7. Review the repository''s commit history for sensitive data
+8. Implement organization policy to prevent public repository creation
+', '["https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility","https://attack.mitre.org/techniques/T1537/"]', '(equals("log.action", "repo.access") ||
+ equals("log.action", "repo.visibility_change") ||
+ equals("log.action", "repo.update")) &&
+equals("log.visibility", "public") &&
+exists("log.senderLogin")
+', '2026-02-09 16:41:57.262033', true, false, 'origin', null, '[]', '["lastEvent.log.repositoryName","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (388, 'GitHub Organization Member to Owner Role Escalation', 3, 3, 2, 'Privilege Escalation', 'T1098 - Account Manipulation', 'Detects escalation of GitHub organization member roles from member to owner. Organization owners have full administrative access including managing billing, teams, repositories, and security settings. Unauthorized role escalation can lead to complete organizational compromise.
+
+Next Steps:
+1. Verify the role change was authorized by an existing organization owner
+2. Review the user being promoted and their business justification
+3. Check if the promoting owner''s account shows signs of compromise
+4. Review the new owner''s recent activities post-escalation
+5. Check for changes to organization settings, webhooks, or security configurations
+6. If unauthorized, immediately demote the user and investigate the promoting account
+7. Enable required two-factor authentication for all organization owners
+8. Implement audit log streaming for real-time organization event monitoring
+', '["https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization","https://attack.mitre.org/techniques/T1098/"]', '(equals("log.action", "org.update_member") ||
+ equals("log.action", "org.add_member")) &&
+equals("log.permission", "admin") &&
+exists("log.senderLogin")
+', '2026-02-09 16:41:57.407580', true, false, 'origin', null, '[]', '["lastEvent.log.senderLogin","lastEvent.log.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (389, 'GitHub Self-Hosted Runner Compromise Detection', 3, 3, 2, 'Supply Chain Compromise', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 'Detects suspicious self-hosted runner operations including unexpected runner registration, deregistration, or workflows specifically targeting self-hosted runners. Compromised self-hosted runners can provide access to the internal network and secrets stored on the runner machine.
+
+Next Steps:
+1. Verify the runner registration or deregistration was authorized
+2. Review the runner''s labels and the workflows targeting it
+3. Check if the runner machine has been compromised
+4. Review secrets and environment variables accessible to the runner
+5. Examine recent workflow runs on the affected runner for malicious jobs
+6. If compromised, deregister the runner and re-image the machine
+7. Rotate all secrets and tokens accessible to the runner
+8. Implement runner groups with restricted repository access
+', '["https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners","https://attack.mitre.org/techniques/T1195/002/"]', '(equals("log.action", "self_hosted_runner.register") ||
+ equals("log.action", "self_hosted_runner.remove") ||
+ equals("log.action", "self_hosted_runner.update") ||
+ equals("log.action", "self_hosted_runner_group.create") ||
+ equals("log.action", "self_hosted_runner_group.update")) &&
+exists("log.senderLogin")
+', '2026-02-09 16:41:57.567191', true, false, 'origin', null, '[]', '["lastEvent.log.action","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (390, 'GitHub Secret Scanning Alert Detected', 3, 2, 1, 'Credential Access', 'T1552: Unsecured Credentials', 'Detects when GitHub''s secret scanning feature identifies potential secrets, API keys, or credentials committed to a repository. This could indicate inadvertent exposure of sensitive information that could be exploited by attackers.
+
+Next Steps:
+1. Immediately review the alert details to identify the exposed secret type and location
+2. Rotate or revoke the exposed credential immediately
+3. Remove the secret from the repository history using git filter-branch or BFG Repo-Cleaner
+4. Audit access logs for any unauthorized use of the exposed credential
+5. Review commit history to identify who committed the secret
+6. Implement pre-commit hooks to prevent future secret exposures
+7. Enable push protection in GitHub to prevent secrets from being pushed
+', '["https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning","https://attack.mitre.org/techniques/T1552/"]', 'equals("log.action", "secret_scanning_alert.created") || equals("log.action", "secret_scanning.new_alert") || (equals("log.alert_type", "secret") && equals("log.state", "open"))', '2026-02-09 16:41:57.722013', true, false, 'origin', null, '[]', '["lastEvent.log.alert_number","lastEvent.log.repositoryName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (391, 'GitHub Sensitive Data Commit Detection', 3, 2, 1, 'Collection', 'T1074 - Data Staged', 'Detects commits that may contain sensitive data such as API keys, passwords, private keys, or other credentials based on commit message patterns or file names.
+
+Next Steps:
+1. Review the commit content to verify if sensitive data was actually exposed
+2. Check the repository visibility (public vs private)
+3. If confirmed, immediately rotate any exposed credentials
+4. Remove the sensitive data from repository history using git filter-branch or BFG Repo-Cleaner
+5. Enable GitHub secret scanning for the repository
+6. Review repository access logs to determine if the exposed data was accessed
+7. Implement pre-commit hooks to prevent future credential commits
+', '["https://docs.github.com/en/webhooks/webhook-events-and-payloads#push","https://attack.mitre.org/techniques/T1074/"]', 'equals("log.action", "push") &&
+(contains("log.headCommitAdded", ".pem") ||
+ contains("log.headCommitAdded", ".key") ||
+ contains("log.headCommitAdded", ".p12") ||
+ contains("log.headCommitAdded", ".pfx") ||
+ contains("log.headCommitAdded", "id_rsa") ||
+ contains("log.headCommitAdded", "id_dsa") ||
+ contains("log.headCommitModified", ".pem") ||
+ contains("log.headCommitModified", ".key") ||
+ contains("log.headCommitModified", ".p12") ||
+ contains("log.headCommitModified", ".pfx") ||
+ contains("log.headCommitModified", "id_rsa") ||
+ contains("log.headCommitModified", "id_dsa"))
+', '2026-02-09 16:41:57.882248', true, false, 'origin', null, '[]', '["lastEvent.log.headCommitId","lastEvent.log.repositoryName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (392, 'GitHub Workflow pull_request_target Injection', 3, 3, 1, 'Supply Chain Compromise', 'T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools', 'Detects modifications to GitHub Actions workflow files that may introduce pull_request_target trigger abuse. This trigger runs with repository write permissions and secrets access even on forked PRs, making it a high-value target for supply chain attacks.
+
+Next Steps:
+1. Review the workflow file changes for pull_request_target trigger usage
+2. Check if the workflow checks out PR head code (dangerous with pull_request_target)
+3. Verify the committer is an authorized repository maintainer
+4. Review the workflow for unsafe uses of PR title, body, or labels in script context
+5. Check for recent fork-based PRs that could exploit the workflow
+6. If malicious, revert the workflow change and review PR history
+7. Implement branch protection requiring code review for workflow changes
+8. Use workflow_run instead of pull_request_target where possible
+', '["https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target","https://attack.mitre.org/techniques/T1195/001/"]', '(equals("log.action", "workflows.completed_workflow_run") ||
+ equals("log.action", "workflows.created_workflow_run")) &&
+exists("log.senderLogin") &&
+(contains("log.workflowFileName", "pull_request_target") ||
+ contains("log.event", "pull_request_target"))
+', '2026-02-09 16:41:58.042469', true, false, 'origin', null, '[]', '["lastEvent.log.repositoryName","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (393, 'GitHub Workflow Modifications Detected', 3, 3, 2, 'Initial Access', 'T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools', 'Detects modifications to GitHub Actions workflows which could be used to inject malicious code into the CI/CD pipeline or steal secrets. Attackers may modify workflows to execute arbitrary code, exfiltrate secrets, or compromise the software supply chain.
+
+Next Steps:
+1. Review the modified workflow files to identify any suspicious changes or additions
+2. Check if the user who made the modifications has legitimate access and business justification
+3. Look for any attempts to access secrets or environment variables in the workflow
+4. Verify if any external actions or Docker images were added that could be malicious
+5. Review commit history and pull request approvals for the workflow changes
+6. Consider temporarily disabling the workflow if suspicious activity is confirmed
+7. Audit repository access permissions and enable branch protection rules for workflow files
+8. Check for any unusual timing of modifications (off-hours, weekends)
+9. Verify the integrity of the repository and look for other suspicious activities
+10. Review access logs for the user account that made the modifications
+', '["https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows","https://attack.mitre.org/techniques/T1195/001/"]', '(equals("log.action", "workflows.updated") ||
+ equals("log.action", "workflows.created") ||
+ equals("log.action", "workflow_run.completed") ||
+ equals("log.action", "workflow_dispatch")) &&
+exists("log.repositoryName") &&
+exists("log.senderLogin") &&
+(contains("log.headCommitModified", ".github/workflows/") ||
+ contains("log.headCommitAdded", ".github/workflows/") ||
+ contains("log.path", ".github/workflows/") ||
+ contains("log.filename", ".github/workflows/"))
+', '2026-02-09 16:41:58.207656', true, false, 'origin', null, '[]', '["lastEvent.log.repositoryName","lastEvent.log.senderLogin"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (396, 'IBM AIX NIM Master Exploitation Detection', 3, 3, 3, 'Lateral Movement', 'T1210 - Exploitation of Remote Services', 'Detects exploitation of IBM AIX Network Installation Management (NIM) master to deploy malicious packages, modify client configurations, or perform lateral movement across AIX infrastructure.
+
+Next Steps:
+1. Verify the NIM operations were authorized
+2. Review NIM client configurations for unauthorized changes
+3. Check for malicious LPP/installp packages in NIM resources
+4. Verify NIM master access controls
+5. Review NIM client machine definitions
+6. Audit NIM operation logs for unauthorized deployments
+', '["https://www.ibm.com/docs/en/aix/7.2?topic=management-network-installation-nim","https://attack.mitre.org/techniques/T1210/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "nim") && (
+ contains("log.message", "define") ||
+ contains("log.message", "cust") ||
+ contains("log.message", "maint") ||
+ contains("log.message", "bos_inst") ||
+ contains("log.message", "alt_disk_install")
+ )) ||
+ (contains("log.message", "nimclient") && contains("log.message", "-o")) ||
+ (contains("log.message", "NIM") && contains("log.message", "push") && contains("log.message", "operation")) ||
+ (contains("log.message", "lpp_source") && contains("log.message", "define"))
+)
+', '2026-02-09 16:47:09.768567', true, false, 'origin', null, '[{"indexPattern":"v11-log-ibm-aix-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-30m","count":3}]', '["adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (412, 'GraphQL Abuse Detection', 2, 1, 1, 'API Abuse', 'T1190 - Exploit Public-Facing Application', 'Detects GraphQL abuse patterns including introspection queries, query batching, deeply nested queries for DoS, and unauthorized schema discovery. These techniques are used to enumerate APIs and exploit GraphQL endpoints.
+
+Next Steps:
+1. Review the GraphQL queries for malicious patterns
+2. Check if introspection queries exposed the schema
+3. Verify if query batching was used for brute force
+4. Implement query depth limiting and complexity analysis
+5. Disable introspection in production environments
+6. Deploy rate limiting for GraphQL endpoints
+', '["https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html","https://attack.mitre.org/techniques/T1190/"]', 'exists("origin.ip") &&
+(
+ regexMatch("raw", "(?i)\\{\\s*__schema\\s*\\{") ||
+ contains("raw", "IntrospectionQuery") ||
+ contains("raw", "introspectionQuery") ||
+ regexMatch("raw", "(?i)(query|mutation)\\s*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{")
+)
+', '2026-02-09 16:47:12.188202', true, false, 'origin', null, '[{"indexPattern":"v11-log-json-input-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (394, 'IBM AIX Unauthorized Crontab Modification Detection', 2, 3, 2, 'Persistence', 'T1053.003 - Scheduled Task/Job: Cron', 'Detects unauthorized crontab modifications on IBM AIX systems that could indicate persistence establishment by an attacker. Monitors for crontab changes, at job submissions, and modifications to /var/spool/cron.
+
+Next Steps:
+1. Review the crontab entries that were added or modified
+2. Verify the user account making the changes
+3. Check the scheduled commands for malicious payloads
+4. Review /var/spool/cron for all user crontabs
+5. Implement cron.allow/cron.deny restrictions
+6. Monitor execution of suspicious scheduled tasks
+', '["https://www.ibm.com/docs/en/aix/7.2?topic=c-crontab-command","https://attack.mitre.org/techniques/T1053/003/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "crontab") && (
+ contains("log.message", "EDIT") ||
+ contains("log.message", "REPLACE") ||
+ contains("log.message", "-e") ||
+ contains("log.message", "installed")
+ )) ||
+ (contains("log.message", "/var/spool/cron") && (
+ contains("log.message", "modified") ||
+ contains("log.message", "created") ||
+ contains("log.message", "changed")
+ )) ||
+ (contains("log.message", "at ") && contains("log.message", "job")) ||
+ (contains("log.message", "cron") && contains("log.message", "CMD") && (
+ contains("log.message", "/tmp/") ||
+ contains("log.message", "wget") ||
+ contains("log.message", "curl") ||
+ contains("log.message", "bash -c") ||
+ contains("log.message", "python")
+ ))
+)
+', '2026-02-09 16:47:09.477618', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (395, 'IBM AIX Unauthorized HMC Access Detection', 3, 3, 3, 'Unauthorized Access', 'T1078 - Valid Accounts', 'Detects unauthorized access to the IBM Hardware Management Console (HMC) that controls Power Systems hardware. HMC access allows management of LPARs, firmware, and hardware resources.
+
+Next Steps:
+1. Verify the HMC access was from an authorized administrator
+2. Review the HMC operations performed during the session
+3. Check for LPAR configuration changes
+4. Verify HMC user accounts and access controls
+5. Review HMC audit logs for additional suspicious activity
+6. Implement multi-factor authentication for HMC access
+', '["https://www.ibm.com/docs/en/power9?topic=console-hardware-management","https://attack.mitre.org/techniques/T1078/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "HMC") && (
+ contains("log.message", "login") ||
+ contains("log.message", "authentication") ||
+ contains("log.message", "session")
+ )) ||
+ (contains("log.message", "hmcshutdown") || contains("log.message", "hmcrestart")) ||
+ contains("log.message", "chsyscfg") ||
+ (contains("log.message", "lpar") && (
+ contains("log.message", "activate") ||
+ contains("log.message", "shutdown") ||
+ contains("log.message", "migrate")
+ )) ||
+ (contains("log.message", "Power Systems") && contains("log.message", "remote access"))
+)
+', '2026-02-09 16:47:09.612632', true, false, 'origin', null, '[{"indexPattern":"v11-log-ibm-aix-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-30m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (397, 'IBM AIX Rootkit Indicator Detection', 3, 3, 3, 'Defense Evasion', 'T1014 - Rootkit', 'Detects AIX-specific rootkit indicators including hidden processes, modified system binaries, suspicious kernel extensions, and integrity violations in the Trusted Computing Base.
+
+Next Steps:
+1. Run trustchk command to verify system binary integrity
+2. Compare running processes with ps output for hidden processes
+3. Check for modified shared libraries in /usr/lib
+4. Review recently loaded kernel extensions
+5. Initiate forensic investigation on the affected system
+6. Consider rebuilding the system from trusted media
+', '["https://www.ibm.com/docs/en/aix/7.2?topic=security-trusted-computing-base","https://attack.mitre.org/techniques/T1014/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "trustchk") && contains("log.message", "FAIL")) ||
+ (contains("log.message", "tcbck") && contains("log.message", "violation")) ||
+ (contains("log.message", "TCB") && contains("log.message", "integrity")) ||
+ (contains("log.message", "genkex") && contains("log.message", "unknown")) ||
+ (contains("log.message", "/dev/kmem") && !equals("origin.user", "root")) ||
+ (contains("log.message", "ld.so") && contains("log.message", "preload")) ||
+ (contains("log.message", "LIBPATH") && contains("log.message", "modified")) ||
+ contains("log.message", "LD_PRELOAD")
+)
+', '2026-02-09 16:47:09.917960', true, false, 'origin', null, '[]', '["adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (398, 'IBM AIX SSH Authorized Keys Manipulation Detection', 3, 3, 1, 'Persistence', 'T1098.004 - Account Manipulation: SSH Authorized Keys', 'Detects modifications to SSH authorized_keys files on IBM AIX systems. Attackers add their SSH public keys to maintain persistent access to compromised systems.
+
+Next Steps:
+1. Review the authorized_keys file changes
+2. Verify the added SSH keys belong to authorized users
+3. Check which user accounts had keys modified
+4. Remove unauthorized SSH keys immediately
+5. Implement SSH key management policies
+6. Monitor for SSH connections using the new keys
+', '["https://www.ibm.com/docs/en/aix/7.2?topic=security-configuring-openssh","https://attack.mitre.org/techniques/T1098/004/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "authorized_keys") && (
+ contains("log.message", "modified") ||
+ contains("log.message", "changed") ||
+ contains("log.message", "written") ||
+ contains("log.message", "appended")
+ )) ||
+ (contains("log.message", ".ssh/authorized_keys") && exists("origin.user")) ||
+ (contains("log.message", "ssh-rsa") && (
+ contains("log.message", ">>") ||
+ contains("log.message", "echo")
+ )) ||
+ (contains("log.message", "sshd_config") && contains("log.message", "AuthorizedKeysFile"))
+)
+', '2026-02-09 16:47:10.048060', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (399, 'IBM AIX Intrusion Detection Alert', 3, 3, 2, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects intrusion attempts and security violations identified by the IBM AIX intrusion detection system, including suspicious activities, privilege escalation attempts, and potential system compromises.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Review the intrusion detection logs for specific details about the attack vector and affected resources
+3. Check for any suspicious processes running with elevated privileges using ''ps aux'' and ''topas''
+4. Examine system integrity with ''trustchk'' command to verify critical system files
+5. Review recent user authentication logs and check for unauthorized account creation or privilege changes
+6. Collect forensic evidence including memory dumps, system logs, and file modifications
+7. Apply security patches and update AIX security configurations based on the vulnerability exploited
+8. Monitor related systems for similar intrusion attempts
+9. Check for any unauthorized file modifications using ''find'' command with modification time filters
+10. Review network connections and active ports using ''netstat'' and ''lsof'' commands
+11. Validate system configuration against security baselines and hardening guides
+12. Document the incident details and update security monitoring rules based on attack patterns
+', '["https://www.ibm.com/docs/en/powersc-standard/2.1.0?topic=ids-configuring-intrusion-detection-prevention-idp-aix-endpoints","https://attack.mitre.org/techniques/T1068/"]', '(
+ equals("log.eventType", "ids") ||
+ equals("log.eventType", "securityd") ||
+ equals("log.eventType", "audit") ||
+ contains("log.msg", "intrusion") ||
+ contains("log.msg", "suspicious") ||
+ contains("log.msg", "anomaly detected")
+) &&
+(
+ contains("log.msg", "buffer overflow") ||
+ contains("log.msg", "privilege escalation") ||
+ contains("log.msg", "unauthorized modification") ||
+ contains("log.msg", "rootkit") ||
+ contains("log.msg", "backdoor") ||
+ contains("log.msg", "suspicious process") ||
+ contains("log.msg", "file integrity") ||
+ contains("action", "ALERT") ||
+ equals("log.returnCode", "1")
+)
+', '2026-02-09 16:47:10.192353', true, false, 'origin', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (400, 'IBM AIX Security Audit Subsystem Alert', 3, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects critical security events from the IBM AIX audit subsystem, including audit configuration changes, audit service disruptions, or attempts to tamper with audit logs. This rule identifies when the audit subsystem fails, is disabled, or when audit-related files are modified.
+
+Next Steps:
+1. Verify the legitimacy of the audit subsystem changes with the system administrator
+2. Check if this is part of scheduled maintenance or authorized configuration changes
+3. Review the specific audit event type and return code for failure details
+4. Examine the user account that performed the action and verify it has appropriate permissions
+5. Investigate any recent changes to audit policies or configurations
+6. Check for additional security events around the same time period
+7. Verify audit log integrity and ensure no logs have been tampered with
+8. Review system logs for any other indicators of compromise
+', '["https://www.ibm.com/support/pages/aix-audit-audit-subsystem-aix","https://attack.mitre.org/techniques/T1562/"]', '(startsWith("log.eventType", "audit") && !equals("log.returnCode", "0")) || (contains("log.message", "audit") && (contains("log.message", "stop") || contains("log.message", "disable") || contains("log.message", "fail"))) || (equals("action", "FILE_MODIFY") && startsWith("log.objName", "/etc/security/audit/")) || (equals("log.commandType", "audit"))', '2026-02-09 16:47:10.337560', true, false, 'origin', null, '[]', '["lastEvent.log.eventType","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (401, 'IBM AIX System Integrity Violation Detected', 2, 3, 2, 'Defense Evasion', 'T1070 - Indicator Removal on Host', 'Detects attempts to compromise system integrity in IBM AIX, including unauthorized modifications to critical system files, audit tampering, security configuration changes, and privilege escalation attempts. This rule monitors for various indicators of system compromise including audit event tampering, security configuration file modifications, suspicious sudo usage, and privilege escalation attempts.
+
+Next Steps:
+1. Immediately investigate the affected system and user account
+2. Review audit logs for related suspicious activities
+3. Check for unauthorized changes to system configuration files
+4. Verify the legitimacy of any privilege escalation attempts
+5. Monitor for additional indicators of compromise
+6. Consider isolating the affected system if malicious activity is confirmed
+7. Review backup and recovery procedures for critical system files
+8. Examine command history and process execution logs
+9. Validate user permissions and access controls
+10. Check for presence of unauthorized tools or backdoors
+', '["https://www.ibm.com/docs/en/ssw_aix_72/security/security_pdf.pdf","https://attack.mitre.org/techniques/T1070/"]', '(contains("log.eventType", "AUD_") && equals("action", "FILE_Write")) || (contains("log.objName", "/etc/security/") && equals("action", "FILE_Write")) || (equals("log.commandType", "sudo") && contains("origin.command", "passwd")) || (contains("log.msg", "audit") && contains("log.msg", "disable")) || (equals("log.osUserID", "root") && !equals("origin.user", "root"))', '2026-02-09 16:47:10.681940', true, false, 'origin', null, '[]', '["lastEvent.log.objName","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (402, 'IBM AIX Trusted Computing Base Violation', 3, 3, 2, 'Defense Evasion', 'T1070 - Indicator Removal', 'Detects violations of the Trusted Computing Base (TCB) in IBM AIX, including unauthorized modifications to critical system files, security database tampering, or attempts to modify files protected by TCB. TCB violations indicate potential system compromise or unauthorized privilege escalation attempts.
+
+Next Steps:
+1. Immediately investigate the user account and source host involved in the TCB violation
+2. Review the specific object/file that was modified and assess the impact
+3. Check system logs for any related authentication failures or privilege escalation attempts
+4. Verify the integrity of critical system files using tcbck command
+5. Review recent system changes and patches that might have triggered legitimate TCB events
+6. If malicious activity is confirmed, isolate the affected system and initiate incident response procedures
+7. Consider running a full system integrity check and malware scan
+', '["https://www.ibm.com/docs/en/aix/7.2?topic=configuration-trusted-computing-base","https://attack.mitre.org/techniques/T1070/"]', '(equals("log.eventType", "tcbck") && contains("log.message", "FAIL")) || (contains("log.message", "TCB") && (contains("log.message", "violation") || contains("log.message", "modified"))) || (equals("log.eventType", "FILE_Mode") && exists("log.objName") && startsWith("log.objName", "/etc/security/")) || (equals("action", "FILE_MODIFY") && exists("log.objName") && (startsWith("log.objName", "/usr/bin/") || startsWith("log.objName", "/usr/sbin/") || startsWith("log.objName", "/etc/security/")))', '2026-02-09 16:47:10.802736', true, false, 'origin', null, '[]', '["lastEvent.log.objName","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (403, 'IBM AIX Trusted Execution Violation', 3, 3, 2, 'Defense Evasion', 'T1036 - Masquerading', 'Detects violations of Trusted Execution (TE) policies in IBM AIX, including execution of untrusted binaries, signature verification failures, or attempts to bypass trusted execution controls. These violations may indicate attempts to execute malicious or unauthorized code on the system.
+
+Next Steps:
+1. Immediately verify the integrity of the executed binary and its digital signature
+2. Check if the binary is from a trusted source or has been tampered with
+3. Review system logs for any concurrent privilege escalation attempts or suspicious activities
+4. Examine the user''s recent activities, access patterns, and authentication history
+5. Validate the system''s trusted execution configuration and policies are properly enforced
+6. Check for any recent changes to the trusted execution database or policies
+7. Analyze the source and nature of the untrusted binary or process
+8. Consider isolating the affected system if malicious activity is confirmed
+9. Review file system integrity and check for signs of compromise
+10. Escalate to security team if this appears to be part of a broader attack
+', '["https://www.ibm.com/support/pages/trusted-execution-enablement","https://attack.mitre.org/techniques/T1036/"]', '(equals("log.eventType", "trustchk") && !equals("log.returnCode", "0")) || (contains("log.msg", "Trusted Execution") && (contains("log.msg", "fail") || contains("log.msg", "violat"))) || (equals("log.eventType", "PROC_Execute") && contains("log.msg", "untrusted")) || (equals("action", "EXEC") && contains("log.objName", "/tmp/") && equals("origin.user", "root"))', '2026-02-09 16:47:10.933106', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (404, 'IBM AS/400 Audit Journal Disabling Detection', 2, 3, 1, 'Defense Evasion', 'T1562.002 - Impair Defenses: Disable Windows Event Logging', 'Detects attempts to disable or modify IBM AS/400 security auditing via CHGAUD, QAUDCTL, or QAUDLVL system value changes. Attackers disable auditing to cover their tracks.
+
+Next Steps:
+1. Verify the audit configuration change was authorized
+2. Re-enable auditing immediately if unauthorized
+3. Check QAUDJRN journal for recent entries before the change
+4. Review system activity during the audit gap
+5. Restrict CHGAUD and system value change authority
+6. Implement monitoring for audit control system values
+', '["https://www.ibm.com/docs/en/i/7.5?topic=auditing-changing-security","https://attack.mitre.org/techniques/T1562/002/"]', 'exists("log.message") &&
+(
+ contains("log.message", "CHGAUD") ||
+ (contains("log.message", "QAUDCTL") && contains("log.message", "*NONE")) ||
+ (contains("log.message", "QAUDLVL") && contains("log.message", "changed")) ||
+ (contains("log.message", "QAUDLVL2") && contains("log.message", "changed")) ||
+ (contains("log.message", "audit") && contains("log.message", "disabled")) ||
+ (contains("log.message", "QAUDJRN") && contains("log.message", "DLTJRN")) ||
+ contains("log.message", "CHGSYSVAL SYSVAL(QAUDCTL) VALUE(''*NONE'')")
+)
+', '2026-02-09 16:47:11.062849', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (405, 'IBM AS/400 Unauthorized IFS Access Detection', 3, 2, 1, 'Collection', 'T1005 - Data from Local System', 'Detects unauthorized access to the IBM AS/400 Integrated File System (IFS). Monitors for access to sensitive directories, configuration files, and bulk file operations that could indicate data theft.
+
+Next Steps:
+1. Review the IFS paths and files being accessed
+2. Verify the user has authorization for the accessed directories
+3. Check for bulk file downloads or copies
+4. Review NetServer and FTP access logs
+5. Restrict IFS directory permissions
+6. Implement IFS object auditing for sensitive directories
+', '["https://www.ibm.com/docs/en/i/7.5?topic=system-integrated-file","https://attack.mitre.org/techniques/T1005/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "IFS") && (
+ contains("log.message", "QSYS.LIB") ||
+ contains("log.message", "/QIBM/") ||
+ contains("log.message", "/home/") ||
+ contains("log.message", "/tmp/")
+ ) && (
+ contains("log.message", "access") ||
+ contains("log.message", "read") ||
+ contains("log.message", "copy") ||
+ contains("log.message", "download")
+ )) ||
+ (contains("log.message", "CPYFRMSTMF") || contains("log.message", "CPYTOSTMF")) ||
+ (contains("log.message", "NetServer") && contains("log.message", "file access")) ||
+ (contains("log.message", "FTP") && contains("log.message", "GET") && contains("log.message", "/QSYS"))
+)
+', '2026-02-09 16:47:11.207711', true, false, 'origin', null, '[{"indexPattern":"v11-log-ibm-as400-*","with":[{"field":"log.message","operator":"filter_match","value":"IFS OR CPYFRMSTMF OR CPYTOSTMF OR NetServer"}],"or":null,"within":"now-15m","count":10}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (406, 'IBM AS/400 Exit Point Tampering Detection', 3, 3, 2, 'Persistence', 'T1562 - Impair Defenses', 'Detects tampering with IBM AS/400 exit points using ADDEXITPGM to register malicious programs. Exit points intercept system operations and can be used for credential capture, data interception, or persistent backdoor access.
+
+Next Steps:
+1. Review the exit point program being registered
+2. Verify the exit point registration was authorized
+3. Check the program source code for malicious functionality
+4. List all registered exit points with WRKREGINF
+5. Remove unauthorized exit point programs
+6. Restrict ADDEXITPGM authority to security administrators
+', '["https://www.ibm.com/docs/en/i/7.5?topic=programs-exit","https://attack.mitre.org/techniques/T1562/"]', 'exists("log.message") &&
+(
+ contains("log.message", "ADDEXITPGM") ||
+ contains("log.message", "RMVEXITPGM") ||
+ contains("log.message", "CHGEXITPGM") ||
+ (contains("log.message", "exit point") && (
+ contains("log.message", "registered") ||
+ contains("log.message", "added") ||
+ contains("log.message", "changed")
+ )) ||
+ (contains("log.message", "WRKREGINF") && contains("log.message", "exit"))
+)
+', '2026-02-09 16:47:11.347239', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (407, 'IBM AS/400 Job Queue Manipulation Detection', 2, 3, 2, 'Execution', 'T1053 - Scheduled Task/Job', 'Detects suspicious job submissions and job queue manipulations on IBM AS/400 that could indicate unauthorized task execution with elevated authority or persistence mechanisms.
+
+Next Steps:
+1. Review the submitted job details and user profile
+2. Verify the job submission was authorized
+3. Check if the job runs with elevated authority (USER parameter)
+4. Review the job''s program and command list
+5. Restrict SBMJOB authority for non-administrative users
+6. Monitor job queue activity for unusual patterns
+', '["https://www.ibm.com/docs/en/i/7.5?topic=concepts-job-queues","https://attack.mitre.org/techniques/T1053/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "SBMJOB") && (
+ contains("log.message", "USER(QSECOFR)") ||
+ contains("log.message", "USER(QSYSOPR)") ||
+ contains("log.message", "*ALLOBJ")
+ )) ||
+ (contains("log.message", "CHGJOBQE") && exists("origin.user")) ||
+ (contains("log.message", "HLDJOBQ") || contains("log.message", "RLSJOBQ")) ||
+ (contains("log.message", "ADDJOBSCDE") && exists("origin.user")) ||
+ (contains("log.message", "job") && contains("log.message", "submitted") && (
+ contains("log.message", "QBATCH") ||
+ contains("log.message", "QSYSNOMAX")
+ ))
+)
+', '2026-02-09 16:47:11.482092', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (408, 'IBM AS/400 Program Adopt Authority Abuse Detection', 3, 3, 2, 'Privilege Escalation', 'T1548 - Abuse Elevation Control Mechanism', 'Detects programs using adopted authority with *ALLOBJ special authority on IBM AS/400. Attackers create programs that adopt elevated privileges to bypass authorization controls and access sensitive objects.
+
+Next Steps:
+1. Review the program using adopted authority
+2. Verify the program owner and adoption profile
+3. Check if *ALLOBJ authority is necessary for the program
+4. Remove unnecessary adopted authority
+5. Implement adopted authority auditing
+6. Review all programs adopting elevated authority
+', '["https://www.ibm.com/docs/en/i/7.5?topic=programs-adopted-authority","https://attack.mitre.org/techniques/T1548/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "ADOPTED") && contains("log.message", "*ALLOBJ")) ||
+ (contains("log.message", "ADOPT") && contains("log.message", "authority")) ||
+ (contains("log.message", "CRTPGM") && contains("log.message", "USRPRF(*OWNER)")) ||
+ (contains("log.message", "CHGPGM") && contains("log.message", "USRPRF(*OWNER)")) ||
+ (contains("log.message", "program adopt") && contains("log.message", "special authority")) ||
+ (contains("log.message", "adopted") && contains("log.message", "QSECOFR"))
+)
+', '2026-02-09 16:47:11.622623', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (409, 'IBM AS/400 Library List Manipulation Detection', 3, 3, 2, 'Privilege Escalation', 'T1574 - Hijack Execution Flow', 'Detects manipulation of IBM AS/400 library lists using CHGLIBL, ADDLIBLE, or CHGSYSLIBL commands. Attackers modify library lists to inject malicious programs that execute instead of legitimate system commands (library list hijacking).
+
+Next Steps:
+1. Review the library list changes and added libraries
+2. Verify the changes were authorized
+3. Check the contents of added libraries for malicious programs
+4. Compare program names in added libraries against system libraries
+5. Remove unauthorized library list entries
+6. Restrict CHGLIBL and ADDLIBLE authority
+', '["https://www.ibm.com/docs/en/i/7.5?topic=concepts-library-lists","https://attack.mitre.org/techniques/T1574/"]', 'exists("log.message") &&
+(
+ contains("log.message", "CHGLIBL") ||
+ contains("log.message", "ADDLIBLE") ||
+ contains("log.message", "CHGSYSLIBL") ||
+ contains("log.message", "RMVLIBLE") ||
+ (contains("log.message", "library list") && (
+ contains("log.message", "changed") ||
+ contains("log.message", "modified") ||
+ contains("log.message", "added")
+ )) ||
+ (contains("log.message", "EDTLIBL") && exists("origin.user"))
+)
+', '2026-02-09 16:47:11.768030', true, false, 'origin', null, '[{"indexPattern":"v11-log-ibm-as400-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (410, 'IBM AS/400 Remote Command Execution Detection', 3, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Detects remote command execution on IBM AS/400 via RCMD, RMTCMD, DDM, or DRDA protocols. These commands allow attackers to execute operations from remote systems.
+
+Next Steps:
+1. Identify the remote system and user executing commands
+2. Verify the remote command execution was authorized
+3. Review the commands being executed remotely
+4. Check DDM and DRDA connection configurations
+5. Restrict remote command execution authority
+6. Implement IP allowlisting for remote connections
+', '["https://www.ibm.com/docs/en/i/7.5?topic=ssw_ibm_i_75/cl/runrmtcmd.htm","https://attack.mitre.org/techniques/T1021/"]', 'exists("log.message") &&
+(
+ contains("log.message", "RUNRMTCMD") ||
+ contains("log.message", "RCMD") ||
+ contains("log.message", "RMTCMD") ||
+ (contains("log.message", "DDM") && contains("log.message", "command")) ||
+ (contains("log.message", "DRDA") && contains("log.message", "remote")) ||
+ (contains("log.message", "REXEC") && exists("origin.ip")) ||
+ (contains("log.message", "SBMRMTCMD") && exists("origin.user"))
+)
+', '2026-02-09 16:47:11.918185', true, false, 'origin', null, '[{"indexPattern":"v11-log-ibm-as400-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-30m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (411, 'IBM AS/400 SQL Injection via ODBC/JDBC Detection', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects SQL injection attempts targeting IBM AS/400 through ODBC/JDBC connections. Monitors for suspicious SQL patterns in database server job logs and diagnostic messages.
+
+Next Steps:
+1. Review the SQL statements for injection patterns
+2. Identify the source application and ODBC/JDBC connection
+3. Check for successful unauthorized data access
+4. Patch the vulnerable application with parameterized queries
+5. Restrict ODBC/JDBC connection permissions
+6. Block the source IP if confirmed malicious
+', '["https://www.ibm.com/docs/en/i/7.5?topic=services-sql-diagnostic","https://attack.mitre.org/techniques/T1190/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "SQL") && (
+ regexMatch("log.message", "(?i)UNION\\s+(ALL\\s+)?SELECT") ||
+ contains("log.message", "'' OR ''1''=''1") ||
+ contains("log.message", "''; DROP") ||
+ contains("log.message", "QSYS2.") ||
+ contains("log.message", "SYSCOLUMNS") ||
+ contains("log.message", "SYSTABLES") ||
+ regexMatch("log.message", "(?i)CHAR\\s*\\([0-9]+\\)") ||
+ contains("log.message", "information_schema")
+ )) ||
+ (contains("log.message", "ODBC") && contains("log.message", "SQL error")) ||
+ (contains("log.message", "JDBC") && contains("log.message", "syntax error"))
+)
+', '2026-02-09 16:47:12.048070', true, false, 'origin', null, '[{"indexPattern":"v11-log-ibm-as400-*","with":[{"field":"log.message","operator":"filter_match","value":"SQL error OR syntax error OR UNION SELECT OR DROP"}],"or":null,"within":"now-15m","count":5}]', '["adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (707, 'Windows: New ActiveSyncAllowedDeviceID Added via PowerShell', 3, 2, 1, 'Persistence', 'T1098.002 - Account Manipulation: Additional Email Delegate Permissions', 'Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1098/002/"]', 'oneOf("log.eventDataProcessName", ["powershell.exe", "pwsh.exe", "powershell_ise.exe"]) && regexMatch("log.message", "(Set-CASMailbox(.+)ActiveSyncAllowedDeviceIDs)")', '2026-02-09 16:57:30.922913', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (413, 'Unsafe Deserialization Attack Detected', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects attempts to exploit unsafe deserialization vulnerabilities through malicious JSON payloads containing serialized objects or code execution patterns. These attacks can lead to remote code execution, privilege escalation, or data compromise.
+
+Next Steps:
+1. Analyze the JSON payload structure and identify malicious patterns
+2. Check application logs for evidence of successful exploitation
+3. Review the target application''s deserialization implementation
+4. Implement input validation and use safe deserialization practices
+5. Monitor for any unusual process execution or system changes
+6. Consider blocking the source IP if attack patterns persist
+7. Examine target application for signs of compromise
+8. Review recent deployments or configuration changes
+9. Check for additional indicators of compromise on affected systems
+10. Document the attack pattern for threat intelligence purposes
+', '["https://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_java.html","https://attack.mitre.org/techniques/T1190/"]', '(contains("raw", "java.lang.Runtime") ||
+ contains("raw", "java.lang.ProcessBuilder") ||
+ contains("raw", "$$beanFactory") ||
+ (contains("raw", "org.apache.commons.collections") && contains("raw", "Transformer")) ||
+ (contains("raw", "java.io.ObjectInputStream") && contains("raw", "exec")) ||
+ contains("raw", "com.sun.rowset.JdbcRowSetImpl") ||
+ contains("raw", "ysoserial") ||
+ contains("raw", "java.net.URLClassLoader"))
+', '2026-02-09 16:47:12.327720', true, false, 'origin', null, '[{"indexPattern":"v11-log-json-input-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-10m","count":3}]', '["adversary.ip","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (414, 'JSON Hijacking Attempt Detected', 3, 2, 1, 'Execution', 'JSON Hijacking', 'Detects attempts to hijack JSON data through malicious script tags, Array constructor overrides, or cross-domain data theft patterns. JSON hijacking attacks attempt to steal sensitive data by exploiting vulnerabilities in JSON responses through script tag inclusion or prototype manipulation.
+
+Next Steps:
+1. Review the request details and identify the source of the hijacking attempt
+2. Check if the origin IP is from a known malicious source
+3. Examine the full request payload for additional malicious indicators
+4. Verify if any sensitive data was exposed in the JSON response
+5. Implement proper CSRF tokens and validate referer headers
+6. Consider blocking the source IP if malicious activity is confirmed
+7. Review application code for proper JSON response security measures
+', '["https://owasp.org/www-community/attacks/JSON_Hijacking","https://attack.mitre.org/techniques/T1059/007/"]', '(contains("raw", "") ||
+ contains("log.callback", "javascript:") ||
+ contains("log.callback", "alert(") ||
+ contains("log.callback", "eval(") ||
+ contains("log.callback", "Function(") ||
+ contains("log.callback", ".constructor("))) ||
+(exists("log.url_query") &&
+ contains("log.url_query", "callback=") &&
+ contains("log.url_query", " Users & Groups > Login Items
+5. Check ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/
+6. Remove unauthorized Login Items and investigate the source
+', '["https://attack.mitre.org/techniques/T1547/015/","https://developer.apple.com/documentation/servicemanagement"]', '(contains("log.eventMessage", "Login Item") || contains("log.eventMessage", "loginitem") ||
+ contains("log.eventMessage", "BackgroundItems") || contains("log.eventMessage", "loginwindow")) &&
+(contains("log.eventMessage", "added") || contains("log.eventMessage", "registered") ||
+ contains("log.eventMessage", "enabled") || contains("log.eventMessage", "modified") ||
+ contains("log.eventMessage", "SMLoginItemSetEnabled"))
+', '2026-02-09 16:52:21.572929', true, false, 'origin', null, '[]', '["lastEvent.log.eventMessage","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (462, 'macOS Ransomware Indicators', 3, 3, 3, 'Impact', 'T1486 - Data Encrypted for Impact', 'Detects mass file encryption patterns on macOS that may indicate ransomware activity, including rapid file modifications with suspicious extensions and encryption tool usage.
+
+Next Steps:
+1. Immediately isolate the affected system from the network
+2. Identify the process performing mass file operations
+3. Check for ransom notes or changed file extensions
+4. Verify backup availability and integrity
+5. Preserve evidence for forensic analysis
+6. Do not pay ransom - engage incident response team
+', '["https://attack.mitre.org/techniques/T1486/"]', '(contains("log.eventMessage", ["encrypted", "encrypt", ".locked", ".crypto", ".crypt"]) ||
+ regexMatch("log.eventMessage", "(?i)\\.(locky|cerber|wannacry|ryuk|maze|conti|lockbit)$")) &&
+(contains("log.eventMessage", "rename") || contains("log.eventMessage", "modified") ||
+ contains("log.eventMessage", "write"))
+', '2026-02-09 16:52:21.737121', true, false, 'origin', null, '[{"indexPattern":"v11-log-macos-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-10m","count":50}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (463, 'Notarization Bypass Attempt Detected', 2, 3, 1, 'Defense Evasion', 'T1553.001 - Subvert Trust Controls: Gatekeeper Bypass', 'Detects attempts to bypass macOS notarization checks through various methods including quarantine attribute manipulation, AppleDouble file format abuse, or ZIP archive exploitation. This rule identifies suspicious activities that attempt to circumvent Apple''s security mechanisms designed to protect users from malicious software.
+
+Next Steps:
+1. Investigate the specific process and command that triggered this alert
+2. Check if the user account has legitimate administrative privileges
+3. Examine recent file downloads and modifications by the user
+4. Review system logs for other suspicious activities by the same user
+5. Verify if any unsigned applications were recently executed
+6. Check for presence of malware or unwanted software on the system
+7. Consider quarantining the affected system if malicious activity is confirmed
+8. Review security policies regarding software installation and execution
+', '["https://redcanary.com/threat-detection-report/techniques/gatekeeper-bypass/","https://attack.mitre.org/techniques/T1553/001/"]', '(equals("log.process", "spctl") && contains("log.eventMessage", "assessment")) ||
+(equals("log.subsystem", "com.apple.xprotect") && contains("log.eventMessage", "failed on rPathCmd")) ||
+(contains("log.eventMessage", "com.apple.quarantine") && contains("log.eventMessage", "remove")) ||
+(equals("log.process", "xattr") && contains("log.eventMessage", "-d com.apple.quarantine")) ||
+(contains("log.eventMessage", "LSFileQuarantineEnabled") && contains("log.eventMessage", "false")) ||
+(contains("log.eventMessage", "ACL") && contains("log.eventMessage", "quarantine"))
+', '2026-02-09 16:52:21.887836', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (464, 'Suspicious Office Application Child Process on macOS', 3, 3, 2, 'Execution', 'T1204.002 - User Execution: Malicious File', 'Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning suspicious child processes such as bash, curl, wget, python, or osascript on macOS. This strongly indicates macro-based malware or document exploitation, as Office applications should not normally spawn shell interpreters or download utilities.
+
+Next Steps:
+1. Identify the malicious document that triggered the child process
+2. Capture the full command line of the spawned process
+3. Quarantine the source document and submit it for analysis
+4. Check for any downloaded payloads or persistence mechanisms
+5. Review email logs to identify how the document was delivered
+6. Alert other users who may have received the same document
+', '["https://attack.mitre.org/techniques/T1204/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml"]', 'contains("log.eventMessage", ["Microsoft Word", "Microsoft Excel", "Microsoft PowerPoint", "com.microsoft.Word", "com.microsoft.Excel", "com.microsoft.PowerPoint"]) &&
+contains("log.eventMessage", ["bash", "sh ", "curl ", "wget ", "python", "osascript", "perl "]) &&
+(
+ contains("log.eventMessage", "spawn") ||
+ contains("log.eventMessage", "exec") ||
+ contains("log.eventMessage", "fork") ||
+ contains("log.eventMessage", "child process")
+)
+', '2026-02-09 16:52:22.047332', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (465, 'Osascript Encoded or Suspicious Execution', 3, 3, 2, 'Execution', 'T1059.002 - Command and Scripting Interpreter: AppleScript', 'Detects suspicious osascript executions from the command line including encoded scripts, scripts executing shell commands, or scripts performing system modifications. Attackers abuse AppleScript for execution and evasion.
+
+Next Steps:
+1. Decode and review the AppleScript content
+2. Identify the parent process that spawned osascript
+3. Check for system modifications made by the script
+4. Review network connections initiated by the script
+5. Investigate the delivery mechanism of the malicious script
+', '["https://attack.mitre.org/techniques/T1059/002/"]', '(equals("log.process", "osascript") || contains("log.eventMessage", "osascript")) &&
+(contains("log.eventMessage", "-e") &&
+ (contains("log.eventMessage", "do shell script") || contains("log.eventMessage", "curl") ||
+ contains("log.eventMessage", "wget") || contains("log.eventMessage", "base64") ||
+ contains("log.eventMessage", "chmod") || contains("log.eventMessage", "/bin/bash") ||
+ contains("log.eventMessage", "python") || contains("log.eventMessage", "openssl")) ||
+ contains("log.eventMessage", "osacompile") ||
+ (contains("log.eventMessage", "osascript") && contains("log.eventMessage", "<<<")) ||
+ regexMatch("log.eventMessage", "(?i)osascript.*-l\\s+JavaScript"))
+', '2026-02-09 16:52:22.207956', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (466, 'PlistBuddy Persistence via RunAtLoad', 2, 3, 2, 'Persistence', 'T1543.001 - Create or Modify System Process: Launch Agent', 'Detects the use of PlistBuddy to set RunAtLoad to true in LaunchAgent or LaunchDaemon plist files. This is a persistence technique where attackers modify property list files to ensure their malicious payload runs automatically at system boot or user login.
+
+Next Steps:
+1. Identify the plist file being modified and examine its full contents
+2. Determine what executable or script the plist is configured to run
+3. Check if the referenced executable is legitimate or malicious
+4. Review the process that invoked PlistBuddy and its parent chain
+5. Remove the malicious plist file and associated executables
+6. Check for other LaunchAgent/LaunchDaemon persistence on the system
+', '["https://attack.mitre.org/techniques/T1543/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml"]', 'contains("log.eventMessage", "PlistBuddy") &&
+contains("log.eventMessage", "RunAtLoad") &&
+contains("log.eventMessage", ["LaunchAgents", "LaunchDaemons"])
+', '2026-02-09 16:52:22.367111', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (467, 'Privacy Preferences (TCC) Database Tampering', 3, 3, 1, 'Privilege Escalation, Defense Evasion', 'T1548 - Abuse Elevation Control Mechanism', 'Detects unauthorized modifications to the macOS TCC (Transparency, Consent, and Control) database which controls application privacy permissions. The TCC database manages access permissions for sensitive resources like camera, microphone, location services, and file system access. Unauthorized modifications to this database can allow malicious applications to bypass privacy controls and gain access to sensitive user data.
+
+Next Steps:
+1. Investigate the process that modified the TCC database and verify if it''s authorized
+2. Check what specific permissions were modified in the TCC database
+3. Review recent application installations and permission requests
+4. Examine system logs for other suspicious activities around the same timeframe
+5. Verify the integrity of system privacy settings and restore from backup if necessary
+6. Consider implementing additional monitoring for TCC database access
+', '["https://www.huntress.com/blog/full-transparency-controlling-apples-tcc","https://attack.mitre.org/techniques/T1548/"]', '(contains("log.eventMessage", "Update Access Record:") && equals("log.subsystem", "com.apple.TCC")) ||
+(equals("log.process", "sqlite3") && contains("log.eventMessage", "TCC.db")) ||
+(equals("log.process", "tccutil") && contains("log.eventMessage", "reset")) ||
+(contains("log.eventMessage", "TCC") && contains("log.eventMessage", "INSERT")) ||
+(contains("log.eventMessage", "TCC") && contains("log.eventMessage", "UPDATE")) ||
+(contains("log.eventMessage", "TCC") && contains("log.eventMessage", "DELETE")) ||
+(equals("log.subsystem", "com.apple.TCC") && equals("log.category", "access") && contains("log.eventMessage", "modification"))
+', '2026-02-09 16:52:22.610159', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (468, 'macOS Root Account Enabled', 3, 3, 2, 'Privilege Escalation', 'T1078 - Valid Accounts', 'Detects the execution of dsenableroot to enable the root account on macOS. The root account is disabled by default on macOS for security. Enabling it grants the highest level of system privileges and is commonly done by attackers for privilege escalation and persistent elevated access.
+
+Next Steps:
+1. Verify if the root account activation was authorized by IT administration
+2. Identify the user and process that ran dsenableroot
+3. Disable the root account immediately if unauthorized (dsenableroot -d)
+4. Check for unauthorized logins using the root account
+5. Review the system for other privilege escalation or persistence mechanisms
+6. Audit sudo and su usage on the affected system
+', '["https://attack.mitre.org/techniques/T1078/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml","https://support.apple.com/en-us/102367"]', 'contains("log.eventMessage", "dsenableroot") &&
+!contains("log.eventMessage", "-d")
+', '2026-02-09 16:52:22.742585', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (787, 'Windows Web Shell Detection: Script Process Child of Common Web Processes', 1, 3, 2, 'Persistence', 'T1505.003 - Server Software Component: Web Shell', 'Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1505/003/"]', 'regexMatch("log.eventDataProcessName", "(cmd.exe|cscript.exe|powershell.exe|pwsh.exe|powershell_ise.exe|wmic.exe|wscript.exe)") && regexMatch("log.eventDataParentProcessName", "(w3wp.exe|httpd.exe|nginx.exe|php.exe|php-cgi.exe|tomcat.exe)")', '2026-02-09 16:57:43.557334', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (469, 'macOS Security Tools Disabled', 3, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects attempts to disable or unload macOS security tools using launchctl or spctl. Attackers commonly disable endpoint security products such as LuLu, BlockBlock, Santa, CarbonBlack, CrowdStrike, and osquery, or disable Gatekeeper via spctl to execute malicious payloads without detection.
+
+Next Steps:
+1. Identify which security tool was disabled and restore it immediately
+2. Determine what process or user initiated the disabling command
+3. Check for malware or suspicious executables that may have been run after the tool was disabled
+4. Review the timeline for other defense evasion or execution events
+5. Re-enable all disabled security tools and verify their status
+6. Investigate why the user had privileges to disable security tools
+', '["https://attack.mitre.org/techniques/T1562/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml"]', '(
+ contains("log.eventMessage", "launchctl") &&
+ contains("log.eventMessage", "unload") &&
+ (
+ contains("log.eventMessage", "LuLu") ||
+ contains("log.eventMessage", "BlockBlock") ||
+ contains("log.eventMessage", "Santa") ||
+ contains("log.eventMessage", "CarbonBlack") ||
+ contains("log.eventMessage", "com.carbonblack") ||
+ contains("log.eventMessage", "CrowdStrike") ||
+ contains("log.eventMessage", "com.crowdstrike") ||
+ contains("log.eventMessage", "osquery") ||
+ contains("log.eventMessage", "com.facebook.osqueryd") ||
+ contains("log.eventMessage", "com.objective-see")
+ )
+) ||
+(
+ contains("log.eventMessage", "spctl") &&
+ contains("log.eventMessage", "--master-disable")
+)
+', '2026-02-09 16:52:22.877852', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (470, 'Shell Profile Modification for Persistence', 2, 3, 1, 'Persistence', 'T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification', 'Detects modifications to shell profile files (.bash_profile, .zshrc, .zprofile) on macOS which attackers use to execute malicious commands every time a shell session starts.
+
+Next Steps:
+1. Review the modified shell profile file for injected commands
+2. Compare against a known-good baseline
+3. Check for reverse shells, downloaders, or environment variable manipulation
+4. Identify the user and process that made the change
+5. Restore the profile from backup if tampered
+', '["https://attack.mitre.org/techniques/T1546/004/"]', '(contains("log.eventMessage", ".bash_profile") || contains("log.eventMessage", ".zshrc") ||
+ contains("log.eventMessage", ".zprofile") || contains("log.eventMessage", ".bashrc") ||
+ contains("log.eventMessage", ".zshenv") || contains("log.eventMessage", "/etc/zshrc") ||
+ contains("log.eventMessage", "/etc/profile")) &&
+(contains("log.eventMessage", "modified") || contains("log.eventMessage", "written") ||
+ contains("log.eventMessage", "created") || contains("log.eventMessage", "changed"))
+', '2026-02-09 16:52:22.997637', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (471, 'SSH Private Key Theft Attempt', 3, 2, 0, 'Credential Access', 'T1552.004 - Unsecured Credentials: Private Keys', 'Detects attempts to access or copy SSH private keys from user home directories on macOS, which attackers use for lateral movement and unauthorized access to remote systems.
+
+Next Steps:
+1. Identify the process and user accessing the SSH private key
+2. Check if the key was copied or transmitted to an external location
+3. Rotate the compromised SSH key pair immediately
+4. Review authorized_keys on remote systems for the compromised key
+5. Check for lateral movement using the stolen key
+6. Investigate the initial compromise vector
+', '["https://attack.mitre.org/techniques/T1552/004/"]', '(contains("log.eventMessage", ".ssh/id_rsa") || contains("log.eventMessage", ".ssh/id_ed25519") ||
+ contains("log.eventMessage", ".ssh/id_ecdsa") || contains("log.eventMessage", ".ssh/id_dsa") ||
+ contains("log.eventMessage", ".ssh/identity")) &&
+(contains("log.eventMessage", "read") || contains("log.eventMessage", "copy") ||
+ contains("log.eventMessage", "open") || contains("log.eventMessage", "cat") ||
+ contains("log.eventMessage", "scp") || contains("log.eventMessage", "base64"))
+', '2026-02-09 16:52:23.137988', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (472, 'Sudo Credential Caching Abuse', 3, 3, 1, 'Privilege Escalation', 'T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching', 'Detects abuse of sudo credential caching on macOS including timestamp manipulation, sudoers file modifications to extend timeout, and tty_tickets bypass attempts.
+
+Next Steps:
+1. Check the sudoers configuration for unauthorized timestamp_timeout changes
+2. Review /var/db/sudo/ for timestamp manipulation
+3. Verify if sudo was used to execute suspicious commands
+4. Check for sudoers file modifications via visudo or direct editing
+5. Review the user account for unauthorized privilege escalation
+', '["https://attack.mitre.org/techniques/T1548/003/"]', '(contains("log.eventMessage", "sudoers") &&
+ (contains("log.eventMessage", "modified") || contains("log.eventMessage", "syntax error") ||
+ contains("log.eventMessage", "timestamp_timeout"))) ||
+(contains("log.eventMessage", "sudo") && contains("log.eventMessage", "timestamp") &&
+ (contains("log.eventMessage", "too far in the future") || contains("log.eventMessage", "reset"))) ||
+(contains("log.eventMessage", "/var/db/sudo") &&
+ (contains("log.eventMessage", "modified") || contains("log.eventMessage", "touch")))
+', '2026-02-09 16:52:23.278181', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (473, 'System Integrity Protection (SIP) Bypass Attempt', 3, 3, 2, 'Defense Evasion', 'T1553.006 - Subvert Trust Controls: Code Signing Policy Modification', 'Detects attempts to bypass System Integrity Protection (SIP) through unauthorized modifications to protected locations or suspicious kernel extension loading with rootless entitlements. SIP is a critical security mechanism in macOS that protects system files and processes from modification, even by privileged users.
+
+Next Steps:
+1. Immediately isolate the affected macOS system to prevent further compromise
+2. Check SIP status using ''csrutil status'' command to verify if it has been disabled
+3. Review system logs for related process execution and file modifications
+4. Examine running kernel extensions using ''kextstat'' command
+5. Investigate the user account and process that attempted the SIP bypass
+6. Check for persistence mechanisms and unauthorized modifications to system files
+7. Review recent software installations and updates that might have triggered this alert
+8. Consider reimaging the system if SIP has been successfully bypassed
+', '["https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024-44243-a-macos-system-integrity-protection-bypass-through-kernel-extensions/","https://attack.mitre.org/techniques/T1553/006/"]', '(
+ equals("log.process", "storagekitd") &&
+ contains("log.eventMessage", "com.apple.rootless.install.heritable")
+) ||
+(
+ regexMatch("log.processImagePath", ".*/System/Library/.*") &&
+ regexMatch("log.eventMessage", ".*(csrutil|disable|rootless).*") &&
+ equals("log.eventType", "logEvent")
+) ||
+(
+ equals("log.subsystem", "com.apple.kernel") &&
+ regexMatch("log.eventMessage", ".*(SIP|rootless).*bypass.*")
+) ||
+(
+ regexMatch("log.process", ".*kext.*") &&
+ contains("log.eventMessage", "rootless")
+)
+', '2026-02-09 16:52:23.422736', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (474, 'macOS System Log Clearing Detected', 1, 3, 2, 'Defense Evasion', 'T1070.002 - Indicator Removal: Clear Linux or Mac System Logs', 'Detects attempts to clear or delete macOS system logs using rm, unlink, or shred commands targeting /var/log or ~/Library/Logs directories. Attackers clear logs to remove evidence of their activities and hinder forensic investigation.
+
+Next Steps:
+1. Identify which log files were deleted and attempt to recover them from backups
+2. Determine the user and process responsible for the log deletion
+3. Review remaining logs and system activity before the deletion event
+4. Check for other anti-forensic activity on the same system
+5. Investigate the system for signs of compromise that the attacker tried to hide
+6. Ensure centralized logging is in place to prevent future evidence destruction
+', '["https://attack.mitre.org/techniques/T1070/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml"]', '(
+ contains("log.eventMessage", ["rm ", "unlink ", "shred "]) &&
+ contains("log.eventMessage", ["/var/log", "/Library/Logs", "system.log", "install.log", "asl/"])
+) ||
+(
+ contains("log.eventMessage", "log erase") &&
+ equals("log.process", "log")
+)
+', '2026-02-09 16:52:23.617278', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (475, 'TCC Database Manipulation Detected', 3, 3, 2, 'Privilege Escalation, Defense Evasion', 'T1548 - Abuse Elevation Control Mechanism', 'Detects unauthorized attempts to manipulate the Transparency, Consent, and Control (TCC) database to bypass privacy protections and gain access to protected resources. This detection identifies various methods of TCC database manipulation including direct database modifications, unauthorized access attempts, and privilege escalation through TCC bypass techniques.
+
+Next Steps:
+1. Investigate the process attempting to modify the TCC database
+2. Check if the modification was authorized and expected
+3. Review system logs for any suspicious activity around the time of detection
+4. Verify the integrity of the TCC database
+5. Check for any unauthorized applications that may have gained elevated privileges
+6. Review recent software installations or system changes
+7. Consider reimaging the affected system if unauthorized TCC manipulation is confirmed
+', '["https://interpressecurity.com/resources/report/return-of-the-macos-transparency-consent-and-control-tcc-database-manipulation/","https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/","https://attack.mitre.org/techniques/T1548/"]', '(
+ equals("log.process", "tccd") &&
+ (
+ regexMatch("log.eventMessage", ".*unauthorized.*access.*") ||
+ contains("log.eventMessage", "bypass") ||
+ contains("log.eventMessage", "CVE-2020-9934")
+ )
+) ||
+(
+ regexMatch("log.processImagePath", ".*/Library/Application Support/com\\.apple\\.TCC/TCC\\.db.*") &&
+ regexMatch("log.eventMessage", ".*(write|modify|INSERT|UPDATE|DELETE).*") &&
+ !equals("log.process", "tccd")
+) ||
+(
+ contains("log.eventMessage", "TCC.db") &&
+ (
+ regexMatch("log.eventMessage", ".*(sqlite3|INSERT INTO|UPDATE|DELETE FROM).*") ||
+ regexMatch("log.eventMessage", ".*(kTCCServiceDeveloperTool|kTCCServiceScreenCapture|kTCCServiceAccessibility).*")
+ )
+) ||
+(
+ equals("log.subsystem", "com.apple.TCC") &&
+ (
+ contains("log.eventMessage", "Full Disk Access") ||
+ contains("log.eventMessage", "Screen Recording") ||
+ contains("log.eventMessage", "Accessibility")
+ ) &&
+ regexMatch("log.eventMessage", ".*(grant|bypass|override).*")
+) ||
+(
+ exists("log.process") &&
+ regexMatch("log.eventMessage", ".*com\\.apple\\.private\\.tcc\\.manager.*") &&
+ !equals("log.process", "tccd")
+)
+', '2026-02-09 16:52:23.744140', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (476, 'Time Machine Backup Deletion Detected', 1, 3, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Detects the use of tmutil to delete Time Machine backups on macOS. This is a common ransomware preparation technique where attackers delete backups to prevent recovery after encryption. Legitimate backup deletions are rare and should be closely monitored.
+
+Next Steps:
+1. Immediately verify if backup deletion was authorized
+2. Identify the user and process that executed tmutil delete
+3. Check for ransomware indicators on the system (file encryption, ransom notes)
+4. Verify the integrity of remaining backups
+5. Isolate the system from the network if ransomware is suspected
+6. Ensure offsite or cloud backups are intact and accessible
+', '["https://attack.mitre.org/techniques/T1490/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml"]', 'contains("log.eventMessage", "tmutil") &&
+contains("log.eventMessage", "delete")
+', '2026-02-09 16:52:23.893341', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (477, 'WizardUpdate Malware Indicators Detected', 3, 3, 3, 'Malware Detection', 'T1059.002 - Command and Scripting Interpreter: AppleScript', 'Detects indicators of the WizardUpdate (UpdateAgent) macOS trojan. This malware uses curl piped to bash/eval patterns and references characteristic paths like _intermediate_agent_ for staging and execution. WizardUpdate is a known macOS trojan that downloads and executes additional payloads.
+
+Next Steps:
+1. Isolate the affected system from the network immediately
+2. Search for the _intermediate_agent_ staging files
+3. Check for persistence mechanisms (LaunchAgents, LaunchDaemons)
+4. Review network connections for C2 communication
+5. Identify the initial infection vector (adware bundle, fake installer)
+6. Perform a full malware scan and consider reimaging the system
+', '["https://attack.mitre.org/techniques/T1059/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml","https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malware-wizardupdate-changes-infection-tactics/"]', '(
+ contains("log.eventMessage", "curl") &&
+ contains("log.eventMessage", ["eval", "bash", "sh "]) &&
+ contains("log.eventMessage", ["pipe", "|"])
+) ||
+contains("log.eventMessage", "_intermediate_agent_") ||
+contains("log.eventMessage", "UpdateAgent")
+', '2026-02-09 16:52:24.027496', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (478, 'XCSSET Malware Indicators Detected', 3, 3, 3, 'Malware Detection', 'T1059.002 - Command and Scripting Interpreter: AppleScript', 'Detects indicators of XCSSET malware on macOS. XCSSET is a sophisticated malware that targets Xcode projects, steals browser data, and installs backdoors. Key indicators include curl requests to /sys/log.php C2 endpoints, osacompile commands in Library/Group Containers paths, and characteristic repl staging patterns.
+
+Next Steps:
+1. Isolate the affected system from the network immediately
+2. Check all Xcode projects on the system for injected malicious build phases
+3. Review Library/Group Containers directories for unauthorized files
+4. Check browser data stores for signs of credential theft
+5. Examine LaunchAgents for XCSSET persistence mechanisms
+6. Perform a full malware scan and consider reimaging the system
+7. Notify other developers who may have cloned affected Xcode projects
+', '["https://attack.mitre.org/techniques/T1059/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml","https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html"]', '(
+ contains("log.eventMessage", "curl") &&
+ contains("log.eventMessage", "/sys/log.php")
+) ||
+(
+ contains("log.eventMessage", "osacompile") &&
+ contains("log.eventMessage", "Library/Group Containers")
+) ||
+(
+ contains("log.eventMessage", "repl") &&
+ contains("log.eventMessage", "Pods") &&
+ contains("log.eventMessage", "xcscheme")
+)
+', '2026-02-09 16:52:24.157689', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (788, 'Windows: Whoami Process Activity', 1, 1, 0, 'Discovery', 'T1033 - System Owner/User Discovery', 'Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.', '["https://attack.mitre.org/tactics/TA0007/","https://attack.mitre.org/techniques/T1033/"]', 'contains("log.eventDataProcessName", "whoami.exe")', '2026-02-09 16:57:43.692193', true, false, 'origin', '["adversary.user","adversary.ip"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (479, 'XProtect Evasion or Tampering Detected', 3, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects attempts to evade or tamper with XProtect malware detection including modification of XProtect files, databases, or YARA rules. XProtect is Apple''s built-in antimalware system, and attempts to bypass or disable it indicate potential malicious activity.
+
+Next Steps:
+1. Immediately investigate the affected system and user account for signs of compromise
+2. Check for recently installed software or suspicious downloads that may have triggered the evasion attempt
+3. Review system logs for other defense evasion activities around the same timeframe
+4. Verify the integrity of XProtect files and configurations
+5. Run a comprehensive malware scan using additional security tools
+6. Consider isolating the affected system if malicious activity is confirmed
+7. Review user privileges and access controls to prevent unauthorized system modifications
+8. Document the incident and update security policies if necessary
+', '["https://www.sentinelone.com/blog/macos-malware-researchers-how-to-bypass-xprotect-on-catalina/","https://attack.mitre.org/techniques/T1562/001/"]', '(
+ equals("log.subsystem", "com.apple.XProtectFramework") &&
+ (
+ contains("log.eventMessage", "bypass") ||
+ contains("log.eventMessage", "evasion") ||
+ contains("log.eventMessage", "disable")
+ )
+) ||
+(
+ regexMatch("log.processImagePath", ".*/Library/Apple/System/Library/CoreServices/XProtect\\.bundle.*") &&
+ regexMatch("log.eventMessage", ".*(modify|write|delete).*")
+) ||
+(
+ regexMatch("log.eventMessage", ".*XProtect\\.(yara|meta\\.plist|bundle).*") &&
+ (
+ regexMatch("log.eventMessage", ".*(modify|tamper|delete).*") ||
+ !equals("log.process", "XProtectService")
+ )
+) ||
+(
+ equals("log.process", "MRT") &&
+ (contains("log.eventMessage", "kill") || contains("log.eventMessage", "terminate") || contains("log.eventMessage", "stop"))
+) ||
+(
+ regexMatch("log.eventMessage", ".*gk\\.db.*") &&
+ regexMatch("log.eventMessage", ".*(modify|delete|truncate).*")
+) ||
+(
+ equals("log.subsystem", "com.apple.MRT") &&
+ (contains("log.eventMessage", "bypass") || contains("log.eventMessage", "disable") || contains("log.eventMessage", "fail"))
+)
+', '2026-02-09 16:52:24.302497', true, false, 'origin', null, '[]', '["lastEvent.log.process","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (480, 'DNS Cache Poisoning Attempt', 3, 3, 2, 'Resource Development', 'T1584.002 - Acquire Infrastructure: DNS Server', 'Detects potential DNS cache poisoning attempts where multiple DNS responses are received from different sources for the same domain in a short time window, which could indicate an attacker trying to inject malicious DNS records.
+
+Next Steps:
+1. Verify the legitimacy of the DNS responses by checking the source IP addresses
+2. Review DNS query logs to identify the original query that triggered these responses
+3. Check if the responding IP addresses match known legitimate DNS servers
+4. Examine the timing patterns of the responses to identify potential spoofing
+5. Verify DNS server configurations and check for unauthorized DNS server additions
+6. Monitor for subsequent DNS queries to verify if poisoned cache entries are being used
+7. Consider implementing DNS security measures like DNSSEC if not already in place
+', '["https://help.mikrotik.com/docs/spaces/ROS/pages/37748767/DNS","https://attack.mitre.org/techniques/T1584/002/"]', 'equals("log.topics", "dns") &&
+equals("target.port", 53) &&
+exists("origin.ip") &&
+contains("log.chain", "response")
+', '2026-02-09 16:52:24.447716', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-mikrotik-*","with":[{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"},{"field":"log.topics","operator":"filter_term","value":"dns"}],"or":null,"within":"now-5m","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (481, 'MikroTik DNS Static Entry Redirection', 3, 3, 1, 'Credential Access', 'T1584.002 - Compromise Infrastructure: DNS Server', 'Detects creation or modification of static DNS entries on MikroTik routers that could redirect traffic to attacker-controlled servers for credential harvesting or man-in-the-middle attacks.
+
+Next Steps:
+1. Review all static DNS entries for unauthorized additions
+2. Verify the destination IP addresses of suspicious DNS entries
+3. Check if DNS entries redirect to known legitimate services or suspicious IPs
+4. Investigate if users may have been redirected to phishing sites
+5. Remove unauthorized DNS entries immediately
+6. Audit DNS server configuration for other anomalies
+', '["https://help.mikrotik.com/docs/spaces/ROS/pages/328094/Log","https://attack.mitre.org/techniques/T1584/002/"]', 'contains("log.topics", "system") &&
+(contains("log.message", "dns") || contains("log.message", "DNS")) &&
+(contains("log.message", ["static", "added", "changed", "entry"]))
+', '2026-02-09 16:52:24.587109', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (482, 'MikroTik SOCKS Proxy Enablement Detection', 3, 3, 2, 'Command and Control', 'T1090 - Proxy', 'Detects SOCKS proxy enablement on MikroTik routers, a common indicator of Meris botnet infection and other RouterOS-targeting malware. Attackers enable SOCKS proxy to route malicious traffic through compromised routers.
+
+Next Steps:
+1. Immediately check if the SOCKS proxy service is enabled on the router
+2. Verify if the change was authorized by a legitimate administrator
+3. Check for known Meris botnet indicators (scheduler scripts, unauthorized users)
+4. Review firewall rules for any recently added NAT or port forwarding entries
+5. If compromised, disable SOCKS proxy, remove unauthorized users and scripts
+6. Update RouterOS to the latest firmware version
+', '["https://help.mikrotik.com/docs/spaces/ROS/pages/328094/Log","https://attack.mitre.org/techniques/T1090/"]', 'contains("log.topics", "system") &&
+(contains("log.message", "socks") || contains("log.message", "SOCKS")) &&
+(contains("log.message", ["enabled", "changed", "added", "proxy"]))
+', '2026-02-09 16:52:24.717823', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (483, 'MikroTik New Admin User Creation', 3, 3, 2, 'Persistence', 'T1136 - Create Account', 'Detects creation of new administrative users on MikroTik RouterOS devices. Attackers who gain access to MikroTik routers frequently create backdoor accounts for persistent access.
+
+Next Steps:
+1. Verify the new user account was created by an authorized administrator
+2. Review the permissions and group assignment of the new account
+3. Check if the user was created through known management channels (Winbox, SSH, web)
+4. Audit all existing user accounts for unauthorized entries
+5. If unauthorized, immediately delete the account and change all admin passwords
+6. Check for other signs of compromise such as script modifications or scheduler tasks
+', '["https://help.mikrotik.com/docs/spaces/ROS/pages/328094/Log","https://attack.mitre.org/techniques/T1136/"]', 'contains("log.topics", "system") &&
+contains("log.topics", "info") &&
+(contains("log.message", "user") && contains("log.message", ["added", "created", "changed group"])) &&
+!contains("log.message", "logged in")
+', '2026-02-09 16:52:24.852887', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (498, 'Baby Shark C2 Communication Pattern Detected', 3, 3, 2, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects HTTP traffic matching the Baby Shark C2 framework URL pattern. Baby Shark is a reconnaissance tool and C2 framework used primarily by North Korean APT groups (Kimsuky/Thallium). The distinctive URL pattern ''momyshark?key='' is unique to this framework and has very low false positive rates.
+
+Next Steps:
+1. IMMEDIATELY escalate - potential nation-state attack (Kimsuky/DPRK)
+2. Isolate the affected host without alerting the attacker
+3. Engage specialized incident response with APT experience
+4. Preserve all forensic evidence including network captures
+5. Block the C2 domain/IP at the network perimeter
+6. Search for other Baby Shark/Kimsuky indicators across the environment
+7. Coordinate with relevant government agencies (CISA, FBI)
+', '["https://attack.mitre.org/techniques/T1071/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml","https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"]', 'equals("log.eventType", "http") &&
+exists("origin.ip") &&
+(
+ contains("log.http.url", "momyshark?key=") ||
+ contains("log.http.url", "momyshark%3Fkey%3D") ||
+ (contains("log.http.url", "babyshark") && contains("log.http.url", "key="))
+)
+', '2026-02-09 16:52:27.277733', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (484, 'RouterOS Multiple Authentication Failures', 3, 3, 2, 'Credential Access', 'T1110.001 - Brute Force: Password Guessing', 'Detects multiple failed authentication attempts to RouterOS from the same source IP, which may indicate a brute force attack against the device. This rule monitors for login failures across all services including SSH, Telnet, Winbox, and web interface.
+
+Next Steps:
+1. Investigate the source IP address for legitimacy and geographic location
+2. Check if the IP is from an expected network range or known administrator location
+3. Review successful authentication attempts from the same IP before and after the failures
+4. Examine other RouterOS logs for additional suspicious activities from this IP
+5. Consider implementing IP blocking or rate limiting for the source IP
+6. Verify RouterOS user accounts for any unauthorized changes or access
+7. Check if default credentials are still in use on the device
+', '["https://help.mikrotik.com/docs/spaces/ROS/pages/328094/Log","https://attack.mitre.org/techniques/T1110/001/"]', 'contains("log.topics", "system") && contains("log.topics", "error") && contains("log.topics", "critical") && contains("log.message", "login failure") && exists("origin.ip")', '2026-02-09 16:52:24.997509', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-mikrotik-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.message","operator":"filter_match","value":"login failure"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (485, 'SSH Brute Force Attack on MikroTik Device', 3, 2, 2, 'Credential Access', 'T1110.001 - Brute Force: Password Guessing', 'Detects SSH brute force attempts against MikroTik devices. Monitors for multiple SSH connection attempts on port 22 from the same source IP within a short time window, which may indicate password guessing attacks.
+
+Next Steps:
+1. Verify the source IP address and check if it''s from a known legitimate administrator
+2. Review SSH access logs on the MikroTik device for successful authentications
+3. Check if the source IP has been involved in other suspicious activities
+4. Consider implementing rate limiting or IP blocking for repeated failed attempts
+5. Ensure SSH access is restricted to authorized management networks only
+6. Review MikroTik firewall rules and consider disabling SSH access from untrusted networks
+', '["https://help.mikrotik.com/docs/spaces/ROS/pages/132350014/SSH","https://attack.mitre.org/techniques/T1110/001/"]', 'equals("target.port", 22) && equals("protocol", "tcp") && exists("origin.ip") &&
+(contains("log.chain", "input") || contains("log.action", "drop")
+|| (contains("log.topics", "system") && contains("log.kvMessage", "ssh")))
+', '2026-02-09 16:52:25.143279', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-mikrotik-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.port","operator":"filter_term","value":"22"},{"field":"protocol","operator":"filter_term","value":"tcp"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (486, 'C2 Beaconing Behavior Detection', 2, 2, 1, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects potential command and control beaconing behavior based on periodic connections with consistent intervals and small data transfers. This rule identifies suspicious network patterns where an internal host makes repeated small connections to an external host, which may indicate C2 communication.
+
+Next Steps:
+1. Analyze the frequency and timing of connections between the source and destination
+2. Investigate the destination IP for known malicious indicators or suspicious reputation
+3. Examine the content of the communications if possible through packet capture
+4. Check the source host for signs of compromise or malware
+5. Review DNS queries made by the source host around the time of the connections
+6. Correlate with other security events from the same source host
+7. Consider isolating the source host if malicious activity is confirmed
+', '["https://attack.mitre.org/techniques/T1071/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") && exists("target.ip") &&
+greaterThan("origin.bytesSent", 0) && lessThan("origin.bytesSent", 10000) &&
+lessThan("origin.packagesSent", 50) &&
+oneOf("target.port", [443, 80, 8080, 8443])
+', '2026-02-09 16:52:25.287615', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"},{"field":"dataType","operator":"filter_term","value":"netflow"}],"or":null,"within":"now-1h","count":30}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (487, 'Data Exfiltration Detection', 3, 2, 1, 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 'Detects potential data exfiltration based on unusually large outbound data transfers to external IP addresses. This rule identifies network flows where significant amounts of data (>10MB) are transferred from internal systems to external destinations in different countries, potentially indicating unauthorized data theft or exfiltration attempts.
+
+Next Steps:
+1. Verify the legitimacy of the large data transfer by checking if it corresponds to authorized business activities
+2. Investigate the destination IP address for reputation and known threat indicators
+3. Review the user and process responsible for initiating the connection
+4. Check for any recently accessed sensitive files or databases on the source system
+5. Examine network logs for any additional suspicious communications to the same destination
+6. Consider implementing DLP policies if large data transfers to external destinations are not business justified
+7. If confirmed malicious, isolate the affected system and conduct a full forensic investigation
+', '["https://attack.mitre.org/techniques/T1041/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") && exists("target.ip") && greaterThan("origin.bytesSent", 10000000) && safe(origin.geolocation.country, "") != safe(target.geolocation.country, "") && greaterThan("origin.port", 1024)', '2026-02-09 16:52:25.702360', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"dataType","operator":"filter_term","value":"netflow"}],"or":null,"within":"now-1h","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (503, 'Command and Control Traffic Detection', 3, 3, 2, 'Command and Control', 'T1095 - Non-Application Layer Protocol', 'Detects command and control (C2) communication patterns including suspicious periodic connections, non-standard ports, encrypted channels on unusual ports, DNS tunneling, and known C2 infrastructure indicators. This rule identifies malicious communications between compromised systems and command and control servers through various techniques including signature-based detection, protocol analysis, and behavioral indicators.
+
+Next Steps:
+1. Immediately isolate the affected system (origin IP) from the network to prevent further C2 communication
+2. Analyze network traffic logs for additional communications with the destination IP
+3. Perform endpoint forensics on the compromised system to identify malware and persistence mechanisms
+4. Check for lateral movement from the compromised system to other network assets
+5. Review DNS logs for additional suspicious domain queries from the affected system
+6. Update threat intelligence feeds and block the identified C2 infrastructure
+7. Scan other systems for indicators of compromise (IoCs) related to the detected C2 activity
+8. Review user activity and privilege escalation attempts from the compromised system
+9. Consider reimaging the affected system after thorough forensic analysis
+10. Implement additional monitoring for similar C2 patterns across the network
+', '["https://attack.mitre.org/techniques/T1095/","https://attack.mitre.org/techniques/T1571/","https://www.snort.org/rule_docs/"]', '(contains("log.alert.signature", ["command and control", "c&c", "c2", "beacon", "cobalt strike", "metasploit"]) ||
+ oneOf("log.alert.category", ["malware-cnc", "suspicious-traffic"]) ||
+ (equals("protocol", "DNS") && equals("log.dns.type", "TXT") && greaterThan("log.dns.response_length", 200)) ||
+ (regexMatch("log.http.uri", "^/[a-zA-Z0-9]{8,16}$") &&
+ equals("log.http.method", "GET")) ||
+ (greaterThan("log.flow.duration", 300) && lessThan("log.flow.packets", 100) && lessThan("log.flow.bytes", 10240)) ||
+ oneOf("log.ja3.hash", ["3b5074b1b5d032e5620f69f9f700ff0e", "6734f37431670b3ab4292b8f60f29984"])) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:52:27.987304', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-1h","count":5}]', '["adversary.ip","target.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (488, 'DDoS Attack Pattern Detection', 1, 1, 3, 'Impact', 'T1498 - Network Denial of Service', 'Detects potential DDoS attack patterns based on high volume of network flows from multiple sources targeting a single destination within a short time window. This rule identifies suspicious traffic volumes that may indicate volumetric DDoS attacks such as UDP floods, TCP floods, or other amplification attacks.
+
+Next Steps:
+1. Verify the target IP address and check if it''s a critical service or server
+2. Analyze the source IPs to determine if they are part of a botnet or coordinated attack
+3. Review network traffic patterns and bandwidth utilization during the timeframe
+4. Check firewall and DDoS mitigation system logs for related events
+5. Implement rate limiting or blocking rules for attacking source IPs if confirmed malicious
+6. Consider scaling up infrastructure or activating DDoS protection services if attack is ongoing
+7. Document the attack pattern for future reference and threat intelligence
+', '["https://attack.mitre.org/techniques/T1498/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("target.ip") && exists("origin.ip") && (greaterThan("origin.bytesSent", 10000000) || greaterThan("origin.packagesSent", 50000))', '2026-02-09 16:52:25.842391', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"},{"field":"dataType","operator":"filter_term","value":"netflow"}],"or":null,"within":"now-5m","count":100}]', '["target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (489, 'Cryptocurrency Mining Pool Traffic Detection', 1, 2, 3, 'Resource Hijacking', 'T1496 - Resource Hijacking', 'Detects network connections to known cryptocurrency mining pool ports (Stratum protocol on 3333, 4444, 5555, 7777, 8888, 9999, 14444). Internal hosts connecting to mining pools indicate cryptojacking or unauthorized mining activity.
+
+Next Steps:
+1. Identify the internal host connecting to mining pools
+2. Scan the host for mining malware (XMRig, CGMiner, etc.)
+3. Review CPU/GPU utilization on the affected host
+4. Check how the mining software was installed (vulnerability, phishing, insider)
+5. Remove the mining software and patch the entry vector
+6. Block mining pool ports at the network perimeter
+', '["https://attack.mitre.org/techniques/T1496/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+oneOf("target.port", [3333, 4444, 5555, 7777, 8888, 9999, 14444, 14433, 45560]) &&
+equals("protocol", "TCP") &&
+!inCIDR("target.ip", "10.0.0.0/8") &&
+!inCIDR("target.ip", "172.16.0.0/12") &&
+!inCIDR("target.ip", "192.168.0.0/16")
+', '2026-02-09 16:52:25.972958', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":5}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (490, 'DNS-over-HTTPS (DoH) Traffic Detection', 1, 0, 0, 'Command and Control', 'T1071.004 - Application Layer Protocol: DNS', 'Detects DNS-over-HTTPS traffic to known public DoH resolvers. While DoH provides privacy, malware and attackers use it to bypass DNS monitoring and exfiltrate data through encrypted DNS channels.
+
+Next Steps:
+1. Identify the internal host using DoH
+2. Determine if DoH usage is authorized by organization policy
+3. Check if the host has DNS-related malware or unauthorized DNS tools
+4. Review if corporate DNS policies are being bypassed
+5. Consider blocking known DoH resolver IPs at the perimeter
+6. Investigate the host for other signs of compromise if DoH usage is unexpected
+', '["https://attack.mitre.org/techniques/T1071/004/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+equals("target.port", 443) &&
+equals("protocol", "TCP") &&
+(equals("target.ip", "1.1.1.1") || equals("target.ip", "1.0.0.1") ||
+ equals("target.ip", "8.8.8.8") || equals("target.ip", "8.8.4.4") ||
+ equals("target.ip", "9.9.9.9") || equals("target.ip", "149.112.112.112") ||
+ equals("target.ip", "208.67.222.222") || equals("target.ip", "208.67.220.220") ||
+ equals("target.ip", "185.228.168.168") || equals("target.ip", "185.228.169.168") ||
+ equals("target.ip", "104.16.248.249") || equals("target.ip", "104.16.249.249"))
+', '2026-02-09 16:52:26.108020', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.port","operator":"filter_term","value":"443"}],"or":null,"within":"now-1h","count":20}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (491, 'ICMP Tunneling Detection', 3, 2, 1, 'Command and Control', 'T1095 - Non-Application Layer Protocol', 'Detects potential ICMP tunneling by identifying ICMP traffic with unusually large packet sizes or high data volumes. Attackers use ICMP tunneling (tools like ptunnel, icmpsh) to exfiltrate data or establish covert C2 channels through protocols that are often allowed by firewalls.
+
+Next Steps:
+1. Investigate the internal host generating large ICMP traffic
+2. Review the ICMP packet sizes - normal ping uses 64 bytes
+3. Check for ICMP tunneling tools on the host (ptunnel, icmpsh, Hans)
+4. Review the destination IP for known C2 infrastructure
+5. Monitor ICMP traffic patterns for regular beaconing intervals
+6. Consider rate-limiting or blocking ICMP to external destinations
+', '["https://attack.mitre.org/techniques/T1095/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+equals("protocol", "ICMP") &&
+greaterThan("log.bytes", 10000)
+', '2026-02-09 16:52:26.252838', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-10m","count":20}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (492, 'Internal Network Host Scanning Detection', 2, 1, 1, 'Discovery', 'T1046 - Network Service Scanning', 'Detects east-west network scanning where an internal host connects to many other internal hosts on the same or multiple ports, indicating internal reconnaissance or worm propagation.
+
+Next Steps:
+1. Identify the source host and determine if it is a legitimate scanner
+2. Check if the scanning host shows signs of compromise
+3. Review the ports being scanned for service enumeration patterns
+4. Investigate the user account associated with the host
+5. Verify if any vulnerability scanning tools are scheduled to run
+6. If unauthorized, isolate the host and perform forensic analysis
+', '["https://attack.mitre.org/techniques/T1046/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+(inCIDR("origin.ip", "10.0.0.0/8") || inCIDR("origin.ip", "172.16.0.0/12") || inCIDR("origin.ip", "192.168.0.0/16")) &&
+(inCIDR("target.ip", "10.0.0.0/8") || inCIDR("target.ip", "172.16.0.0/12") || inCIDR("target.ip", "192.168.0.0/16")) &&
+lessOrEqual("log.packets", 5) &&
+lessThan("log.bytes", 500)
+', '2026-02-09 16:52:26.403027', true, false, 'origin', '["adversary.ip"]', '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-5m","count":30}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (493, 'Internal SMB/RDP Lateral Movement Detection', 3, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Detects internal hosts connecting to multiple internal targets on SMB (445) or RDP (3389) ports in a short time window, indicating potential lateral movement or internal reconnaissance.
+
+Next Steps:
+1. Identify the source host and verify if the activity is from an authorized admin
+2. Review the user account associated with the connections
+3. Check if the source host shows signs of compromise
+4. Investigate the target hosts for unauthorized access
+5. Review authentication logs on target systems for the associated user
+6. If unauthorized, isolate the source host and conduct forensic analysis
+', '["https://attack.mitre.org/techniques/T1021/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+oneOf("target.port", [445, 3389]) &&
+(inCIDR("origin.ip", "10.0.0.0/8") || inCIDR("origin.ip", "172.16.0.0/12") || inCIDR("origin.ip", "192.168.0.0/16"))
+', '2026-02-09 16:52:26.547607', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.port","operator":"filter_term","value":"445"}],"or":[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.port","operator":"filter_term","value":"3389"}],"or":null,"within":"now-10m","count":10}],"within":"now-10m","count":10}]', '["adversary.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (494, 'Abnormally Long-Lived Network Connection', 2, 1, 1, 'Command and Control', 'T1571 - Non-Standard Port', 'Detects abnormally long-lived network connections (lasting over 24 hours) to external destinations. Persistent connections may indicate C2 channels, backdoor access, or data exfiltration tunnels that maintain ongoing communication.
+
+Next Steps:
+1. Investigate the internal host maintaining the long connection
+2. Identify the application or process responsible for the connection
+3. Review the destination IP and port for known C2 indicators
+4. Check the data transfer volume during the connection
+5. Review connection patterns for beaconing behavior
+6. If suspicious, terminate the connection and scan the host
+', '["https://attack.mitre.org/techniques/T1571/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+greaterThan("log.duration", 86400) &&
+equals("protocol", "TCP") &&
+!inCIDR("target.ip", "10.0.0.0/8") &&
+!inCIDR("target.ip", "172.16.0.0/12") &&
+!inCIDR("target.ip", "192.168.0.0/16") &&
+!oneOf("target.port", [443, 80, 22, 993, 995, 587])
+', '2026-02-09 16:52:26.692192', true, false, 'origin', null, '[]', '["adversary.ip","target.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (495, 'Port Scanning Activity Detection', 2, 1, 1, 'Discovery', 'T1046 - Network Service Scanning', 'Detects port scanning activities based on patterns of connections to multiple ports with minimal data transfer. This could indicate reconnaissance activities or vulnerability scanning attempts.
+
+Next Steps:
+1. Verify the scanning activity by examining the target ports and services
+2. Check if the origin IP is known to be legitimate (security scanner, monitoring tool)
+3. Analyze the scope of the scan - single target or multiple targets
+4. Review firewall and intrusion detection logs for additional context
+5. Investigate any successful connections or unusual response patterns
+6. Consider blocking the origin IP if malicious activity is confirmed
+', '["https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html","https://attack.mitre.org/techniques/T1046/"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+lessOrEqual("log.packets", 10) &&
+lessThan("log.bytes", 1000) &&
+greaterThan("target.port", 0) &&
+equals("protocol", "TCP")
+', '2026-02-09 16:52:26.847297', true, false, 'origin', '["adversary.ip","target.ip"]', '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-2m","count":25}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (496, 'VPN Protocol to Non-Corporate Destination', 3, 2, 1, 'Exfiltration', 'T1572 - Protocol Tunneling', 'Detects VPN protocol traffic (OpenVPN, WireGuard, IPsec) from internal hosts to non-corporate external destinations. This may indicate data exfiltration through unauthorized VPN tunnels or policy-violating VPN usage.
+
+Next Steps:
+1. Identify the internal host establishing unauthorized VPN connections
+2. Verify if the destination is a legitimate corporate VPN endpoint
+3. Review the user and application initiating the VPN tunnel
+4. Check the volume of data transferred through the tunnel
+5. Investigate if any sensitive data may have been exfiltrated
+6. Block unauthorized VPN ports at the perimeter if not needed
+', '["https://attack.mitre.org/techniques/T1572/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html"]', 'exists("origin.ip") &&
+exists("target.ip") &&
+oneOf("target.port", [1194, 51820, 500, 4500, 1701, 1723]) &&
+!inCIDR("target.ip", "10.0.0.0/8") &&
+!inCIDR("target.ip", "172.16.0.0/12") &&
+!inCIDR("target.ip", "192.168.0.0/16")
+', '2026-02-09 16:52:26.987216', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.port","operator":"filter_term","value":"{{target.port}}"}],"or":null,"within":"now-1h","count":3}]', '["adversary.ip","target.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (497, 'Tor Network Usage Detection', 3, 2, 1, 'Command and Control', 'T1090 - Proxy: Multi-hop Proxy', 'Detects potential Tor network usage based on connections to known Tor entry node ports (9001, 9030, 9050, 9051) and traffic patterns consistent with Tor usage. Tor is commonly used by attackers to anonymize their traffic and evade detection.
+
+Next Steps:
+1. Verify if Tor usage is authorized in your organization''s security policy
+2. Investigate the source IP address and user context if available
+3. Check for other suspicious activities from the same source
+4. Consider blocking Tor traffic if not authorized for business use
+5. Review firewall logs for additional Tor-related connections
+6. Correlate with authentication logs to identify the user if possible
+', '["https://attack.mitre.org/techniques/T1090/","https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html","https://www.torproject.org/"]', 'exists("origin.ip") && exists("target.ip") &&
+oneOf("target.port", [9001, 9030, 9050, 9051]) &&
+equals("protocol", "6") && greaterThan("log.bytes", 512)
+', '2026-02-09 16:52:27.132413', true, false, 'origin', null, '[{"indexPattern":"v11-log-netflow-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":5}]', '["adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (671, 'Windows: Execution via MSSQL xp_cmdshell Stored Procedure', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it''s important to review the context of it''s use.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1059/"]', 'oneOf("log.message", ["diskfree", "rmdir", "mkdir", "dir", "del", "rename", "bcp", "XMLNAMESPACES"]) && contains("log.winlogEventDataProcessName", "cmd.exe") && contains("log.winlogEventDataParentProcessName", "sqlservr.exe")', '2026-02-09 16:57:25.311986', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (499, 'Base64-Encoded DNS Query Detected', 3, 2, 1, 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol', 'Detects DNS queries containing base64-encoded data, identified by the presence of ''=='' padding followed by a dot separator. This pattern is commonly used in DNS-based data exfiltration where stolen data is encoded in base64 and split across DNS query subdomains. Legitimate DNS queries almost never contain base64 padding characters.
+
+Next Steps:
+1. Decode the base64 content from the DNS query subdomains
+2. Identify what data is being exfiltrated through the DNS channel
+3. Isolate the source host generating these queries
+4. Block the DNS domain being used for exfiltration at the resolver
+5. Review the volume and frequency of these queries to assess data loss
+6. Check for malware on the source host that is performing the exfiltration
+7. Implement DNS query length monitoring and blocking for oversized queries
+', '["https://attack.mitre.org/techniques/T1048/003/","https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_susp_b64_queries.yml"]', 'equals("log.eventType", "dns") &&
+exists("log.dns.query") &&
+regexMatch("log.dns.query", ".*==\\..*") &&
+exists("origin.ip")
+', '2026-02-09 16:52:27.413211', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"dns"}],"or":null,"within":"now-10m","count":5}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (500, 'Base64-Encoded User Agent String Detected', 2, 2, 1, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects HTTP traffic where the user agent string appears to be a base64-encoded value. Some malware families (notably YamaBot/Torisma attributed to North Korean APT Lazarus) use base64-encoded browser strings as user agents. This evasion technique attempts to bypass user agent-based detection while still being identifiable by the base64 encoding pattern.
+
+Next Steps:
+1. Decode the base64 user agent string to identify the encoded content
+2. Investigate the source host for malware, particularly Lazarus/DPRK-attributed tools
+3. Check the destination for known C2 infrastructure
+4. Correlate with other suspicious activity from the same host
+5. Block the destination IP/domain at the network perimeter
+6. Perform endpoint forensics to identify the malware component
+7. Search for similar base64-encoded UA patterns from other hosts
+', '["https://attack.mitre.org/techniques/T1071/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_base64_encoded.yml"]', 'equals("log.eventType", "http") &&
+exists("log.http.http_user_agent") &&
+exists("origin.ip") &&
+regexMatch("log.http.http_user_agent", "^[A-Za-z0-9+/]{40,}={0,2}$")
+', '2026-02-09 16:52:27.562596', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"http"}],"or":null,"within":"now-30m","count":3}]', '["lastEvent.log.http.http_user_agent","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (501, 'Cobalt Strike DNS Beacon Pattern Detected', 3, 3, 2, 'Command and Control', 'T1071.004 - Application Layer Protocol: DNS', 'Detects DNS queries matching known Cobalt Strike DNS beacon patterns. Cobalt Strike uses specific DNS query prefixes for its DNS-based C2 channel, including ''aaa.stage.'' for staging and ''post.1'' for data exfiltration. These patterns are highly specific to Cobalt Strike and rarely appear in legitimate DNS traffic.
+
+Next Steps:
+1. Immediately isolate the source host generating these DNS queries
+2. Capture and analyze the full DNS query/response pairs for encoded C2 data
+3. Search for the Cobalt Strike beacon payload on the affected endpoint
+4. Check for lateral movement from the compromised system
+5. Block the identified C2 domains at the DNS resolver level
+6. Perform memory forensics on the endpoint to identify the beacon configuration
+7. Review network logs for additional C2 channels (HTTP/HTTPS beacons)
+', '["https://attack.mitre.org/techniques/T1071/004/","https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_mal_cobaltstrike.yml","https://blog.sekoia.io/hunting-and-detecting-cobalt-strike/"]', 'equals("log.eventType", "dns") &&
+exists("log.dns.query") &&
+(
+ regexMatch("log.dns.query", "(?i)^aaa\\.stage\\.") ||
+ regexMatch("log.dns.query", "(?i)^post\\.1") ||
+ (regexMatch("log.dns.query", "(?i)^cdn\\.") && regexMatch("log.dns.query", "(?i)\\.(stage|post)\\.")) ||
+ (regexMatch("log.dns.query", "(?i)^api\\.") && regexMatch("log.dns.query", "(?i)\\.(stage|post)\\.")) ||
+ (regexMatch("log.dns.query", "(?i)^www6\\.") && regexMatch("log.dns.query", "(?i)\\.(stage|post)\\."))
+) &&
+exists("origin.ip")
+', '2026-02-09 16:52:27.712837', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"dns"}],"or":null,"within":"now-15m","count":3}]', '["lastEvent.log.dns.query","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (502, 'Cobalt Strike Malleable C2 Profile Detected', 3, 3, 2, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects HTTP traffic patterns matching known Cobalt Strike malleable C2 profiles. Cobalt Strike operators use malleable C2 profiles to disguise their C2 traffic as legitimate services (Amazon, OCSP, OneDrive, jQuery). This rule matches specific URI patterns, HTTP headers, and user agent combinations that are characteristic of common malleable C2 profiles.
+
+Next Steps:
+1. Immediately isolate the source host from the network
+2. Capture full packet data for the identified C2 sessions
+3. Perform memory forensics to extract the beacon configuration
+4. Identify the C2 server infrastructure and block at network perimeter
+5. Search for additional compromised hosts communicating with the same infrastructure
+6. Check for lateral movement and credential theft from the compromised host
+7. Engage incident response procedures for confirmed C2 activity
+', '["https://attack.mitre.org/techniques/T1071/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml","https://www.cobaltstrike.com/help-malleable-c2"]', 'equals("log.eventType", "http") &&
+exists("origin.ip") &&
+exists("target.ip") &&
+(
+ (contains("log.http.url", "/s/ref=nb_sb_noss_1/") && contains("log.http.http_user_agent", "Mozilla")) ||
+ (contains("log.http.url", "/MFEwTzBNMEswSTAJBg") && contains("log.http.http_content_type", "application/ocsp-response")) ||
+ (regexMatch("log.http.url", "(?i)/jquery-3\\.[0-9]+\\.[0-9]+\\.min\\.js$") && contains("log.http.http_user_agent", "Mozilla")) ||
+ (contains("log.http.url", "/_api/v2.0/") && contains("log.http.hostname", "onedrive")) ||
+ (contains("log.http.url", "/pixel.gif") && contains("log.http.url", "utmac=")) ||
+ (regexMatch("log.http.url", "(?i)/api/v1/push$") && contains("log.http.http_content_type", "application/octet-stream")) ||
+ (contains("log.http.url", "/updates/") && endsWith("log.http.url", ".cab")) ||
+ (regexMatch("log.http.url", "(?i)/__utm\\.gif\\?utmac=") && contains("log.http.http_user_agent", "Mozilla"))
+)
+', '2026-02-09 16:52:27.848465', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"http"}],"or":null,"within":"now-30m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (681, 'Windows: Multiple remote access login failures', 3, 2, 2, 'Credential Access', 'T1110 - Brute Force', 'Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.', '["https://attack.mitre.org/techniques/T1110/"]', 'oneOf("log.eventCode", [20187, 20014, 20078, 20050, 20049, 2018]) &&
+regexMatch("log.message", "(?i)(authentication failed|login failed|access denied|authentication error|invalid credentials)")
+', '2026-02-09 16:57:26.752360', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (504, 'Covert Channel Detection', 3, 2, 1, 'Exfiltration', 'Covert Channel Communication', 'Detects potential covert channel communication through unusual protocols, DNS tunneling, or ICMP data exfiltration patterns. This rule identifies suspicious network communications that may be used to bypass security controls and exfiltrate data through legitimate-looking traffic.
+
+Next Steps:
+1. Examine the source and destination IPs involved in the communication
+2. Analyze the DNS queries for suspicious patterns, encoding, or unusual subdomain structures
+3. Review ICMP traffic payload sizes and patterns for data hiding indicators
+4. Check for base64 encoded data in DNS queries or other protocols
+5. Correlate with endpoint security logs to identify the source process or application
+6. Monitor for similar patterns from the same source IP over extended time periods
+7. Consider network traffic analysis to identify covert communication protocols
+8. Review firewall and proxy logs for blocked or allowed suspicious connections
+', '["https://attack.mitre.org/techniques/T1048/","https://docs.suricata.io/en/latest/output/eve/eve-json-format.html"]', '(
+ (equals("log.eventType", "alert") &&
+ contains("log.alert.signature", "DNS tunneling")) ||
+ (equals("protocol", "ICMP") &&
+ greaterThan("log.flow.bytes_toserver", 1000)) ||
+ (equals("protocol", "DNS") &&
+ greaterThan("log.dns.query.length", 100)) ||
+ (equals("log.appProto", "dns") &&
+ contains("log.dns.query.rrname", ".base64."))
+)
+', '2026-02-09 16:52:28.137680', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (505, 'Data Exfiltration Pattern Detection', 3, 1, 1, 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 'Detects potential data exfiltration activities through unusual outbound traffic patterns, large data transfers, suspicious protocols, base64 encoded data, and connections to external file sharing services. This rule identifies various indicators of data theft including large uploads, connections to file sharing services, DNS tunneling, and TOR usage.
+
+Next Steps:
+1. Investigate the source host for signs of compromise or unauthorized access
+2. Review network logs to identify the exact data being transferred
+3. Check if the destination is a known legitimate service or suspicious domain
+4. Examine user activity on the source system for unauthorized data access
+5. Review file access logs and recently modified sensitive files
+6. Analyze DNS queries for potential data tunneling patterns
+7. Check for presence of data collection tools or scripts on the affected system
+8. Verify if the large data transfer was authorized by business processes
+9. Consider implementing additional monitoring on the affected host
+10. If confirmed malicious, isolate the affected system and begin incident response procedures
+', '["https://attack.mitre.org/techniques/T1048/","https://attack.mitre.org/techniques/T1041/","https://www.snort.org/rule_docs/"]', '(contains("log.alert.signature", ["exfiltration", "data theft", "suspicious upload"]) ||
+ oneOf("log.alert.category", ["policy-violation", "data-loss"]) ||
+ (greaterThan("log.flow.bytes_toserver", 10485760) && oneOf("target.port", [443, 22, 53, 8080])) ||
+ (equals("log.http.method", "POST") && greaterThan("log.http.length", 5242880)) ||
+ contains("log.dns.query", ".pastebin.") || contains("log.dns.query", ".wetransfer.") || contains("log.dns.query", ".mediafire.") ||
+ (equals("log.protocol", "DNS") && greaterThan("log.dns.query_length", 200)) ||
+ contains("log.tls.sni", ["tor2web", ".onion"])) &&
+exists("origin.ip") &&
+exists("target.ip") &&
+equals("log.direction", "outbound")
+', '2026-02-09 16:52:28.278396', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (506, 'DDoS Attack Patterns', 1, 2, 3, 'Impact', 'T1498 - Network Denial of Service', 'Detects various DDoS attack patterns including SYN floods, UDP floods, ICMP floods, HTTP floods, and amplification attacks based on Suricata network intrusion detection system alerts and traffic patterns.
+
+Next Steps:
+1. Analyze traffic volume and patterns to the targeted destination
+2. Check for similar attacks from multiple source IPs
+3. Implement rate limiting or blocking rules for attacking sources
+4. Monitor network bandwidth utilization and performance metrics
+5. Consider activating DDoS mitigation services if available
+6. Review firewall and load balancer configurations
+7. Document the attack timeline and impact for incident response
+', '["https://attack.mitre.org/techniques/T1498/","https://attack.mitre.org/techniques/T1499/","https://docs.suricata.io/en/latest/output/eve/eve-json-format.html"]', '(
+ (equals("log.eventType", "alert") &&
+ (contains("log.alert.signature", "SYN flood") ||
+ contains("log.alert.signature", "DDoS") ||
+ contains("log.alert.signature", "amplification"))) ||
+ (equals("protocol", "TCP") &&
+ equals("log.tcp.flags", "S") &&
+ greaterThan("log.flow.pkts_toserver", 100) &&
+ lessThan("log.flow.duration", 5)) ||
+ (equals("protocol", "UDP") &&
+ greaterThan("log.flow.pkts_toserver", 1000) &&
+ lessThan("log.flow.duration", 10)) ||
+ (equals("protocol", "ICMP") &&
+ greaterThan("log.flow.pkts_toserver", 500) &&
+ lessThan("log.flow.duration", 5)) ||
+ (equals("target.port", 123) &&
+ safe("log.flow.bytes_toclient", 0) > safe("log.flow.bytes_toserver", 0) * 10)
+)
+', '2026-02-09 16:52:28.422423', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-5m","count":50}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (507, 'Cryptocurrency Mining Pool DNS Lookup Detected', 1, 1, 3, 'Resource Hijacking', 'T1496 - Resource Hijacking', 'Detects DNS queries to known cryptocurrency mining pool domains. Unauthorized mining software on corporate systems indicates compromise, as attackers deploy cryptominers for profit using stolen compute resources. This degrades system performance and increases energy costs.
+
+Next Steps:
+1. Identify and terminate the mining process on the affected host
+2. Determine how the miner was deployed (malware, unauthorized software, web-based)
+3. Block mining pool domains at the DNS resolver
+4. Check for additional compromise indicators - miners often accompany other malware
+5. Scan for mining software across the environment
+6. Block common mining ports (3333, 4444, 5555, 8333, 9999) at the firewall
+7. Review system resource utilization for anomalous CPU/GPU usage
+', '["https://attack.mitre.org/techniques/T1496/","https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_mining_pools.yml"]', 'equals("log.eventType", "dns") &&
+exists("log.dns.query") &&
+exists("origin.ip") &&
+(
+ contains("log.dns.query", "monerohash.com") ||
+ contains("log.dns.query", "moneropool.com") ||
+ contains("log.dns.query", "moneropools.com") ||
+ contains("log.dns.query", "xmrpool.eu") ||
+ contains("log.dns.query", "xmrpool.net") ||
+ contains("log.dns.query", "xmr.nanopool.org") ||
+ contains("log.dns.query", "pool.minergate.com") ||
+ contains("log.dns.query", "minexmr.com") ||
+ contains("log.dns.query", "hashvault.pro") ||
+ contains("log.dns.query", "supportxmr.com") ||
+ contains("log.dns.query", "xmr-usa.dwarfpool.com") ||
+ contains("log.dns.query", "xmr-eu.dwarfpool.com") ||
+ contains("log.dns.query", "pool.hashvault.pro") ||
+ contains("log.dns.query", "xmr.pool.minergate.com") ||
+ contains("log.dns.query", "mine.moneropool.com") ||
+ contains("log.dns.query", "xmr.2miners.com") ||
+ contains("log.dns.query", "pool.xmr.pt") ||
+ contains("log.dns.query", "pool.minexmr.com") ||
+ contains("log.dns.query", "monero.herominers.com") ||
+ contains("log.dns.query", "xmr.f2pool.com") ||
+ contains("log.dns.query", "pool.supportxmr.com") ||
+ contains("log.dns.query", "monerohash.net") ||
+ contains("log.dns.query", "us-east.stratum-mining.com") ||
+ contains("log.dns.query", "gulf.moneroocean.stream") ||
+ contains("log.dns.query", "moneroocean.stream") ||
+ contains("log.dns.query", "eu.stratum.slushpool.com") ||
+ contains("log.dns.query", "stratum.slushpool.com") ||
+ contains("log.dns.query", "pool.hashrate.to") ||
+ contains("log.dns.query", "us-east1.miningpoolhub.com") ||
+ contains("log.dns.query", "asia.miningpoolhub.com") ||
+ contains("log.dns.query", "europe.miningpoolhub.com") ||
+ contains("log.dns.query", "pool.coinfoundry.org") ||
+ contains("log.dns.query", "unmineable.com") ||
+ contains("log.dns.query", "ethermine.org") ||
+ contains("log.dns.query", "flypool.org") ||
+ contains("log.dns.query", "eth.nanopool.org") ||
+ contains("log.dns.query", "prohashing.com") ||
+ contains("log.dns.query", "nicehash.com") ||
+ contains("log.dns.query", "luxor.tech") ||
+ contains("log.dns.query", "cruxpool.com") ||
+ contains("log.dns.query", "crazypool.org") ||
+ contains("log.dns.query", "hiveon.net") ||
+ contains("log.dns.query", "poolin.com") ||
+ (regexMatch("log.dns.query", "(?i)(stratum|mining|pool).*\\.(com|net|org|eu|io)$") && contains("log.dns.query", "xmr")) ||
+ (regexMatch("log.dns.query", "(?i)(stratum|mining|pool).*\\.(com|net|org|eu|io)$") && contains("log.dns.query", "monero")) ||
+ regexMatch("log.dns.query", "(?i)coinhive\\.com$") ||
+ contains("log.dns.query", "cryptonight.") ||
+ contains("log.dns.query", "coin-hive.com") ||
+ contains("log.dns.query", "jsecoin.com") ||
+ contains("log.dns.query", "authedmine.com") ||
+ contains("log.dns.query", "coinimp.com") ||
+ contains("log.dns.query", "crypto-loot.com") ||
+ contains("log.dns.query", "minecrunch.co") ||
+ contains("log.dns.query", "webmine.cz") ||
+ contains("log.dns.query", "ppxxmr.com") ||
+ contains("log.dns.query", "coinlab.biz") ||
+ contains("log.dns.query", "minero.cc") ||
+ contains("log.dns.query", "deepminer.js") ||
+ contains("log.dns.query", "cryptoloot.pro")
+)
+', '2026-02-09 16:52:28.517975', true, false, 'origin', null, '[]', '["lastEvent.log.dns.query","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (516, 'Lateral Movement Indicators', 3, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Detects indicators of lateral movement within the network including SMB/RDP scanning, authentication attempts across multiple systems, suspicious remote access patterns, and administrative tool usage. This rule identifies various lateral movement techniques including PsExec usage, WMI commands, RDP brute force attempts, SMB scanning, and connections to common administrative ports.
+
+Next Steps:
+1. Investigate the source IP for other suspicious activities in the past 24 hours
+2. Check if the source host has legitimate administrative access to target systems
+3. Review authentication logs for failed/successful logins from the source IP
+4. Examine process execution logs on both source and target systems
+5. Validate if the detected services (SMB, RDP, WMI) are authorized for this source
+6. Check for privilege escalation attempts on target systems
+7. Review network segmentation to ensure proper access controls
+8. Correlate with endpoint detection tools for additional IOCs
+', '["https://attack.mitre.org/techniques/T1021/","https://attack.mitre.org/tactics/TA0008/","https://www.snort.org/rule_docs/"]', '(contains("log.alert.signature", ["lateral movement", "psexec", "wmi", "rdp brute", "smb scan"]) ||
+ oneOf("log.alert.category", ["network-scan", "misc-activity"]) ||
+ (oneOf("target.port", [445, 3389, 135, 139, 5985, 5986]) && equals("log.eventType", "alert")) ||
+ (oneOf("log.smb.command", ["SMB2_COMMAND_TREE_CONNECT", "SMB2_COMMAND_SESSION_SETUP"]) && !equals("log.smb.status", "STATUS_SUCCESS")) ||
+ (equals("protocol", "RDP") && equals("log.rdp.event_type", "connection_attempt")) ||
+ oneOf("log.service", ["wmi", "winrm", "psexec", "dcom"])) &&
+exists("origin.ip") &&
+exists("target.ip") &&
+regexMatch("origin.ip", "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)")
+', '2026-02-09 16:52:29.767596', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-10m","count":10}]', '["adversary.ip","target.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (508, 'DNS Query to Out-of-Band Interaction Domain', 3, 2, 1, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects DNS queries to known out-of-band (OOB) interaction testing domains used by penetration testing tools and exploit frameworks. These domains (Burp Collaborator, interactsh, dnslog.cn, canarytokens) are almost exclusively used during active exploitation attempts such as SSRF, RCE, XXE, and Log4Shell attacks. Legitimate use is extremely rare outside of authorized security testing.
+
+Next Steps:
+1. Identify the application or service that triggered the DNS query
+2. Check web server logs for corresponding exploitation attempts (SSRF, XXE, JNDI)
+3. Determine if this is authorized penetration testing activity
+4. If unauthorized, investigate the target application for vulnerabilities
+5. Block the OOB interaction domains at the DNS resolver
+6. Check for successful exploitation indicators on the target systems
+7. Review WAF/IDS logs for correlated attack signatures
+', '["https://attack.mitre.org/techniques/T1190/","https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_external_service_interaction_domains.yml","https://portswigger.net/burp/documentation/collaborator"]', 'equals("log.eventType", "dns") &&
+exists("log.dns.query") &&
+(
+ contains("log.dns.query", ".burpcollaborator.net") ||
+ contains("log.dns.query", ".oastify.com") ||
+ contains("log.dns.query", ".interact.sh") ||
+ contains("log.dns.query", ".interactsh.com") ||
+ contains("log.dns.query", ".canarytokens.com") ||
+ contains("log.dns.query", ".dnslog.cn") ||
+ contains("log.dns.query", ".ceye.io") ||
+ contains("log.dns.query", ".bxss.me") ||
+ contains("log.dns.query", ".xss.ht") ||
+ contains("log.dns.query", ".requestbin.net") ||
+ contains("log.dns.query", ".pipedream.net") ||
+ contains("log.dns.query", ".webhook.site") ||
+ contains("log.dns.query", ".r87.me") ||
+ contains("log.dns.query", ".dnsbin.zhack.ca") ||
+ contains("log.dns.query", ".pingb.in") ||
+ contains("log.dns.query", ".beeceptor.com") ||
+ contains("log.dns.query", ".requestrepo.com") ||
+ contains("log.dns.query", ".oast.fun") ||
+ contains("log.dns.query", ".oast.live") ||
+ contains("log.dns.query", ".oast.site") ||
+ contains("log.dns.query", ".oast.online") ||
+ contains("log.dns.query", ".oast.me") ||
+ contains("log.dns.query", ".requestcatcher.com") ||
+ contains("log.dns.query", ".canarytokens.org")
+) &&
+exists("origin.ip")
+', '2026-02-09 16:52:28.628417', true, false, 'origin', null, '[]', '["lastEvent.log.dns.query","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (509, 'DNS Tunneling Detection', 2, 2, 1, 'Command and Control', 'T1071.004 - Application Layer Protocol: DNS', 'Detects potential DNS tunneling activity based on abnormal DNS query patterns, including unusually long domain names, high frequency of DNS requests, or suspicious TXT record queries. DNS tunneling is a technique used by attackers to exfiltrate data or establish command and control channels by encoding data within DNS queries and responses.
+
+Next Steps:
+1. Analyze the DNS queries to identify the specific domains and query types involved
+2. Check the frequency and volume of DNS requests from the source IP
+3. Examine the content of TXT record queries for encoded data
+4. Correlate with network traffic to identify potential data exfiltration
+5. Block suspicious domains at the DNS level if confirmed malicious
+6. Monitor the source host for other indicators of compromise
+', '["https://attack.mitre.org/techniques/T1071/004/","https://www.sans.org/reading-room/whitepapers/dns/detecting-dns-tunneling-34152"]', 'equals("log.protocol", "DNS") && (
+ greaterThan("log.query_length", 50) ||
+ equals("log.query_type", "TXT") ||
+ greaterThan("log.subdomain_levels", 4) ||
+ greaterThan("log.entropy", 4.5)
+)
+', '2026-02-09 16:52:28.763599', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.protocol","operator":"filter_term","value":"DNS"}],"or":null,"within":"now-5m","count":50}]', '["adversary.ip","target.domain"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (510, 'DNS TXT Record Contains Execution Strings', 3, 3, 2, 'Command and Control', 'T1071.004 - Application Layer Protocol: DNS', 'Detects DNS TXT record responses containing Windows command execution strings such as IEX, Invoke-Expression, cmd.exe, powershell, and other execution indicators. This technique is used for DNS-based C2 payload delivery where commands are encoded in DNS TXT records and executed by the compromised host.
+
+Next Steps:
+1. Capture and decode the full DNS TXT record content
+2. Analyze the payload for specific commands being delivered
+3. Isolate the host requesting these DNS records
+4. Block the queried domain at the DNS resolver
+5. Check for evidence of command execution on the endpoint
+6. Review DNS logs for similar queries from other hosts
+7. Perform endpoint forensics to identify the malware requesting these records
+', '["https://attack.mitre.org/techniques/T1071/004/","https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_susp_txt_exec_strings.yml"]', 'equals("log.eventType", "dns") &&
+equals("log.dns.type", "answer") &&
+exists("log.dns.answers") &&
+(
+ contains("log.dns.answers", "IEX") ||
+ contains("log.dns.answers", "Invoke-Expression") ||
+ contains("log.dns.answers", "cmd.exe") ||
+ contains("log.dns.answers", "powershell") ||
+ contains("log.dns.answers", "cmd /c") ||
+ contains("log.dns.answers", "Start-Process") ||
+ contains("log.dns.answers", "DownloadString") ||
+ contains("log.dns.answers", "DownloadFile") ||
+ contains("log.dns.answers", "Net.WebClient") ||
+ contains("log.dns.answers", "FromBase64String") ||
+ contains("log.dns.answers", "/bin/bash") ||
+ contains("log.dns.answers", "/bin/sh") ||
+ contains("log.dns.answers", "wget ") ||
+ contains("log.dns.answers", "curl ")
+) &&
+exists("origin.ip")
+', '2026-02-09 16:52:28.917614', true, false, 'origin', null, '[]', '["lastEvent.log.dns.query","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (511, 'Exploit Attempt Detection', 3, 3, 2, 'Lateral Movement', 'T1210 - Exploitation of Remote Services', 'Detects potential exploit attempts based on suspicious payload patterns, buffer overflow indicators, shellcode execution attempts, and known vulnerability signatures in network traffic. This rule triggers on Suricata IDS alerts that indicate active exploitation attempts against network services.
+
+Next Steps:
+1. Immediately investigate the source IP and target system for signs of compromise
+2. Review the specific CVE or vulnerability signature that triggered the alert
+3. Check if the target system has been patched against the detected vulnerability
+4. Analyze network traffic patterns around the time of the alert for additional suspicious activity
+5. Verify if the exploit attempt was successful by checking system logs and file integrity
+6. Consider blocking the source IP if confirmed malicious
+7. Review and update security controls to prevent similar exploit attempts
+', '["https://attack.mitre.org/techniques/T1210/","https://www.snort.org/rule_docs/"]', '(contains("log.alert.signature", ["exploit", "overflow", "shellcode", "CVE-"]) ||
+ oneOf("log.alert.category", ["attempted-admin", "attempted-user", "shellcode-detect"])) &&
+exists("origin.ip") &&
+equals("log.eventType", "alert")
+', '2026-02-09 16:52:29.058325', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["lastEvent.log.alert.signature","adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (536, 'WildFire Malware Detection', 3, 3, 2, 'Execution', 'T1204.002 - User Execution: Malicious File', 'Detects when WildFire identifies malicious files or malware based on threat analysis. This rule triggers on files with malicious verdicts from WildFire''s advanced analysis engine, indicating potential malware execution or file-based threats.
+
+Next Steps:
+1. Immediately isolate the affected host to prevent lateral movement
+2. Review the file hash and name from the WildFire report
+3. Check if the file was executed or just downloaded
+4. Investigate user activity around the time of detection
+5. Scan other systems for the same file hash
+6. Review email logs if the file came via email attachment
+7. Update security policies to prevent similar threats
+8. Consider forensic analysis of the affected system
+', '["https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview","https://attack.mitre.org/techniques/T1204/002/"]', 'equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") && oneOf("log.severityLabel", ["high", "critical"]) && oneOf("log.act", ["alert", "block", "deny"])', '2026-02-09 16:53:33.007425', true, false, 'origin', null, '[]', '["lastEvent.log.pa_threatid","target.host","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (512, 'Exploit Framework User Agent Detected in HTTP Traffic', 3, 3, 2, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects HTTP traffic containing user agent strings from known C2 frameworks and exploit tools including Cobalt Strike, Metasploit, Empire, Havoc, Sliver, Brute Ratel, Mythic, and other offensive security frameworks. These user agents are strong indicators of active command and control communication or exploitation attempts.
+
+Next Steps:
+1. Immediately isolate the source host generating this traffic
+2. Determine which C2 framework is in use based on the specific user agent
+3. Perform endpoint forensics to locate the implant/beacon
+4. Block the destination IP/domain at the network perimeter
+5. Search for other hosts communicating with the same C2 infrastructure
+6. Check for data exfiltration and lateral movement from the compromised host
+7. Engage incident response for confirmed C2 compromise
+', '["https://attack.mitre.org/techniques/T1071/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_frameworks.yml"]', 'equals("log.eventType", "http") &&
+exists("log.http.http_user_agent") &&
+exists("origin.ip") &&
+(
+ contains("log.http.http_user_agent", "Cobalt Strike") ||
+ regexMatch("log.http.http_user_agent", "(?i)^Mozilla/5\\.0 \\(compatible; MSIE 9\\.0; Windows NT 6\\.1; WOW64; Trident/5\\.0; MALC\\)$") ||
+ contains("log.http.http_user_agent", "Meterpreter") ||
+ contains("log.http.http_user_agent", "Metasploit") ||
+ regexMatch("log.http.http_user_agent", "(?i)^Mozilla/5\\.0 \\(Windows; U; MSIE 7\\.0; Windows NT 5\\.2\\) Java/") ||
+ contains("log.http.http_user_agent", "Empire") ||
+ contains("log.http.http_user_agent", "HavocClient") ||
+ contains("log.http.http_user_agent", "Havoc C2") ||
+ contains("log.http.http_user_agent", "SliverHTTPClient") ||
+ contains("log.http.http_user_agent", "sliver") ||
+ contains("log.http.http_user_agent", "BruteRatel") ||
+ contains("log.http.http_user_agent", "Mythic") ||
+ contains("log.http.http_user_agent", "Covenant") ||
+ contains("log.http.http_user_agent", "PoshC2") ||
+ contains("log.http.http_user_agent", "Merlin Agent") ||
+ contains("log.http.http_user_agent", "DeimosC2") ||
+ contains("log.http.http_user_agent", "NimPlant") ||
+ contains("log.http.http_user_agent", "Nighthawk") ||
+ contains("log.http.http_user_agent", "SILENTTRINITY") ||
+ contains("log.http.http_user_agent", "Koadic") ||
+ contains("log.http.http_user_agent", "PhoenixC2") ||
+ contains("log.http.http_user_agent", "Villain") ||
+ contains("log.http.http_user_agent", "JEVIUX") ||
+ contains("log.http.http_user_agent", "Ninja C2") ||
+ contains("log.http.http_user_agent", "Silver C2")
+)
+', '2026-02-09 16:52:29.197342', true, false, 'origin', null, '[]', '["lastEvent.log.http.http_user_agent","adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (513, 'Hack Tool User Agent Detected in HTTP Traffic', 2, 2, 1, 'Reconnaissance', 'T1595.002 - Active Scanning: Vulnerability Scanning', 'Detects HTTP traffic containing user agent strings from known offensive security and hacking tools including vulnerability scanners, brute force tools, SQL injection tools, and web application testing tools. These tools are commonly used during reconnaissance and exploitation phases of attacks.
+
+Next Steps:
+1. Determine if this is authorized penetration testing or security assessment
+2. Identify the specific tool being used and its target
+3. Block the source IP at the network perimeter if unauthorized
+4. Review web server logs for successful exploitation attempts
+5. Check if any vulnerabilities were discovered and exploited
+6. Implement rate limiting and WAF rules for detected scanning patterns
+7. Alert the security operations team for investigation
+', '["https://attack.mitre.org/techniques/T1595/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_hacktool.yml"]', 'equals("log.eventType", "http") &&
+exists("log.http.http_user_agent") &&
+exists("origin.ip") &&
+(
+ regexMatch("log.http.http_user_agent", "(?i)^Hydra") ||
+ regexMatch("log.http.http_user_agent", "(?i)^DirBuster") ||
+ regexMatch("log.http.http_user_agent", "(?i)^dirbuster") ||
+ contains("log.http.http_user_agent", "sqlmap/") ||
+ regexMatch("log.http.http_user_agent", "(?i)^masscan/") ||
+ regexMatch("log.http.http_user_agent", "(?i)^Nikto") ||
+ contains("log.http.http_user_agent", "Nmap Scripting Engine") ||
+ regexMatch("log.http.http_user_agent", "(?i)^Nmap") ||
+ contains("log.http.http_user_agent", "Nuclei") ||
+ contains("log.http.http_user_agent", "gobuster") ||
+ contains("log.http.http_user_agent", "ffuf/") ||
+ contains("log.http.http_user_agent", "feroxbuster") ||
+ contains("log.http.http_user_agent", "wfuzz") ||
+ contains("log.http.http_user_agent", "httpx") ||
+ contains("log.http.http_user_agent", "WPScan") ||
+ contains("log.http.http_user_agent", "wpscan") ||
+ contains("log.http.http_user_agent", "Burp Suite") ||
+ contains("log.http.http_user_agent", "ZAP") ||
+ regexMatch("log.http.http_user_agent", "(?i)^OWASP ZAP") ||
+ contains("log.http.http_user_agent", "Arachni") ||
+ contains("log.http.http_user_agent", "w3af") ||
+ contains("log.http.http_user_agent", "Skipfish") ||
+ contains("log.http.http_user_agent", "OpenVAS") ||
+ contains("log.http.http_user_agent", "Nessus") ||
+ contains("log.http.http_user_agent", "Acunetix") ||
+ contains("log.http.http_user_agent", "AppSpider") ||
+ contains("log.http.http_user_agent", "Qualys") ||
+ contains("log.http.http_user_agent", "Commix") ||
+ contains("log.http.http_user_agent", "XSSer") ||
+ contains("log.http.http_user_agent", "Medusa") ||
+ contains("log.http.http_user_agent", "Patator") ||
+ contains("log.http.http_user_agent", "CeWL") ||
+ contains("log.http.http_user_agent", "Amass") ||
+ contains("log.http.http_user_agent", "subfinder") ||
+ contains("log.http.http_user_agent", "Scrapy") ||
+ contains("log.http.http_user_agent", "Dalfox") ||
+ contains("log.http.http_user_agent", "Jaeles") ||
+ contains("log.http.http_user_agent", "Cariddi") ||
+ contains("log.http.http_user_agent", "gau/") ||
+ contains("log.http.http_user_agent", "katana/")
+)
+', '2026-02-09 16:52:29.338625', true, false, 'origin', '["adversary.ip","lastEvent.log.http.http_user_agent"]', '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"http"}],"or":null,"within":"now-15m","count":10}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (514, 'ICMP Tunneling Detection', 3, 2, 2, 'Command and Control', 'T1572 - Protocol Tunneling', 'Detects potential ICMP tunneling activity based on abnormal ICMP packet patterns, including oversized ICMP packets, unusual ICMP types, high payload entropy, or abnormal ICMP codes. ICMP tunneling is a covert channel technique used by attackers to bypass network security controls and establish command and control communications.
+
+Next Steps:
+1. Investigate the source IP address for other suspicious network activities
+2. Analyze the ICMP packet payload for hidden data or commands
+3. Check if the destination IP is a known external server or suspicious domain
+4. Review network logs for patterns of regular ICMP traffic to the same destination
+5. Examine endpoint logs on the source machine for signs of compromise
+6. Consider blocking ICMP traffic to external destinations if not business-critical
+7. Implement ICMP payload inspection rules to detect tunneling signatures
+8. Monitor for other covert channel techniques from the same source
+', '["https://attack.mitre.org/techniques/T1572/","https://www.sans.org/reading-room/whitepapers/covert/icmp-tunneling-is-is-secure-1857"]', 'equals("log.protocol", "ICMP") &&
+(greaterThan("log.packet_size", 128) ||
+ greaterThan("log.payload_entropy", 6.0) ||
+ greaterThan("log.icmp_code", 15))
+', '2026-02-09 16:52:29.478469', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.protocol","operator":"filter_term","value":"ICMP"}],"or":null,"within":"now-10m","count":100}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (515, 'IPFS-Based Credential Harvesting Page Access', 3, 2, 0, 'Credential Access', 'T1056 - Input Capture', 'Detects HTTP access to IPFS (InterPlanetary File System) URLs containing email parameters, which is a strong indicator of credential harvesting phishing pages. Attackers host phishing pages on IPFS because the content is decentralized and extremely difficult to take down. The presence of email parameters in IPFS URLs indicates the page is pre-populated with the victim''s email for credential theft.
+
+Next Steps:
+1. Identify the user who accessed the IPFS phishing page
+2. Check if the user submitted credentials on the phishing page
+3. If credentials were submitted, immediately reset the affected account password
+4. Enable MFA on the affected account if not already active
+5. Check for unauthorized access to the user''s account from unusual locations
+6. Block IPFS gateway domains at the proxy if not business-required
+7. Review email logs for the phishing message that delivered the IPFS link
+8. Report the IPFS phishing content to the gateway provider
+', '["https://attack.mitre.org/techniques/T1056/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ipfs-abuse-in-phishing-campaigns/"]', 'equals("log.eventType", "http") &&
+exists("origin.ip") &&
+(
+ (contains("log.http.hostname", "ipfs.io") ||
+ contains("log.http.hostname", "cloudflare-ipfs.com") ||
+ contains("log.http.hostname", "gateway.ipfs.io") ||
+ contains("log.http.hostname", "dweb.link") ||
+ contains("log.http.hostname", "ipfs.eth.aragon.network") ||
+ contains("log.http.hostname", "cf-ipfs.com") ||
+ contains("log.http.hostname", "gateway.pinata.cloud") ||
+ contains("log.http.hostname", "ipfs.infura.io") ||
+ contains("log.http.hostname", "ipfs.fleek.co") ||
+ contains("log.http.hostname", "nftstorage.link") ||
+ contains("log.http.hostname", "w3s.link") ||
+ contains("log.http.hostname", ".ipfs.") ||
+ contains("log.http.url", "/ipfs/") ||
+ contains("log.http.url", "/ipns/")
+ ) &&
+ (
+ regexMatch("log.http.url", "(?i)(email|mail|e-mail|user|login|account)=") ||
+ regexMatch("log.http.url", "(?i)#.*@.*\\.(com|org|net|edu|gov)")
+ )
+)
+', '2026-02-09 16:52:29.624016', true, false, 'origin', null, '[]', '["lastEvent.log.http.hostname","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (682, 'Windows: Modification of Boot Configuration', 1, 3, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1490/"]', 'contains("log.winlogEventDataProcessName", "bcdedit.exe") && regexMatch("log.message", "((ignoreallfailures(.+)bootstatuspolicy(.+)/set)|(ignoreallfailures(.+)/set(.+)bootstatuspolicy)|(/set(.+)bootstatuspolicy(.+)ignoreallfailures)|(/set(.+)ignoreallfailures(.+)bootstatuspolicy)|(bootstatuspolicy(.+)set(.+)ignoreallfailures)|(bootstatuspolicy(.+)ignoreallfailures(.+)/set)|(no(.+)recoveryenabled)|(recoveryenabled(.+)no))")', '2026-02-09 16:57:26.892249', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (517, 'Malware Callback Detection', 3, 3, 2, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects potential malware callback activities including beaconing behavior, known malicious domains, suspicious user agents, and communication patterns typical of command and control infrastructure.
+
+Next Steps:
+1. Analyze the source IP for additional malicious activity patterns
+2. Check destination IP against threat intelligence feeds
+3. Examine HTTP user agents and DNS queries for suspicious patterns
+4. Review network flow duration and data volume for beaconing behavior
+5. Correlate with endpoint security logs to identify compromised systems
+6. Consider blocking the identified C2 infrastructure
+', '["https://attack.mitre.org/techniques/T1071/","https://www.virustotal.com/gui/home/upload","https://www.snort.org/rule_docs/"]', '(contains("log.alert.signature", ["malware", "trojan", "backdoor", "botnet", "c2", "callback"]) ||
+ oneOf("log.alert.category", ["trojan-activity", "malware-cnc"]) ||
+ regexMatch("log.dns.query", "^[a-z0-9]{20,}\\.")) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:52:29.897680', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":10}]', '["adversary.ip","target.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (518, 'Known Malware User Agent String Detected', 3, 3, 2, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects HTTP traffic containing user agent strings associated with known malware families including RATs, stealers, ransomware, and other malicious software. These user agents are hardcoded or generated by specific malware families and serve as high-confidence indicators of compromise.
+
+Next Steps:
+1. Immediately isolate the infected host from the network
+2. Identify the specific malware family from the user agent pattern
+3. Perform full endpoint forensic analysis and malware sample collection
+4. Block the C2 infrastructure at network perimeter
+5. Check for data exfiltration from the infected host
+6. Search for additional infected hosts using the same C2 or malware indicators
+7. Engage incident response and initiate containment procedures
+', '["https://attack.mitre.org/techniques/T1071/001/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_malware.yml"]', 'equals("log.eventType", "http") &&
+exists("log.http.http_user_agent") &&
+exists("origin.ip") &&
+(
+ contains("log.http.http_user_agent", "CRAZYAPT") ||
+ contains("log.http.http_user_agent", "PlugX") ||
+ regexMatch("log.http.http_user_agent", "(?i)^njRAT") ||
+ contains("log.http.http_user_agent", "AsyncRAT") ||
+ contains("log.http.http_user_agent", "QuasarRAT") ||
+ contains("log.http.http_user_agent", "Quasar Client") ||
+ contains("log.http.http_user_agent", "DarkComet") ||
+ contains("log.http.http_user_agent", "NanoCore") ||
+ regexMatch("log.http.http_user_agent", "(?i)^Emotet") ||
+ contains("log.http.http_user_agent", "TrickBot") ||
+ contains("log.http.http_user_agent", "Qakbot") ||
+ contains("log.http.http_user_agent", "QBot") ||
+ contains("log.http.http_user_agent", "IcedID") ||
+ contains("log.http.http_user_agent", "BazarLoader") ||
+ contains("log.http.http_user_agent", "Bumblebee") ||
+ contains("log.http.http_user_agent", "Latrodectus") ||
+ regexMatch("log.http.http_user_agent", "(?i)^LockBit") ||
+ contains("log.http.http_user_agent", "BlackCat") ||
+ contains("log.http.http_user_agent", "ALPHV") ||
+ contains("log.http.http_user_agent", "Raccoon Stealer") ||
+ contains("log.http.http_user_agent", "RedLine Stealer") ||
+ contains("log.http.http_user_agent", "Vidar") ||
+ contains("log.http.http_user_agent", "Lumma") ||
+ contains("log.http.http_user_agent", "StealC") ||
+ contains("log.http.http_user_agent", "AntSword") ||
+ regexMatch("log.http.http_user_agent", "(?i)antSword/v") ||
+ contains("log.http.http_user_agent", "Behinder") ||
+ contains("log.http.http_user_agent", "Godzilla") ||
+ contains("log.http.http_user_agent", "China Chopper") ||
+ contains("log.http.http_user_agent", "SparkRAT") ||
+ contains("log.http.http_user_agent", "Gh0stRAT") ||
+ contains("log.http.http_user_agent", "Remcos") ||
+ contains("log.http.http_user_agent", "AgentTesla") ||
+ contains("log.http.http_user_agent", "FormBook") ||
+ contains("log.http.http_user_agent", "XWorm") ||
+ contains("log.http.http_user_agent", "DCRat") ||
+ contains("log.http.http_user_agent", "Warzone") ||
+ contains("log.http.http_user_agent", "NetWire") ||
+ contains("log.http.http_user_agent", "Amadey") ||
+ contains("log.http.http_user_agent", "SmokeLoader") ||
+ contains("log.http.http_user_agent", "SystemBC") ||
+ contains("log.http.http_user_agent", "Pikabot") ||
+ contains("log.http.http_user_agent", "DarkGate") ||
+ contains("log.http.http_user_agent", "Dridex") ||
+ contains("log.http.http_user_agent", "Zloader") ||
+ contains("log.http.http_user_agent", "Ursnif") ||
+ contains("log.http.http_user_agent", "Gootkit") ||
+ contains("log.http.http_user_agent", "Hancitor") ||
+ contains("log.http.http_user_agent", "Kimsuky") ||
+ contains("log.http.http_user_agent", "CobInt") ||
+ contains("log.http.http_user_agent", "FlawedAmmyy")
+)
+', '2026-02-09 16:52:30.058579', true, false, 'origin', null, '[]', '["lastEvent.log.http.http_user_agent","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (519, 'ARP Spoofing Detection', 3, 3, 2, 'Network Attack', 'T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning', 'Detects ARP spoofing and ARP cache poisoning attacks identified by Suricata. ARP spoofing allows attackers to intercept traffic between hosts on the same network segment, enabling man-in-the-middle attacks, credential theft, and session hijacking.
+
+Next Steps:
+1. Identify the source MAC address involved in the ARP spoofing
+2. Locate the physical port and switch where the spoofing originates
+3. Check if the ARP responses are claiming to be the default gateway
+4. Review affected hosts for intercepted credentials or modified traffic
+5. Enable Dynamic ARP Inspection (DAI) on switches if not configured
+6. Investigate the device for attack tools (Ettercap, Bettercap, arpspoof)
+', '["https://suricata.readthedocs.io/en/latest/rules/index.html","https://attack.mitre.org/techniques/T1557/002/"]', 'equals("log.eventType", "alert") &&
+(contains("log.alert.signature", ["ARP", "arp"]) &&
+ contains("log.alert.signature", ["spoof", "poison", "duplicate", "conflict", "gratuitous"])) &&
+exists("origin.ip")
+', '2026-02-09 16:52:30.203935', true, false, 'origin', null, '[]', '["adversary.ip","adversary.mac"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (520, 'JA3 Fingerprint Threat Intelligence Match', 3, 2, 1, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects TLS client fingerprints (JA3 hashes) matching known malicious software, C2 frameworks, or threat intelligence feeds. JA3 fingerprinting identifies unique TLS client behaviors regardless of destination IP.
+
+Next Steps:
+1. Identify the internal host generating the suspicious JA3 fingerprint
+2. Review the JA3 hash against known malware fingerprint databases
+3. Investigate the process making the TLS connection
+4. Check if the JA3 matches known C2 frameworks (Cobalt Strike, Metasploit, Empire)
+5. Scan the host for malware
+6. Block or monitor connections with the identified JA3 fingerprint
+', '["https://suricata.readthedocs.io/en/latest/rules/ja3-keywords.html","https://attack.mitre.org/techniques/T1071/001/"]', 'equals("log.eventType", "alert") &&
+(contains("log.alert.signature", ["ja3", "JA3", "TLS fingerprint"]) &&
+ contains("log.alert.signature", ["malware", "malicious", "trojan", "c2", "cobalt", "beacon"])) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:52:30.332852', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (521, 'Malicious File Download Detection', 3, 3, 2, 'Execution', 'T1105 - Ingress Tool Transfer', 'Detects downloads of potentially malicious executable files over HTTP identified by Suricata file inspection. This includes PE executables, scripts, and other suspicious file types being transferred from external sources.
+
+Next Steps:
+1. Identify the internal host downloading the file
+2. Review the file hash against threat intelligence databases
+3. Check if the download was initiated by user action or automated
+4. Quarantine or delete the downloaded file if confirmed malicious
+5. Scan the host for additional malware or compromise indicators
+6. Block the source domain/IP and investigate the delivery mechanism
+', '["https://suricata.readthedocs.io/en/latest/rules/file-keywords.html","https://attack.mitre.org/techniques/T1105/"]', 'equals("log.eventType", "alert") &&
+(contains("log.alert.signature", ["executable", "EXE download", "PE file", "script download", "malware download"]) ||
+ oneOf("log.alert.category", ["A Network Trojan was detected", "Potentially Bad Traffic", "Misc Attack"]) &&
+ contains("log.alert.signature", ["download", "file"])) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:52:30.477886', true, false, 'target', null, '[]', '["lastEvent.log.alert.signature","target.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (650, 'Windows: Multiple Logon Failure Followed by Logon Success', 2, 2, 3, 'Credential Access', 'T1110 - Brute Force', 'This rule is triggered when a sequence of multiple failed login attempts followed immediately by a successful login from the same IP address or source is detected. This unusual sequence of events may indicate a possible unauthorized access attempt using a brute force or password guessing technique. The purpose of this rule is to identify suspicious patterns of login activity and alert you to potential unauthorized access attempts.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1110/"]', 'equals("log.eventCode", 4624)', '2026-02-09 16:57:22.482274', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventCode","operator":"filter_term","value":4625},{"field":"target.user","operator":"filter_term","value":"{{target.user}}"}],"or":null,"within":"now-5m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (522, 'SSH Brute Force and Tunneling Detection', 3, 2, 2, 'Lateral Movement', 'T1021.004 - Remote Services: SSH', 'Detects SSH-based attacks including brute force attempts, SSH tunneling indicators, and anomalous SSH traffic patterns identified by Suricata. SSH is commonly abused for lateral movement and encrypted tunneling.
+
+Next Steps:
+1. Investigate the source IP for SSH brute force patterns
+2. Check if SSH tunneling is being used to bypass network controls
+3. Review SSH key-based authentication for unauthorized keys
+4. Check for SSH connections to unusual internal or external destinations
+5. Review the SSH client version for known vulnerable or suspicious clients
+6. Consider restricting SSH access to authorized jump hosts only
+', '["https://suricata.readthedocs.io/en/latest/rules/ssh-keywords.html","https://attack.mitre.org/techniques/T1021/004/"]', 'equals("log.eventType", "alert") &&
+(contains("log.alert.signature", ["SSH", "ssh"]) &&
+ contains("log.alert.signature", ["brute", "scan", "tunnel", "banner", "exploit", "overflow"])) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:52:30.607926', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (523, 'TLS Certificate Anomaly Detection', 3, 2, 1, 'Defense Evasion', 'T1573 - Encrypted Channel', 'Detects TLS certificate anomalies including self-signed certificates, expired certificates, certificate subject mismatches, and certificates from untrusted authorities. These anomalies are common indicators of C2 infrastructure, man-in-the-middle attacks, or phishing sites.
+
+Next Steps:
+1. Review the certificate details (issuer, subject, validity dates)
+2. Check if the destination is a legitimate service with a known certificate issue
+3. Investigate self-signed certificates connecting to external hosts
+4. Review the internal host for malware communicating with C2 servers
+5. Check if the certificate fingerprint matches known threat intelligence
+6. Block connections to destinations with suspicious certificates
+', '["https://suricata.readthedocs.io/en/latest/rules/tls-keywords.html","https://attack.mitre.org/techniques/T1573/"]', 'equals("log.eventType", "alert") &&
+(contains("log.alert.signature", ["self-signed", "expired certificate", "certificate mismatch", "untrusted CA", "invalid certificate"]) ||
+ oneOf("log.alert.category", ["Not Suspicious Traffic", "Potential Corporate Privacy Violation"]) &&
+ contains("log.alert.signature", "certificate")) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:52:30.748591', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-1h","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (524, 'NKN Blockchain C2 Communication Detected', 3, 3, 2, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects DNS queries to NKN (New Kind of Network) blockchain seed nodes. NKN is a blockchain-based overlay network that has been abused by malware as a decentralized C2 channel. The use of blockchain-based C2 makes takedown extremely difficult and provides high resilience for malware communications.
+
+Next Steps:
+1. Investigate the source host for malware using NKN for C2
+2. Block NKN seed node domains at the DNS resolver
+3. Check for NKN client software or libraries on the endpoint
+4. Perform memory forensics to identify the malware component
+5. Search for similar NKN DNS queries from other hosts
+6. Block NKN protocol traffic at the network perimeter
+7. Engage threat intelligence team to identify the specific malware family
+', '["https://attack.mitre.org/techniques/T1071/","https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_nkn.yml","https://research.checkpoint.com/2023/cloud-based-botnet-used-nkn-for-its-c2-communication/"]', 'equals("log.eventType", "dns") &&
+exists("log.dns.query") &&
+exists("origin.ip") &&
+(
+ regexMatch("log.dns.query", "(?i)^seed[0-9]*\\.nkn\\.org$") ||
+ endsWith("log.dns.query", ".nkn.org") ||
+ endsWith("log.dns.query", ".nknx.org")
+)
+', '2026-02-09 16:52:30.892651', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"dns"}],"or":null,"within":"now-15m","count":3}]', '["lastEvent.log.dns.query","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (525, 'Port Scan Detection', 2, 1, 1, 'Discovery', 'T1046 - Network Service Scanning', 'Detects various port scanning techniques including TCP SYN scans, connect scans, UDP scans, NULL scans, FIN scans, and XMAS scans. Port scanning is a reconnaissance technique used by attackers to discover open ports and services on target systems, which can be used to identify potential attack vectors.
+
+This rule detects port scans through multiple indicators:
+- Suricata alert signatures containing scan-related keywords
+- TCP SYN packets with short duration flows (SYN scan)
+- TCP packets with unusual flag combinations (NULL, FIN, XMAS scans)
+- Anomaly events indicating scan activity
+
+Next Steps:
+1. Investigate the source IP for legitimacy (internal security scanner vs external threat)
+2. Analyze the target ports and services being scanned
+3. Check for any successful connections following the scan activity
+4. Review network segmentation and firewall rules for the affected systems
+5. Consider blocking the source IP if confirmed malicious
+6. Monitor for any privilege escalation or lateral movement attempts from the scanning source
+', '["https://attack.mitre.org/techniques/T1046/","https://docs.suricata.io/en/latest/output/eve/eve-json-format.html"]', '(
+ (equals("log.eventType", "alert") &&
+ contains("log.alert.signature", ["scan", "SCAN", "portscan"])) ||
+ (equals("protocol", "TCP") &&
+ equals("log.tcp.flags", "S") &&
+ equals("log.flow.state", "new") &&
+ lessThan("log.flow.duration", 1)) ||
+ (equals("protocol", "TCP") &&
+ oneOf("log.tcp.flags", ["", "F", "FPU"])) ||
+ (equals("log.eventType", "anomaly") &&
+ contains("log.anomaly.event", "scan"))
+)
+', '2026-02-09 16:52:31.042713', true, false, 'origin', '["adversary.ip","target.ip"]', '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-10m","count":50},{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-10m","count":20}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (526, 'PwnDrop File Hosting Server Access Detected', 2, 3, 1, 'Command and Control', 'T1102 - Web Service', 'Detects HTTP access to PwnDrop file hosting servers. PwnDrop is a self-hosted file hosting tool designed for red teamers and attackers to serve payloads. The /pwndrop/ path in the URL is the default admin and API endpoint, and its presence in web traffic strongly indicates malicious file hosting or payload delivery.
+
+Next Steps:
+1. Identify what files were downloaded from the PwnDrop server
+2. Analyze any downloaded files for malicious content
+3. Block the PwnDrop server IP/domain at the network perimeter
+4. Check if the access was part of authorized red team activity
+5. Investigate the source host for signs of compromise
+6. Search for other hosts that connected to the same PwnDrop server
+7. Check email logs for phishing links pointing to the PwnDrop server
+', '["https://attack.mitre.org/techniques/T1102/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_pwndrop.yml","https://github.com/kgretzky/pwndrop"]', 'equals("log.eventType", "http") &&
+exists("origin.ip") &&
+contains("log.http.url", "/pwndrop/")
+', '2026-02-09 16:52:31.187655', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (527, 'Rclone Data Exfiltration Tool Detected', 3, 2, 1, 'Exfiltration', 'T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage', 'Detects HTTP traffic with the rclone user agent string. Rclone is a command-line program to manage files on cloud storage and is the most commonly used data exfiltration tool in ransomware operations. Threat groups including Conti, BlackMatter, LockBit, and many others use rclone to exfiltrate data before deploying ransomware.
+
+Next Steps:
+1. Immediately investigate the source host for signs of ransomware staging
+2. Determine what data is being transferred and to which cloud destination
+3. Check if rclone is an authorized tool in the environment
+4. Block the destination cloud storage endpoints if unauthorized
+5. Preserve network capture data for forensic analysis of exfiltrated data
+6. Search for ransomware deployment indicators on the same host
+7. Initiate incident response - this may indicate imminent ransomware deployment
+', '["https://attack.mitre.org/techniques/T1567/002/","https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_rclone.yml","https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/"]', 'equals("log.eventType", "http") &&
+exists("log.http.http_user_agent") &&
+exists("origin.ip") &&
+(
+ startsWith("log.http.http_user_agent", "rclone/") ||
+ contains("log.http.http_user_agent", "rclone/v")
+)
+', '2026-02-09 16:52:31.332661', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.eventType","operator":"filter_term","value":"http"}],"or":null,"within":"now-30m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (528, 'Threat Intelligence IOC Match', 3, 2, 2, 'Command and Control', 'Command and Control', 'Detects network traffic matching known malicious indicators from threat intelligence feeds including malicious IPs, domains, and URLs. This rule triggers when Suricata identifies traffic involving known threat actors, command and control servers, botnet infrastructure, or other malicious network indicators based on threat intelligence data.
+
+Next Steps:
+1. Immediately isolate the affected system from the network to prevent lateral movement
+2. Analyze the complete network session to understand the scope of communication
+3. Check for other systems that may have communicated with the same malicious indicator
+4. Review threat intelligence source details to understand the specific threat type and attribution
+5. Examine system logs for signs of compromise or malicious activity
+6. Run comprehensive malware scans on the affected endpoint
+7. Review user activity and authentication logs for suspicious behavior
+8. Consider blocking the malicious indicator at network perimeter devices
+9. Document the incident and update threat hunting queries to detect similar activity
+10. If confirmed malicious, initiate incident response procedures and consider threat hunting across the environment
+', '["https://attack.mitre.org/techniques/T1071/","https://www.snort.org/faq/what-is-snort"]', 'equals("log.alert_category", "threat_intel") &&
+exists("origin.ip") &&
+oneOf("log.threat_type", ["malicious_ip", "c2_server", "known_malware", "botnet"])
+', '2026-02-09 16:52:31.768258', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":3}]', '["lastEvent.log.threat_type","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (529, 'Tor Proxy/Gateway DNS Lookup Detected', 3, 2, 1, 'Command and Control', 'T1090.003 - Proxy: Multi-hop Proxy', 'Detects DNS lookups to known Tor proxy and gateway domains. These services allow web traffic to be routed through the Tor network without installing the Tor browser, commonly used by attackers to anonymize C2 traffic or access dark web resources from corporate networks.
+
+Next Steps:
+1. Investigate the source host for malware using Tor for C2 communications
+2. Determine if the user has a legitimate reason to access Tor services
+3. Block Tor proxy domains at the DNS resolver level
+4. Check for data exfiltration through Tor-routed connections
+5. Review the host for other indicators of compromise
+6. Implement network controls to block Tor relay IPs at the firewall
+7. Monitor for Tor bridge connections as an evasion technique
+', '["https://attack.mitre.org/techniques/T1090/003/","https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_torproxy.yml"]', 'equals("log.eventType", "dns") &&
+exists("log.dns.query") &&
+exists("origin.ip") &&
+(
+ contains("log.dns.query", ".torproject.org") ||
+ contains("log.dns.query", ".tor2web.") ||
+ contains("log.dns.query", ".onion.to") ||
+ contains("log.dns.query", ".onion.cab") ||
+ contains("log.dns.query", ".onion.nu") ||
+ contains("log.dns.query", ".onion.link") ||
+ contains("log.dns.query", ".onion.it") ||
+ contains("log.dns.query", ".onion.city") ||
+ contains("log.dns.query", ".onion.direct") ||
+ contains("log.dns.query", ".onion.top") ||
+ contains("log.dns.query", ".onion.casa") ||
+ contains("log.dns.query", ".onion.plus") ||
+ contains("log.dns.query", ".onion.dog") ||
+ contains("log.dns.query", ".onion.rip") ||
+ contains("log.dns.query", ".onion.guide") ||
+ contains("log.dns.query", ".onion.ws") ||
+ contains("log.dns.query", ".onion.pet") ||
+ contains("log.dns.query", ".onion.sh") ||
+ contains("log.dns.query", ".onion.ly") ||
+ contains("log.dns.query", ".onion.mn") ||
+ contains("log.dns.query", ".onion.si") ||
+ contains("log.dns.query", ".onion.lu") ||
+ contains("log.dns.query", ".darknet.to") ||
+ contains("log.dns.query", ".onion.foundation") ||
+ endsWith("log.dns.query", ".torproxy.io") ||
+ endsWith("log.dns.query", ".tor-gateways.de") ||
+ endsWith("log.dns.query", ".torstorm.org") ||
+ endsWith("log.dns.query", ".tor.taxi") ||
+ endsWith("log.dns.query", ".tor.direct") ||
+ endsWith("log.dns.query", ".torghost.com") ||
+ endsWith("log.dns.query", ".tor.gs") ||
+ endsWith("log.dns.query", ".tor.cat") ||
+ endsWith("log.dns.query", ".tor.haus") ||
+ endsWith("log.dns.query", ".tor.rocks") ||
+ endsWith("log.dns.query", ".tor.lol") ||
+ endsWith("log.dns.query", ".onion.in.net") ||
+ endsWith("log.dns.query", ".onion.glass") ||
+ endsWith("log.dns.query", ".onion.ms") ||
+ endsWith("log.dns.query", ".onion.gg") ||
+ endsWith("log.dns.query", ".tor.pm")
+)
+', '2026-02-09 16:52:31.922243', true, false, 'origin', null, '[]', '["lastEvent.log.dns.query","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (530, 'Tunneling Detection', 3, 2, 1, 'Command and Control', 'T1572 - Protocol Tunneling', 'Detects various tunneling techniques including SSH tunneling, HTTP tunneling, VPN over non-standard ports, and protocol mismatches. Tunneling is used by attackers to bypass network security controls and establish covert communication channels.
+
+Next Steps:
+1. Verify the legitimacy of the detected tunneling activity
+2. Check if the source IP is authorized to establish tunneled connections
+3. Analyze the destination and ports being used for tunneling
+4. Review network traffic patterns for data exfiltration indicators
+5. Investigate the purpose and content of the tunneled traffic
+6. Consider blocking the source IP if activity is confirmed malicious
+7. Review firewall rules to prevent unauthorized tunneling protocols
+', '["https://attack.mitre.org/techniques/T1572/","https://docs.suricata.io/en/latest/output/eve/eve-json-format.html"]', '(
+ (equals("log.eventType", "alert") &&
+ (contains("log.alert.signature", "SSH") &&
+ !equals("target.port", 22))) ||
+ (equals("log.appProto", "ssh") &&
+ !equals("target.port", 22)) ||
+ (equals("protocol", "TCP") &&
+ equals("target.port", 443) &&
+ !equals("log.appProto", "tls")) ||
+ (equals("log.eventType", "alert") &&
+ contains("log.alert.signature", "tunnel")) ||
+ (equals("target.port", 53) &&
+ equals("protocol", "TCP") &&
+ greaterThan("log.flow.bytes_toserver", 5000))
+)
+', '2026-02-09 16:52:32.048347', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"target.port","operator":"filter_term","value":"{{target.port}}"}],"or":null,"within":"now-30m","count":5}]', '["adversary.ip","target.port"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (651, 'Windows: Clearing Windows Console History', 1, 2, 3, 'Defense Evasion', 'T1070.003 - Indicator Removal: Clear Command History', 'Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1070/003/"]', 'regexMatch("log.message", "(Clear-History|(Remove-Item|rm)(.+)(ConsoleHost_history.txt|\\(Get-PSReadlineOption\\)\\.HistorySavePath)|(ConsoleHost_history.txt|\\(Get-PSReadlineOption\\)\\.HistorySavePath)(.+)(Remove-Item|rm)|Set-PSReadlineOption(.+)SaveNothing|SaveNothing(.+)PSReadlineOption)") && equals("log.winlogProviderName", "PowerShell")', '2026-02-09 16:57:22.562327', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (531, 'IOC Match from Threat Intelligence Feed', 3, 3, 2, 'Defense Evasion', 'T1027 - Obfuscated Files or Information', 'Detects when network traffic matches known Indicators of Compromise (IOCs) from threat intelligence feeds. This includes malicious IPs, domains, URLs, or file hashes associated with known threat actors or campaigns. The Palo Alto firewall has identified and blocked traffic based on threat intelligence data.
+
+Next Steps:
+1. Review the specific IOC that triggered the alert and verify its legitimacy
+2. Investigate the source IP address for additional suspicious activities
+3. Check if the same IOC has been observed from other internal hosts
+4. Examine the target destination for potential compromise indicators
+5. Update threat intelligence feeds and firewall rules as necessary
+6. Consider isolating affected hosts if compromise is confirmed
+7. Document the incident and IOC details for threat hunting activities
+', '["https://docs.paloaltonetworks.com/cortex/cortex-xsoar/threat-intelligence-management","https://attack.mitre.org/techniques/T1027/"]', '(contains("log.panOSThreatCategory", "malware") ||
+ contains("log.panOSThreatCategory", "command-and-control") ||
+ contains("log.panOSThreatCategory", "phishing") ||
+ contains("log.panOSThreatCategory", "botnet") ||
+ contains("log.msg", "threat-intel") ||
+ contains("log.msg", "ioc-match")) &&
+oneOf("log.panOSAction", ["block", "deny", "drop", "reset-both", "reset-client", "reset-server"])
+', '2026-02-09 16:53:32.223201', true, false, 'origin', null, '[]', '["lastEvent.log.panOSThreatID","adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (532, 'PAN-OS Management Plane Login Brute Force', 3, 3, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects multiple failed login attempts to the PAN-OS management plane (web UI, SSH, or API), indicating potential brute force attacks against firewall administrative credentials.
+
+Next Steps:
+1. Investigate the source IP attempting management authentication
+2. Verify if the targeted admin account exists and is active
+3. Check for any successful logins from the same source after failures
+4. Consider restricting management access by IP address
+5. Enable account lockout policies if not already configured
+6. Review management interface exposure and restrict to trusted networks
+', '["https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields","https://attack.mitre.org/techniques/T1110/"]', 'equals("log.pa_type", "SYSTEM") &&
+(contains("log.message", ["auth", "login"]) && contains("log.message", ["fail", "invalid", "denied"])) &&
+exists("origin.ip")
+', '2026-02-09 16:53:32.372752', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-paloalto-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.pa_type","operator":"filter_term","value":"SYSTEM"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (533, 'PAN-OS DNS Security Alert Detection', 3, 2, 1, 'Command and Control', 'T1071.004 - Application Layer Protocol: DNS', 'Detects PAN-OS DNS Security alerts including DNS sinkholing, domain generation algorithm (DGA) detection, DNS tunneling, and queries to known malicious domains. These alerts indicate potential C2 communication or data exfiltration via DNS.
+
+Next Steps:
+1. Identify the internal host generating suspicious DNS queries
+2. Review the queried domains for DGA patterns or known malicious indicators
+3. Check if DNS tunneling tools are installed on the source system
+4. Review the DNS query frequency and payload sizes for anomalies
+5. Investigate the source host for malware infection
+6. Block the malicious domains and scan the affected host
+', '["https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/dns-security","https://attack.mitre.org/techniques/T1071/004/"]', 'equals("log.pa_type", "THREAT") &&
+(equals("log.pa_subtype", "dns") ||
+ (contains("log.message", "DNS") && contains("log.message", ["sinkhole", "DGA", "tunnel", "malicious"]))) &&
+(oneOf("log.act", ["sinkhole", "block-url", "alert", "drop"]) ||
+ exists("log.DNSSICategory")) &&
+exists("origin.ip")
+', '2026-02-09 16:53:32.531854', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-paloalto-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.pa_subtype","operator":"filter_term","value":"dns"}],"or":null,"within":"now-30m","count":3}]', '["adversary.ip","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (534, 'PAN-OS Spyware and Vulnerability Threat Detection', 3, 3, 2, 'Intrusion Detection', 'T1190 - Exploit Public-Facing Application', 'Detects spyware and vulnerability threat detections from PAN-OS threat prevention engine. These alerts indicate active exploitation attempts, spyware callbacks, or known vulnerability exploitation against protected hosts.
+
+Next Steps:
+1. Investigate the source and target of the detected threat
+2. Review the specific threat ID and signature for vulnerability details
+3. Check if the attack was blocked or only alerted
+4. Verify the target system is patched against the exploited vulnerability
+5. Scan the target system for signs of compromise if the threat was not blocked
+6. Update threat prevention signatures and review security profiles
+', '["https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention","https://attack.mitre.org/techniques/T1190/"]', 'equals("log.pa_type", "THREAT") &&
+oneOf("log.pa_subtype", ["spyware", "vulnerability"]) &&
+oneOf("log.severityLabel", ["critical", "high"]) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:53:32.686845', true, false, 'origin', null, '[]', '["lastEvent.log.pa_threatid","adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (535, 'PAN-OS Malicious URL Category Block', 3, 2, 1, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects URL filtering blocks for malicious, phishing, or command-and-control URL categories on Palo Alto firewalls. Repeated blocks from the same host may indicate malware infection or compromised credentials.
+
+Next Steps:
+1. Investigate the internal host that attempted to access the malicious URL
+2. Review the URL category and specific blocked domain for threat context
+3. Check if the user clicked a phishing link in email
+4. Scan the host for malware if the URL was a C2 callback
+5. Review other connections from the same host for additional IOCs
+6. Block the destination domain at DNS level for defense in depth
+', '["https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering","https://attack.mitre.org/techniques/T1071/001/"]', 'equals("log.pa_type", "THREAT") &&
+equals("log.pa_subtype", "url") &&
+oneOf("log.act", ["block-url", "block-page", "block-override", "alert"]) &&
+(oneOf("log.urlCategory", ["malware", "phishing", "command-and-control", "grayware", "hacking"]) ||
+ contains("log.category", ["malware", "phishing", "command-and-control", "grayware", "hacking"]))
+', '2026-02-09 16:53:32.851804', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-paloalto-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.pa_subtype","operator":"filter_term","value":"url"}],"or":null,"within":"now-30m","count":5}]', '["adversary.ip","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (652, 'Clearing Windows Event Logs with wevtutil', 1, 2, 3, 'Defense Evasion', 'T1070.001 - Indicator Removal: Clear Windows Event Logs', 'Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1070/001/"]', 'regexMatch("log.message", "(/e:false|cl|clear-log|Clear-EventLog)") && regexMatch("log.winlogEventDataLogonProcessName", "wevtutil.exe")', '2026-02-09 16:57:22.671692', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (537, 'Zero-Day Exploit Prevention', 3, 3, 3, 'Execution', 'T1203 - Exploitation for Client Execution', 'Detects potential zero-day exploits blocked by Palo Alto''s threat prevention engine. This rule triggers on high-severity vulnerability attempts and unknown threat patterns that may indicate zero-day exploit attempts. The rule looks for THREAT type events with vulnerability or exploit subtypes that have high or critical severity, and either contain CVE references or are categorized as unknown threats.
+
+Next Steps:
+1. Investigate the source IP address and determine if it''s internal or external
+2. Review the specific threat ID and vulnerability details in Palo Alto logs
+3. Check if the exploit attempt was successful or blocked
+4. Analyze network traffic patterns from the source IP for additional malicious activity
+5. Update threat prevention signatures if a new zero-day is confirmed
+6. Consider blocking the source IP if it shows persistent malicious behavior
+7. Review and strengthen endpoint security on potentially targeted systems
+', '["https://docs.paloaltonetworks.com/threat-prevention/administration/best-practices/best-practices-for-securing-your-network-from-layer-4-and-layer-7-evasions/evasion-signatures","https://attack.mitre.org/techniques/T1203/"]', 'equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown"))', '2026-02-09 16:53:33.232292', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-paloalto-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"log.pa_type","operator":"filter_term","value":"THREAT"}],"or":null,"within":"now-30m","count":2}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (538, 'DNS Resolver Cache Poisoning Attempt', 2, 3, 2, 'Credential Access, Collection', 'T1584.002 - Compromise Infrastructure: DNS Server', 'Detects potential DNS cache poisoning attempts on pfSense DNS resolver (Unbound) by monitoring for suspicious DNS responses with mismatched query IDs or unexpected responses from non-authoritative servers. This rule identifies anomalous DNS traffic patterns that may indicate an attacker attempting to poison DNS cache entries.
+
+Next Steps:
+1. Investigate the source IP address for other suspicious DNS activities
+2. Verify DNS resolver configuration and check for unauthorized changes
+3. Review DNS query logs for patterns of cache poisoning attempts
+4. Check if legitimate DNS servers are responding with forged packets
+5. Consider implementing DNS response validation and DNSSEC if not already enabled
+6. Monitor for subsequent DNS queries to verify if cache poisoning was successful
+', '["https://docs.netgate.com/pfsense/en/latest/services/dns/resolver.html","https://attack.mitre.org/techniques/T1584/002/"]', 'equals("log.eventType", "unbound") && contains("log.reason", "reply") && (!equals("log.rcode", "NOERROR") || contains("log.flags", "FORGED"))', '2026-02-09 16:53:33.407250', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-pfsense-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-5m","count":10}]', '["lastEvent.log.query_name","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (539, 'pfSense Snort/Suricata IDS Alerts', 2, 2, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects high-priority IDS alerts from Snort or Suricata indicating malicious activity, exploits, or known attack patterns. These alerts typically indicate active threats such as trojans, exploits, malware, backdoors, shellcode, rootkits, or various attack attempts including scans, intrusions, and compromises.
+
+Next Steps:
+1. Immediately investigate the source IP address and verify if it''s a legitimate system
+2. Review the full alert details and classification to understand the specific threat detected
+3. Check network logs for additional suspicious activity from the same source
+4. Examine the target system for signs of compromise or successful exploitation
+5. Consider blocking the source IP if confirmed malicious
+6. Update IDS signatures and review firewall rules to prevent similar attacks
+7. Correlate with threat intelligence feeds to identify known malicious indicators
+', '["https://docs.netgate.com/pfsense/en/latest/packages/snort/alerts.html","https://docs.netgate.com/pfsense/en/latest/packages/snort/index.html","https://attack.mitre.org/techniques/T1059/"]', 'regexMatch("log.eventType", "(?i)(snort|suricata)") &&
+regexMatch("log.raw", "(?i)(priority\\s*:\\s*1|classification\\s*:\\s*(trojan|exploit|malware|backdoor|shellcode|rootkit))")
+', '2026-02-09 16:53:33.652593', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-pfsense-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["lastEvent.log.eventType","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (540, 'SonicWall Anti-Spyware Detection', 3, 2, 1, 'Discovery', 'T1082 - System Information Discovery', 'Detects when SonicWall Anti-Spyware service identifies and blocks spyware, adware, or other potentially unwanted programs (PUPs) that may be attempting to collect sensitive information or establish persistence on the network.
+
+Next Steps:
+- Review the detected spyware category and priority level
+- Investigate the source IP address for other malicious activities
+- Check if the blocked spyware represents a targeted attack or widespread infection
+- Verify that Anti-Spyware policies are properly configured and up-to-date
+- Consider quarantining the affected host if multiple spyware detections occur
+- Review network traffic patterns from the source to identify potential data exfiltration
+', '["https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf","https://attack.mitre.org/techniques/T1082/"]', '(exists("log.spycat") ||
+ contains("log.message", "spyware") ||
+ contains("log.message", "Anti-Spyware") ||
+ contains("log.eventName", "Anti-Spyware") ||
+ contains("log.category", "Anti-Spyware") ||
+ (exists("log.spypri") && !equals("log.spypri", "0"))) &&
+(equals("action", "blocked") || equals("log.fw_action", "drop"))
+', '2026-02-09 16:53:33.742351', true, false, 'origin', '["adversary.ip","target.host"]', '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":3}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (541, 'SonicWall Botnet Activity Detected', 3, 3, 2, 'Command and Control', 'T1071 - Application Layer Protocol', 'Detects potential botnet command and control (C2) communication or infected host behavior identified by SonicWall''s botnet filter. This includes suspicious outbound connections, HTML infection chains, or known botnet signatures.
+
+Next Steps:
+1. Investigate the source IP for additional suspicious activity
+2. Check network logs for other connections from the same host
+3. Analyze DNS queries from the affected host
+4. Review endpoint logs for signs of malware infection
+5. Consider isolating the affected host if infection is confirmed
+6. Update threat intelligence feeds and security signatures
+7. Scan the host with updated antivirus/anti-malware tools
+', '["https://www.sonicwall.com/support/knowledge-base/understanding-geo-ip-and-botnet-filter-diagnostics-options/200527122256150","https://attack.mitre.org/techniques/T1071/"]', '(equals("log.category", "Botnet") || contains("log.message", "botnet") || contains("log.message", "infected") || contains("log.message", "C&C") || contains("log.message", "command and control") || equals("log.af_service", "botnet")) && (equals("action", "blocked") || equals("action", "dropped") || equals("log.fw_action", "drop"))', '2026-02-09 16:53:33.847589', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-2h","count":10}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (542, 'SonicWall Capture ATP Malicious Verdict', 3, 3, 2, 'Execution', 'T1204 - User Execution', 'Detects when SonicWall Capture ATP (Advanced Threat Protection) identifies a file as malicious after sandbox analysis. This indicates an attempted malware delivery or execution that was blocked by the ATP service.
+
+Next Steps:
+1. Investigate the source IP address for additional malicious activity
+2. Review the file hash and name for threat intelligence correlation
+3. Check if the same file was delivered to other internal systems
+4. Verify ATP policies are properly configured and up to date
+5. Consider blocking the source IP at the perimeter if confirmed malicious
+6. Document the incident and update threat intelligence feeds
+', '["https://www.sonicwall.com/support/knowledge-base/capture-atp-overview/170503785055490","https://attack.mitre.org/techniques/T1204/"]', '(contains("log.msg", "Capture ATP") || contains("log.msg", "Gateway Anti-Virus") || contains("log.msg", "Sandbox") || equals("log.category", "Anti-Virus") || equals("log.af_type", "ATP")) && (contains("log.msg", "malicious") || contains("log.msg", "blocked") || contains("log.msg", "threat detected") || equals("log.result", "malicious") || equals("action", "blocked"))', '2026-02-09 16:53:33.947017', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":2}]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (543, 'SonicWall Capture Client Threat Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects threats identified by SonicWall Capture Client including advanced malware, zero-day exploits, and sophisticated attack techniques. Capture Client provides advanced threat protection through sandboxing and behavioral analysis.
+
+Next Steps:
+1. Immediately isolate the affected host to prevent lateral movement
+2. Review the specific threat details in SonicWall management console
+3. Analyze the malware sample if available for attribution and IOCs
+4. Check for any successful file downloads or executions on the host
+5. Scan the host with updated antivirus signatures
+6. Review network traffic for any data exfiltration attempts
+7. Update security policies if new attack vectors are identified
+', '["https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf","https://attack.mitre.org/techniques/T1055/"]', '(contains("log.msg", "Capture Client") || contains("log.app", "Capture") || contains("log.category", "Capture")) && (exists("log.ipscat") || exists("log.ipspri") || exists("log.dpi") || equals("log.action", "drop"))', '2026-02-09 16:53:34.087590', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (544, 'SonicWall Encrypted Threats Detection', 3, 3, 2, 'Command and Control', 'T1573 - Encrypted Channel', 'Detects threats hidden in encrypted traffic identified by SonicWall DPI-SSL (Deep Packet Inspection of SSL/TLS) including malware, exploits, and data exfiltration attempts over encrypted channels. This rule identifies when SonicWall''s advanced threat protection has detected malicious activity within encrypted communications.
+
+Next Steps:
+1. Review the specific threat type and category identified in the event details
+2. Examine the source and destination IP addresses for indicators of compromise
+3. Check the SSL/TLS certificate details and validation status
+4. Investigate the application or service attempting the encrypted communication
+5. Review network traffic patterns to identify potential data exfiltration
+6. Consider temporarily blocking the source IP if malicious activity is confirmed
+7. Update security policies to prevent similar encrypted threats
+8. Document findings for threat intelligence and future prevention
+', '["https://www.sonicwall.com/solutions/advanced-threats/encrypted-threats/","https://attack.mitre.org/techniques/T1573/"]', '(contains("log.eventName", "SSL") || contains("log.eventName", "TLS") || contains("log.eventName", "encrypted") || contains("log.eventName", "DPI-SSL") || contains("log.message", "SSL") || contains("log.message", "TLS") || contains("log.message", "encrypted") || contains("protocol", "SSL") || contains("protocol", "TLS")) &&
+(contains("log.eventName", "threat") || contains("log.eventName", "malware") || contains("log.eventName", "blocked") || contains("log.eventName", "violation") || contains("log.message", "threat") || contains("log.message", "malware") || contains("log.message", "blocked") || equals("log.result", "blocked") || equals("action", "blocked") || exists("log.ipscat") || exists("log.spycat"))
+', '2026-02-09 16:53:34.247577', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (545, 'SonicWall Gateway Anti-Virus Detection', 3, 3, 2, 'Command and Control', 'T1105 - Ingress Tool Transfer', 'Detects when SonicWall Gateway Anti-Virus (GAV) identifies and blocks malicious content. This indicates potential malware attempting to enter the network through web traffic, email attachments, or file downloads. The Gateway Anti-Virus service scans HTTP, HTTPS, FTP, and SMTP traffic in real-time to detect and prevent malware from entering the network perimeter.
+
+Next Steps:
+1. Review the specific malware signature or threat name in the log details
+2. Investigate the source IP address and geolocation for suspicious patterns
+3. Check if the same source has attempted other malicious activities
+4. Verify that the anti-virus definitions are up to date
+5. Consider implementing additional network segmentation if internal hosts are affected
+6. Review firewall policies to ensure proper traffic filtering
+7. Escalate to incident response team if part of a coordinated attack campaign
+', '["https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf","https://attack.mitre.org/techniques/T1105/"]', '(contains("log.gcat", "Gateway Anti-Virus") ||
+ contains("log.message", "virus") ||
+ contains("log.message", "malware") ||
+ contains("log.eventName", "Anti-Virus") ||
+ contains("log.category", "Anti-Virus")) &&
+equals("action", "blocked")
+', '2026-02-09 16:53:34.411970', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":3}]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (546, 'SonicWall Intrusion Prevention System Alert', 3, 3, 3, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects when SonicWall IPS identifies and blocks intrusion attempts, including buffer overflows, SQL injection, cross-site scripting, and other network-based attacks targeting vulnerabilities. This rule triggers when the SonicWall firewall''s Intrusion Prevention System detects malicious traffic patterns or known attack signatures.
+
+Next Steps:
+1. Verify the blocked attack by reviewing the SonicWall logs for attack details and signatures matched
+2. Check if the attack was successfully blocked or if any traffic bypassed the IPS
+3. Investigate the source IP for additional malicious activity or patterns
+4. Review target systems for any signs of compromise if the attack was not fully blocked
+5. Update IPS signatures if new attack patterns are discovered
+6. Consider implementing additional network segmentation if attacks are targeting critical systems
+7. Review and update security policies if necessary to prevent similar attacks
+', '["https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf","https://attack.mitre.org/techniques/T1190/"]', '(exists("log.ipscat") ||
+ contains("log.message", "IPS") ||
+ contains("log.eventName", "Intrusion") ||
+ contains("log.category", "Intrusion Prevention") ||
+ (exists("log.ipspri") && !equals("log.ipspri", "0"))) &&
+(equals("action", "blocked") || equals("log.fw_action", "drop"))
+', '2026-02-09 16:53:34.517699', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (547, 'SonicWall Management Interface Authentication Failures', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects multiple failed authentication attempts to the SonicWall management interface, indicating potential brute force attacks against administrative credentials.
+
+Next Steps:
+1. Investigate the source IP address attempting authentication
+2. Check if the source IP is from an authorized management network
+3. Review for successful logins from the same IP after failures
+4. Consider blocking the source IP on the management interface
+5. Restrict management access to specific IP addresses
+6. Enable account lockout and two-factor authentication
+', '["https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf","https://attack.mitre.org/techniques/T1110/"]', '((contains("log.message", ["admin", "management", "login"]) &&
+ contains("log.message", ["fail", "denied", "invalid", "incorrect"])) ||
+ contains("log.eventName", ["Administrator login failed", "Login failure"]) ||
+ contains("log.category", "Authentication Access")) &&
+exists("origin.ip")
+', '2026-02-09 16:53:34.693327', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (548, 'pfSense WebGUI Authentication Brute Force', 3, 3, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects multiple failed WebGUI authentication attempts on pfSense firewalls, indicating potential brute force attacks against the administrative interface.
+
+Next Steps:
+1. Review the source IP and check if it is from an authorized management network
+2. Check for successful logins from the same IP following the failures
+3. Verify the targeted admin account exists and review its access level
+4. Consider blocking the source IP on the management interface
+5. Restrict WebGUI access to specific management networks
+6. Enable anti-lockout rules and consider implementing CAPTCHA
+', '["https://docs.netgate.com/pfsense/en/latest/monitoring/logs/index.html","https://attack.mitre.org/techniques/T1110/"]', '(regexMatch("raw", "(?i)(webconfigurator.*authentication.*error|login.*failed|authentication.*failure|invalid.*login)") ||
+ regexMatch("log.csvMsg", "(?i)(webconfigurator.*authentication.*error|login.*failed|authentication.*failure|invalid.*login)") ||
+ contains("log.eventType", "sshguard")) &&
+exists("origin.ip")
+', '2026-02-09 16:53:34.823146', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-pfsense-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (549, 'SonicWall Zero-Day Threat Detection', 3, 3, 3, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects zero-day threats and unknown malware identified by SonicWall Capture ATP service including sandbox detonations and RTDMI (Real-Time Deep Memory Inspection) alerts. This rule triggers when the SonicWall firewall identifies previously unknown threats through advanced analysis techniques.
+
+Next Steps:
+1. Immediately isolate the affected system from the network if possible
+2. Review the full event details including file hashes, URLs, and source IPs
+3. Check if the threat was successfully blocked or if additional containment is needed
+4. Update threat intelligence feeds and IOCs based on the detected indicators
+5. Perform forensic analysis on any systems that may have been compromised
+6. Review firewall rules and security policies to ensure adequate protection
+7. Document the incident and update incident response procedures if necessary
+', '["https://www.sonicwall.com/support/knowledge-base/capture-advanced-threat-protection-feature-overview/170504863294345","https://attack.mitre.org/techniques/T1190/"]', '(contains("log.eventName", "ATP") || contains("log.eventName", "zero-day") || contains("log.eventName", "unknown") || contains("log.eventName", "sandbox") || contains("log.eventName", "RTDMI") || contains("log.message", "ATP") || contains("log.message", "zero-day") || contains("log.message", "unknown malware") || contains("log.message", "sandbox")) &&
+(contains("log.eventName", "detected") || contains("log.eventName", "blocked") || contains("log.message", "detected") || contains("log.message", "blocked") || equals("log.result", "blocked") || equals("action", "blocked") || equals("log.severity", "critical") || equals("log.severity", "high"))
+', '2026-02-09 16:53:34.972825', true, false, 'origin', null, '[]', '["adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (550, 'SonicWall SSL VPN Authentication Failures', 3, 2, 1, 'Credential Access', 'T1133 - External Remote Services', 'Detects multiple SSL VPN authentication failures from the same source IP on SonicWall firewalls, indicating brute force or credential stuffing attacks against remote access services.
+
+Next Steps:
+1. Investigate the source IP and check threat intelligence databases
+2. Verify if the targeted user accounts exist and are active
+3. Check for successful VPN connections from the same IP
+4. Consider geo-restricting VPN access
+5. Enable MFA for VPN access if not already configured
+6. Block the source IP if confirmed malicious
+', '["https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf","https://attack.mitre.org/techniques/T1133/"]', '((contains("log.message", ["VPN", "SSL-VPN", "NetExtender"]) &&
+ contains("log.message", ["fail", "denied", "invalid", "rejected"])) ||
+ contains("log.eventName", ["VPN login failed", "SSL VPN authentication failed"]) ||
+ contains("log.category", "VPN Access")) &&
+exists("origin.ip")
+', '2026-02-09 16:53:35.127681', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sonicwall-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (551, 'CEF Source Impersonation Detection', 2, 3, 1, 'Defense Evasion', 'T1036 - Masquerading', 'Detects CEF messages with spoofed device vendor or product fields that could indicate an attacker injecting false security events or masquerading as a trusted security device to inject malicious log data.
+
+Next Steps:
+1. Verify the source IP matches the claimed device vendor/product
+2. Check if the CEF header fields are consistent with known devices
+3. Compare against the device inventory for the source IP
+4. Investigate the source system for signs of compromise
+5. Implement CEF source validation in the log pipeline
+6. Block unauthorized CEF sources at the network level
+', '["https://www.microfocus.com/documentation/arcsight/arcsight-cef-23/","https://attack.mitre.org/techniques/T1036/"]', 'exists("origin.ip") &&
+exists("log.deviceVendor") &&
+exists("log.deviceProduct") &&
+(
+ (regexMatch("log.deviceVendor", "(?i)^(unknown|test|debug|hack|admin|null)$")) ||
+ (contains("log.deviceVendor", "<") || contains("log.deviceVendor", ">") || contains("log.deviceVendor", ";")) ||
+ (contains("log.deviceProduct", "<") || contains("log.deviceProduct", ">") || contains("log.deviceProduct", ";")) ||
+ (regexMatch("log.deviceVendor", ".*[|\\n\\r].*")) ||
+ (regexMatch("log.deviceProduct", ".*[|\\n\\r].*"))
+)
+', '2026-02-09 16:53:35.281978', true, false, 'origin', null, '[{"indexPattern":"v11-log-syslog-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":5}]', '["lastEvent.log.deviceVendor","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (552, 'CEF User Agent Anomaly Detection', 2, 2, 1, 'Command and Control', 'T1071.001 - Application Layer Protocol: Web Protocols', 'Detects anomalous user agent strings in CEF logs that may indicate malicious scripts, bots, vulnerability scanners, or attempts to bypass security controls through user agent spoofing. This rule identifies known attack tools, template injection attempts, and unusually short or long user agent strings.
+
+Next Steps:
+1. Investigate the source IP address for additional suspicious activities
+2. Review the specific URLs and resources accessed by this user agent
+3. Check for other security events from the same IP address in recent timeframes
+4. Analyze the request patterns to determine if automated scanning is occurring
+5. Consider blocking the source IP if confirmed malicious
+6. Review web application logs for potential exploitation attempts
+7. Validate if the user agent represents legitimate automation tools
+', '["https://attack.mitre.org/techniques/T1071/001/","https://learn.microsoft.com/en-us/azure/sentinel/cef-name-mapping"]', 'equals("log.dataType", "cef") &&
+exists("log.requestClientApplication") &&
+(
+ regexMatch("log.requestClientApplication", "(?i)sqlmap") ||
+ regexMatch("log.requestClientApplication", "(?i)nikto") ||
+ regexMatch("log.requestClientApplication", "(?i)havij") ||
+ regexMatch("log.requestClientApplication", "(?i)acunetix") ||
+ regexMatch("log.requestClientApplication", "(?i)nessus") ||
+ regexMatch("log.requestClientApplication", "(?i)metasploit") ||
+ contains("log.requestClientApplication", "${") ||
+ contains("log.requestClientApplication", "{{")
+)
+', '2026-02-09 16:53:35.442215', true, false, 'origin', null, '[{"indexPattern":"v11-log-syslog-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-1h","count":10}]', '["lastEvent.log.requestClientApplication","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (553, 'ESXi Local Account Manipulation Detection', 3, 3, 2, 'Persistence', 'T1098 - Account Manipulation', 'Detects creation or modification of local ESXi user accounts. Attackers create backdoor accounts on ESXi hosts for persistent access, or modify existing accounts to escalate privileges.
+
+Next Steps:
+1. Verify if the user account change was authorized
+2. Review the new account''s permissions and roles
+3. Check for any new administrator-level accounts
+4. Remove unauthorized accounts immediately
+5. Reset passwords for compromised accounts
+6. Implement centralized authentication (Active Directory integration)
+', '["https://kb.vmware.com/s/article/1006530","https://attack.mitre.org/techniques/T1098/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "vim-cmd vimsvc/auth/") && (
+ contains("log.message", "entity_permission_add") ||
+ contains("log.message", "entity_permission_update")
+ )) ||
+ (contains("log.message", "useradd") || contains("log.message", "usermod") || contains("log.message", "userdel")) ||
+ (contains("log.message", "esxcli system account") && (
+ contains("log.message", "add") ||
+ contains("log.message", "set")
+ )) ||
+ (contains("log.message", "permission") && contains("log.message", "Admin") && (
+ contains("log.message", "added") || contains("log.message", "granted")
+ ))
+)
+', '2026-02-09 16:53:35.582520', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (554, 'ESXi Virtual Disk Theft Detection', 3, 1, 1, 'Collection', 'T1005 - Data from Local System', 'Detects potential theft of virtual machine disk files (.vmdk) through Datastore Browser downloads, SCP transfers, or unauthorized vmkfstools operations. Attackers exfiltrate VMDK files to obtain complete system images.
+
+Next Steps:
+1. Identify the user and source accessing the VMDK files
+2. Verify if the file access was authorized
+3. Review network traffic for large data transfers
+4. Check datastore browser access logs
+5. Restrict datastore access permissions
+6. Implement file integrity monitoring on datastores
+', '["https://attack.mitre.org/techniques/T1005/"]', 'exists("log.message") &&
+(
+ (contains("log.message", ".vmdk") && (
+ contains("log.message", "download") ||
+ contains("log.message", "GET /folder/") ||
+ contains("log.message", "scp") ||
+ contains("log.message", "cp ")
+ )) ||
+ (contains("log.message", "vmkfstools") && (
+ contains("log.message", "-i") ||
+ contains("log.message", "--clonevirtualdisk") ||
+ contains("log.message", "-X") ||
+ contains("log.message", "--exportvirtualdisk")
+ )) ||
+ (contains("log.message", "Datastore") && contains("log.message", "browse") && contains("log.message", ".vmdk"))
+)
+', '2026-02-09 16:53:35.732606', true, false, 'origin', null, '[]', '["adversary.hostname","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (555, 'ESXi Firewall Rule Modification Detection', 2, 3, 2, 'Defense Evasion', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'Detects modifications to ESXi firewall ruleset configurations using esxcli network firewall commands. Attackers modify firewall rules to enable outbound connections for C2 communication or to expose management interfaces.
+
+Next Steps:
+1. Review the specific firewall rule changes
+2. Verify the changes were authorized maintenance operations
+3. Check if new inbound or outbound rules were added
+4. Restore default firewall rules if unauthorized
+5. Investigate what traffic the rule changes would allow
+6. Monitor network traffic for newly allowed connections
+', '["https://kb.vmware.com/s/article/2008226","https://attack.mitre.org/techniques/T1562/004/"]', 'exists("log.message") &&
+(
+ contains("log.message", "esxcli network firewall") ||
+ (contains("log.message", "firewall") && contains("log.message", "ruleset")) ||
+ contains("log.message", "esxcli network firewall set --enabled false") ||
+ (contains("log.message", "firewall") && (
+ contains("log.message", "allowedip add") ||
+ contains("log.message", "set --allowed-all true") ||
+ contains("log.message", "set --enabled")
+ )) ||
+ (contains("log.message", "iptables") && exists("origin.hostname"))
+)
+', '2026-02-09 16:53:35.882889', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (556, 'ESXi Host Compromise Indicators', 3, 3, 3, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects indicators of ESXi host compromise including ransomware preparation activities, suspicious file operations on virtual machines, logging tampering, and abnormal system changes. Monitors for encryption tools, VM power operations, and file system modifications.
+
+Next Steps:
+1. Immediately isolate the affected ESXi host from the network to prevent lateral movement
+2. Review all virtual machines on the host for signs of encryption or corruption
+3. Check VM snapshots and backups to determine if they have been deleted or tampered with
+4. Examine ESXi logs for unauthorized administrative access or configuration changes
+5. Verify the integrity of the ESXi management interface and SSH access logs
+6. Review network traffic from the ESXi host for unusual outbound connections
+7. Check for presence of ransomware files or encryption tools on the host filesystem
+8. Validate ESXi user accounts and permissions for unauthorized modifications
+9. Assess the impact on running VMs and determine if immediate shutdown is necessary
+10. Contact incident response team and consider engaging VMware support for forensic analysis
+', '["https://www.forescout.com/blog/vmware-esxi-servers-a-major-attack-vector-for-ransomware/","https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass","https://attack.mitre.org/techniques/T1059/"]', '(contains("log.message", "encrypt.sh") ||
+ (contains("log.message", "encrypt") && !contains("log.message", "TLS") && !contains("log.message", "SSL")) ||
+ contains("log.message", "esxcli vm process list") ||
+ contains("log.message", "esxcli vm process kill") ||
+ contains("log.message", "Device I/O error") ||
+ contains("log.message", "Medium Error Detected") ||
+ contains("log.message", "Uncorrectable error in data") ||
+ contains("log.message", "Disk error detected") ||
+ contains("log.message", "Unable to read partition table") ||
+ contains("log.message", "logging service disabled") ||
+ contains("log.message", "log events removed") ||
+ (equals("log.process", "vmkernel") && contains("log.message", "SCSI sense")) ||
+ (contains("log.eventInfo", "ransom") || contains("log.eventInfo", "encrypt"))) &&
+exists("origin.hostname")
+', '2026-02-09 16:53:36.012767', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (557, 'ESXi Ransomware Attack Detection', 3, 3, 3, 'Impact', 'T1486 - Data Encrypted for Impact', 'Detects ESXi ransomware attack patterns including mass VM shutdown, VMDK encryption indicators, suspicious script execution, and deletion of VM snapshots. ESXiArgs and similar ransomware families target ESXi hosts to encrypt virtual machine disk files.
+
+Next Steps:
+1. Immediately isolate the ESXi host from the network
+2. Check if VMs are shutting down or being encrypted
+3. Verify snapshot and backup integrity
+4. Do NOT power on encrypted VMs
+5. Preserve forensic evidence before recovery attempts
+6. Contact incident response team immediately
+', '["https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a","https://attack.mitre.org/techniques/T1486/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "vim-cmd vmsvc/power.off") || contains("log.message", "esxcli vm process kill")) ||
+ (contains("log.message", "openssl") && contains("log.message", "enc")) ||
+ (contains("log.message", ".vmdk") && (contains("log.message", "encrypt") || contains("log.message", "openssl"))) ||
+ (contains("log.message", "encrypt.sh") || contains("log.message", "encrypt.py")) ||
+ (contains("log.message", "esxcli vm process list") && contains("log.message", "kill")) ||
+ (contains("log.message", "snapshot") && contains("log.message", "removeall")) ||
+ (contains("log.message", ".vmx") && contains("log.message", "removed")) ||
+ contains("log.message", "ransom") ||
+ (contains("log.message", "chmod") && contains("log.message", "+x") && contains("log.message", ".sh"))
+)
+', '2026-02-09 16:53:36.167390', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (558, 'ESXi Syslog Forwarding Disruption Detection', 1, 3, 2, 'Defense Evasion', 'T1562.002 - Impair Defenses: Disable Windows Event Logging', 'Detects attempts to disable or modify ESXi syslog forwarding to prevent security monitoring. Attackers disable syslog to operate without detection by the SIEM.
+
+Next Steps:
+1. Verify the syslog configuration change was authorized
+2. Re-enable syslog forwarding immediately if unauthorized
+3. Check for suspicious activity during the logging gap
+4. Review ESXi host for signs of compromise
+5. Implement monitoring for syslog service status
+6. Restrict access to syslog configuration
+', '["https://kb.vmware.com/s/article/2003322","https://attack.mitre.org/techniques/T1562/002/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "esxcli system syslog") && (
+ contains("log.message", "config set") ||
+ contains("log.message", "reload") ||
+ contains("log.message", "--loghost")
+ )) ||
+ (contains("log.message", "syslog") && contains("log.message", "stopped")) ||
+ (contains("log.message", "vmsyslogd") && contains("log.message", "terminated")) ||
+ (contains("log.message", "syslog") && contains("log.message", "disabled")) ||
+ (contains("log.message", "Syslog.global.logHost") && contains("log.message", "changed"))
+)
+', '2026-02-09 16:53:36.302635', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (559, 'ESXi Unsigned VIB Installation Detection', 3, 3, 3, 'Persistence', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 'Detects installation of unsigned or community-supported VIB (vSphere Installation Bundle) packages on ESXi hosts. APT groups use malicious VIBs for persistent backdoor access to hypervisors that survive reboots and updates.
+
+Next Steps:
+1. Review the installed VIB package details and acceptance level
+2. Verify the VIB was from an authorized VMware or vendor source
+3. Check for any changes to ESXi acceptance level (CommunitySupported)
+4. Examine the VIB contents for malicious payloads
+5. Remove unauthorized VIBs immediately
+6. Reset ESXi acceptance level to PartnerSupported or VMwareCertified
+', '["https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence","https://attack.mitre.org/techniques/T1195/002/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "esxcli software vib install") || contains("log.message", "esxcli software vib update")) ||
+ (contains("log.message", "VIB") && (contains("log.message", "installed") || contains("log.message", "Install"))) ||
+ (contains("log.message", "acceptance level") && contains("log.message", "CommunitySupported")) ||
+ contains("log.message", "--force --no-sig-check") ||
+ (contains("log.message", "esxcli software acceptance") && contains("log.message", "set"))
+)
+', '2026-02-09 16:53:36.451904', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (560, 'CEF File Hash Mismatch Detection', 3, 3, 2, 'Impact', 'T1565.001 - Data Manipulation: Stored Data Manipulation', 'Detects file hash mismatches in CEF logs which may indicate file tampering, malware infection, or unauthorized modifications to critical files. This rule monitors custom string fields (cs1-cs6) for hash values and their labels, as well as dedicated hash fields to identify discrepancies.
+
+**Next Steps:**
+1. Verify the affected file integrity by recalculating its hash
+2. Check if the file modification was authorized and documented
+3. Investigate the source and timing of the file change
+4. Review system logs for unauthorized access or malware activity
+5. Compare with known good file versions or backups
+6. If malicious activity is confirmed, isolate the affected system and initiate incident response procedures
+', '["https://attack.mitre.org/techniques/T1565/001/","https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-8.4/pdfdoc/cef-implementation-standard/cef-implementation-standard.pdf"]', 'equals("log.dataType", "cef") &&
+(
+ (oneOf("log.cs1Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs1") && contains("log.message", "mismatch")) ||
+ (oneOf("log.cs2Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs2") && contains("log.message", "mismatch")) ||
+ (oneOf("log.cs3Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs3") && contains("log.message", "mismatch")) ||
+ (oneOf("log.cs4Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs4") && contains("log.message", "mismatch")) ||
+ (oneOf("log.cs5Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs5") && contains("log.message", "mismatch")) ||
+ (oneOf("log.cs6Label", ["hash", "fileHash", "md5", "sha1", "sha256"]) && exists("log.cs6") && contains("log.message", "mismatch")) ||
+ (exists("log.fileHash") && contains("log.message", "mismatch")) ||
+ (exists("log.oldFileHash") && exists("log.fileHash") && safe(log.oldFileHash, "") != safe(log.fileHash, "")) ||
+ contains("log.message", "hash mismatch") ||
+ contains("log.message", "checksum failure") ||
+ contains("log.message", "integrity violation")
+)
+', '2026-02-09 16:53:36.587497', true, false, 'origin', null, '[]', '["lastEvent.log.fname","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (561, 'VMware ESXi Hypervisor Escape Attempt Detection', 3, 3, 3, 'Privilege Escalation', 'T1611 - Escape to Host', 'Detects potential hypervisor escape attempts through suspicious VMX process activity, abnormal privilege escalation, or unauthorized access to host resources from guest VMs. This rule identifies various indicators of compromise including CVE-2024-37085 exploitation, VMCI backdoor attempts, and unauthorized vpxuser activities.
+
+Next Steps:
+1. Immediately isolate the affected ESXi host from the network to prevent lateral movement
+2. Review VMX process logs and system calls for evidence of escape attempts
+3. Check for unauthorized changes to virtual machine configurations
+4. Examine guest VM activities and processes for signs of compromise
+5. Verify integrity of hypervisor files and configurations
+6. Review security patches and ensure latest ESXi updates are applied
+7. Analyze network traffic for data exfiltration or command and control communications
+8. Consider forensic imaging of affected virtual machines before remediation
+', '["https://attack.mitre.org/techniques/T1611/","https://www.usenix.org/system/files/woot19-paper_zhao.pdf","https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-F35D7005-58EB-48AC-99D5-B9942EB2A8EF.html"]', '(regexMatch("log.message", "(?i)(vmx|vmware-vmx)") && regexMatch("log.message", "(?i)(escape|breakout|privilege|escalat|host access|unauthorized)")) ||
+(regexMatch("log.process", "(?i)vmx") && equals("severity", "error")) ||
+(regexMatch("log.message", "(?i)vpxuser") && regexMatch("log.message", "(?i)(failed|denied|unauthorized)")) ||
+(regexMatch("log.message", "(?i)CVE-2024-37085")) ||
+(regexMatch("log.message", "(?i)VMCI") && regexMatch("log.message", "(?i)(backdoor|socket|unauthorized)"))
+', '2026-02-09 16:53:36.972688', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (562, 'ESXi Direct SSH Login Detection', 3, 3, 2, 'Remote Access', 'T1021.004 - Remote Services: SSH', 'Detects direct SSH login to ESXi hosts, which is a security concern as ESXi management should primarily be done through vCenter. Direct SSH access is commonly used by attackers for ransomware deployment and post-exploitation activities.
+
+Next Steps:
+1. Verify the SSH login was from an authorized administrator
+2. Check if SSH was enabled as part of authorized maintenance
+3. Review commands executed during the SSH session
+4. Disable SSH access after maintenance is complete
+5. Implement SSH access controls and key-based authentication
+6. Monitor for post-login suspicious activity
+', '["https://kb.vmware.com/s/article/1017910","https://attack.mitre.org/techniques/T1021/004/"]', 'exists("log.message") &&
+(
+ (contains("log.message", "SSH") && contains("log.message", "login")) ||
+ (contains("log.message", "sshd") && contains("log.message", "Accepted")) ||
+ (contains("log.message", "SSH session") && contains("log.message", "opened")) ||
+ (contains("log.message", "SSH") && contains("log.message", "enabled")) ||
+ (contains("log.message", "ssh") && contains("log.message", "connection from"))
+)
+', '2026-02-09 16:53:37.087309', true, false, 'origin', null, '[]', '["adversary.hostname","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (563, 'PowerCLI Script Execution Detection', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects PowerCLI script execution on VMware ESXi hosts by monitoring for authentication events and command execution patterns associated with MS Web Services Client Protocol, which is unique to PowerCLI connections. PowerCLI is VMware''s powerful command-line tool that can be used by attackers to perform reconnaissance, lateral movement, or persistence on virtualized infrastructure.
+
+Next Steps:
+1. Verify if the PowerCLI activity is authorized by checking with the VMware administrators
+2. Review the source IP address and user account to determine if they are legitimate
+3. Check for any suspicious commands or configuration changes made through PowerCLI
+4. Review ESXi audit logs for any unauthorized changes to VM configurations or host settings
+5. If unauthorized, immediately revoke access and investigate the scope of potential compromise
+6. Consider implementing stricter access controls and monitoring for PowerCLI usage
+', '["https://attack.mitre.org/techniques/T1059/","https://blogs.vmware.com/vsphere/2013/07/capturing-logins-to-esxi-by-a-root-account.html"]', 'regexMatch("log.message", "(?i)MS Web Services Client Protocol") ||
+(regexMatch("log.message", "(?i)authentication of user") && regexMatch("log.message", "(?i)PowerCLI")) ||
+(regexMatch("log.process", "(?i)vimsvc") && regexMatch("log.message", "(?i)Auth") && regexMatch("log.message", "(?i)User")) ||
+(regexMatch("log.message", "(?i)Syslog\\.global\\.log") && regexMatch("log.message", "(?i)Set-VMHost")) ||
+regexMatch("log.message", "(?i)Get-VMHostSysLogServer")
+', '2026-02-09 16:53:37.252131', true, false, 'origin', null, '[]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (564, 'VMware vCenter Server Attack Indicators', 3, 3, 3, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects potential attacks targeting vCenter Server including authentication anomalies, privilege escalation attempts, and suspicious command execution. Monitors for indicators of compromise such as unusual SSH enablement, service modifications, and administrative group changes.
+
+Next Steps:
+1. Immediately isolate the affected vCenter Server from the network
+2. Review authentication logs for suspicious login attempts
+3. Check for unauthorized SSH access or administrative privilege escalations
+4. Verify integrity of ESXi configurations and VIB installations
+5. Scan for indicators of ransomware or malware deployment
+6. Review network traffic for lateral movement attempts
+7. Implement emergency access controls and change administrative passwords
+8. Contact VMware security team if vulnerability exploitation is suspected
+', '["https://us-cert.cisa.gov/ncas/alerts/aa22-138b","https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html","https://attack.mitre.org/techniques/T1190/"]', '(contains("log.message", "SSH enabled") ||
+ contains("log.message", "esxcli") ||
+ contains("log.message", "openssl enc") ||
+ contains("log.message", "VMware admins") ||
+ contains("log.message", "ESX admins") ||
+ contains("log.message", "virtualization admins") ||
+ contains("log.message", "storage admins") ||
+ contains("log.message", "password reset") ||
+ contains("log.message", "VIB install") ||
+ contains("log.message", "authentication failed") ||
+ (equals("log.process", "vpxd") && equals("severity", "error"))) &&
+exists("origin.hostname")
+', '2026-02-09 16:53:37.392349', true, false, 'origin', null, '[{"indexPattern":"v11-log-vmware-esxi-*","with":[{"field":"origin.hostname","operator":"filter_term","value":"{{origin.hostname}}"}],"or":null,"within":"now-30m","count":5}]', '["adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (565, 'Virtual Machine Escape Detection', 3, 3, 3, 'Privilege Escalation', 'T1611 - Escape to Host', 'Detects VM escape attempts through abnormal guest operations, suspicious VMware Tools activity, or attempts to access host resources from guest VMs. VM escape is a critical security event where an attacker breaks out of virtual machine containment to access the hypervisor or host system.
+
+Next Steps:
+1. Immediately isolate the affected virtual machine from the network
+2. Review VMware ESXi host logs for additional suspicious activities
+3. Check for unauthorized VIB installations or modifications
+4. Verify VMware Tools integrity and version on affected VMs
+5. Scan the VM for malware and examine running processes
+6. Review VM configuration files for unauthorized changes
+7. Update VMware ESXi to latest security patches
+8. Consider forensic analysis of the VM if compromise is confirmed
+', '["https://attack.mitre.org/techniques/T1611/","https://www.csoonline.com/article/3837874/vmware-esxi-gets-critical-patches-for-in-the-wild-virtual-machine-escape-attack.html","https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html"]', '(regexMatch("log.message", "(?i)guest.*(operation|ops)") && regexMatch("log.message", "(?i)(failed|denied|error|unauthorized)")) ||
+(regexMatch("log.message", "(?i)vmware.*tools") && regexMatch("log.message", "(?i)(exploit|malicious|unauthorized|abnormal)")) ||
+(regexMatch("log.message", "(?i)(vmdk|vswp)") && regexMatch("log.message", "(?i)(modify|rename|delete)") && !regexMatch("log.process", "(?i)(vmware|esxcli)")) ||
+(regexMatch("log.message", "(?i)vib.*install") && regexMatch("log.message", "(?i)(malicious|unsigned|failed)")) ||
+(regexMatch("log.eventInfo", "(?i)(vm.*escape|breakout|containment.*breach)"))
+', '2026-02-09 16:53:37.782344', true, false, 'origin', null, '[]', '["lastEvent.log.process","adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (653, 'Windows: NTDS or SAM Database File Copied', 3, 3, 3, 'Credential Access', 'T1003.002 - OS Credential Dumping: Security Account Manager', 'Identifies a copy operation of the Active Directory Domain Database or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and local credentials.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/","https://attack.mitre.org/techniques/T1003/002/"]', 'regexMatch("log.winlogEventDataProcessName", "(?i)(cmd\\.exe|powershell\\.exe|xcopy\\.exe|esentutl\\.exe)") && regexMatch("log.message", "(copy|xcopy|Copy-Item|move|cp|mv|/y|/vss|/d)") && regexMatch("log.message", "(\\ntds.dit|\\config\\SAM|\\(.+)\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy(.+)\\|/system32/config/SAM)")', '2026-02-09 16:57:22.802134', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (566, 'VMware Tools Vulnerability Exploitation', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Detects potential exploitation of VMware Tools vulnerabilities by monitoring for suspicious authentication events, command execution patterns, and error messages related to VMware Tools operations. VMware Tools vulnerabilities can be exploited to gain unauthorized access to virtual machines or escalate privileges within the virtualized environment.
+
+Next Steps:
+1. Immediately isolate the affected ESXi host or virtual machine
+2. Check VMware Tools version and compare against known vulnerable versions
+3. Review authentication logs for signs of unauthorized access attempts
+4. Examine process execution logs around the time of the alert
+5. Verify the integrity of VMware Tools installation and configuration
+6. Update VMware Tools to the latest secure version if vulnerabilities are confirmed
+7. Review network traffic to and from the affected system for indicators of compromise
+8. Check for lateral movement attempts from the compromised system
+', '["https://attack.mitre.org/techniques/T1190/","https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-F35D7005-58EB-48AC-99D5-B9942EB2A8EF.html"]', '(regexMatch("log.message", "(?i)vmware tools") && equals("severity", "error")) ||
+(regexMatch("log.message", "(?i)authentication of user") && regexMatch("log.message", "(?i)failed")) ||
+(regexMatch("log.message", "(?i)LW_ERROR_PASSWORD_MISMATCH")) ||
+(regexMatch("log.message", "(?i)Cannot login") && regexMatch("log.process", "(?i)vmtoolsd")) ||
+(regexMatch("log.message", "(?i)rejected password for user")) ||
+(regexMatch("log.message", "(?i)vmtoolsd") && regexMatch("log.message", "(?i)exploit"))
+', '2026-02-09 16:53:37.877370', true, false, 'origin', null, '[{"indexPattern":"v11-log-vmware-esxi-*","with":[{"field":"origin.hostname","operator":"filter_term","value":"{{origin.hostname}}"}],"or":null,"within":"now-15m","count":5}]', '["adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (567, 'vSphere API Abuse Detection', 3, 3, 2, 'Lateral Movement', 'T1210 - Exploitation of Remote Services', 'Detects potential vSphere API abuse including unauthorized access attempts, suspicious API calls, and exploitation attempts. Monitors for authentication failures, unusual vpxuser activity, and rapid API requests that could indicate compromise or abuse of VMware vSphere infrastructure.
+
+Next Steps:
+1. Investigate the source IP and hostname making the suspicious API calls
+2. Review vCenter Server logs for additional context around the time of the alert
+3. Check for any concurrent authentication events or privilege escalation attempts
+4. Verify if the vpxuser account is being used inappropriately for shell access or commands
+5. Examine network traffic patterns to identify potential automated attack tools
+6. Review recent changes to vSphere permissions and user accounts
+7. Check for any indicators of lateral movement or data exfiltration
+8. Consider temporarily blocking the source IP if malicious activity is confirmed
+', '["https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass","https://attack.mitre.org/techniques/T1210/"]', '(contains("log.message", "authentication of user") &&
+ (contains("log.message", "failed") ||
+ contains("log.message", "denied"))) ||
+(contains("log.message", "vpxuser") &&
+ (contains("log.message", "shell") ||
+ contains("log.message", "command"))) ||
+(equals("log.process", "vpxd") &&
+ (equals("severity", "error") ||
+ contains("log.message", "unauthorized") ||
+ contains("log.message", "permission denied"))) ||
+(contains("log.message", "API") &&
+ (contains("log.message", "abuse") ||
+ contains("log.message", "flood") ||
+ contains("log.message", "excessive")))
+', '2026-02-09 16:53:38.007127', true, false, 'origin', null, '[{"indexPattern":"v11-log-vmware-esxi-*","with":[{"field":"origin.hostname","operator":"filter_term","value":"{{origin.hostname}}"}],"or":null,"within":"now-5m","count":10}]', '["lastEvent.log.eventInfo","adversary.hostname"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (623, 'Shadow Credentials Attack Detection', 3, 3, 1, 'Credential Access', 'T1556 - Modify Authentication Process', 'Detects Shadow Credentials attacks where adversaries modify the msDS-KeyCredentialLink attribute
+on Active Directory objects to add their own key credentials for passwordless authentication.
+This enables attackers to authenticate as the target account without knowing the password,
+effectively taking over the account. The rule monitors Event ID 5136 (directory service object
+modification) and Event ID 4662 (object access) for msDS-KeyCredentialLink changes.
+
+Next Steps:
+1. Identify the account whose msDS-KeyCredentialLink was modified
+2. Check if the modification was done by an authorized admin or service
+3. Examine the added key credential for malicious certificates
+4. Remove unauthorized key credentials from the affected account
+5. Reset the password for the affected account
+6. Review who has write access to the msDS-KeyCredentialLink attribute
+7. Audit all accounts for unauthorized key credential additions
+8. Investigate for related tools like Whisker or pyWhisker
+', '["https://attack.mitre.org/techniques/T1556/","https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab","https://github.com/eladshamir/Whisker"]', '(
+ equals("log.eventCode", "5136") &&
+ equals("log.winlogChannel", "Security") &&
+ contains("log.winlog.event_data.AttributeLDAPDisplayName", "msDS-KeyCredentialLink")
+) ||
+(
+ equals("log.eventCode", "4662") &&
+ equals("log.winlogChannel", "Security") &&
+ contains("log.winlog.event_data.Properties", "msDS-KeyCredentialLink") &&
+ !regexMatch("log.winlogEventDataSubjectUserName", "(?i)\\$$")
+)
+', '2026-02-09 16:55:35.012446', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (624, 'SID History Injection Attempt', 3, 3, 1, 'Defense Evasion, Privilege Escalation', 'T1134.005 - Access Token Manipulation: SID-History Injection', 'Detects attempts to add SID History to an account, which can be used for privilege escalation. SID History injection allows attackers to inherit permissions from privileged accounts without being members of privileged groups. Both successful (4765) and failed (4766) attempts are monitored.
+
+Next Steps:
+1. Immediately investigate the target user account and verify if SID History modification was legitimate
+2. Check if the user performing the action has proper administrative privileges for this operation
+3. Review the source SID being added to understand what permissions are being inherited
+4. Examine recent authentication logs for the target account to identify potential unauthorized access
+5. Verify Active Directory configuration and check for signs of domain controller compromise
+6. Consider resetting the target account password and removing unauthorized SID History entries
+7. Review domain administrator accounts and privileged group memberships for anomalies
+', '["https://attack.mitre.org/techniques/T1134/005/","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4765","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4766","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4765"]', 'oneOf("log.winlogEventId", ["4765", "4766"]) &&
+equals("log.winlogChannel", "Security")
+', '2026-02-09 16:55:35.146892', true, false, 'origin', null, '[]', '["adversary.user","target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (654, 'Windows: Potential Credential Access via Trusted Developer Utility', 2, 2, 3, 'Credential Access', 'T1003 - OS Credential Dumping', 'An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'regexMatch("log.winlogEventDataProcessName", "(MSBuild.exe|msbuild.exe)") && regexMatch("log.message", "(vaultcli.dll|SAMLib.DLL)")', '2026-02-09 16:57:22.937330', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventDataProcessId","operator":"filter_term","value":"{{log.eventDataProcessId}}"}],"or":null,"within":"now-1m","count":1}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (568, 'ADFS Authentication Anomalies', 3, 2, 2, 'Defense Evasion, Persistence, Privilege Escalation, Initial Access', 'T1078 - Valid Accounts', 'Detects anomalous authentication attempts against Active Directory Federation Services (ADFS) including multiple failed attempts that could indicate password spraying or brute force attacks. This rule monitors for authentication failures, token validation failures, and other ADFS security events that may indicate malicious activity.
+
+Next Steps:
+1. Review the source IP address and determine if it''s from a known/trusted location
+2. Check for patterns of failed authentication attempts across multiple users
+3. Examine ADFS audit logs for additional context around the authentication failures
+4. Verify if the targeted user accounts are valid and active
+5. Consider implementing IP-based blocking if malicious activity is confirmed
+6. Review ADFS configuration for security hardening opportunities
+7. Correlate with other authentication events across the domain
+', '["https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging","https://attack.mitre.org/techniques/T1078/"]', 'equals("log.winlogProviderName", "AD FS") && (equals("log.winlogEventId", "411") || equals("log.winlogEventId", "342") || equals("log.winlogEventId", "516")) && contains("log.message", "token validation failed")', '2026-02-09 16:55:26.567792', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"}],"or":null,"within":"now-10m","count":10}]', '["adversary.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (569, 'AdminSDHolder Abuse Detection', 3, 3, 2, 'Persistence, Privilege Escalation', 'T1098 - Account Manipulation', 'Detects modifications to the AdminSDHolder object which can be used for persistence by granting elevated privileges. The SDProp process propagates these permissions to protected groups every 60 minutes, making this a critical security event.
+
+Next Steps:
+1. Immediately review the user account that performed the modification
+2. Check if the modification was authorized and part of legitimate administrative activities
+3. Examine the specific permissions that were changed on the AdminSDHolder object
+4. Monitor for privilege escalation activities in the next 60 minutes (SDProp cycle)
+5. Review all members of protected groups for unauthorized additions
+6. Audit recent administrative activities by the same user account
+7. Consider temporarily disabling the user account if unauthorized activity is suspected
+', '["https://attack.mitre.org/techniques/T1098/","https://adsecurity.org/?p=1906","https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory"]', 'oneOf("log.eventCode", ["4662", "5136", "4670"]) &&
+equals("log.winlogChannel", "Security") &&
+(
+ contains("log.winlog.event_data.ObjectName", "CN=AdminSDHolder,CN=System") ||
+ contains("log.winlog.event_data.ObjectDN", "CN=AdminSDHolder,CN=System")
+) &&
+(
+ oneOf("log.winlog.event_data.OperationType", ["Object Access", "Write Property"]) ||
+ oneOf("log.winlog.event_data.AccessMask", ["0x20000", "0x40000", "0x80000"]) ||
+ regexMatch("log.action", ".*Permissions.*changed.*")
+) &&
+!equals("log.winlogEventDataSubjectUserName", "SYSTEM")
+', '2026-02-09 16:55:26.727971', true, false, 'origin', null, '[]', '["lastEvent.log.winlog.event_data.ObjectName","lastEvent.log.winlogEventDataSubjectUserName"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (570, 'AMSI Bypass Detection', 3, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects attempts to bypass the Antimalware Scan Interface (AMSI) through PowerShell commands, DLL hijacking, or memory patching techniques. AMSI bypass is commonly used by attackers to evade detection when executing malicious PowerShell scripts or other code.
+
+Next Steps:
+1. Immediately isolate the affected host to prevent lateral movement
+2. Examine the full PowerShell script block text in Event ID 4104 for malicious content
+3. Review command line arguments in Event ID 4688 for suspicious PowerShell execution
+4. Check for additional indicators of compromise on the host
+5. Verify if legitimate administrative tools are being used or if this is malicious activity
+6. Review recent file modifications and process execution history
+7. Check for persistence mechanisms that may have been installed
+8. Consider reimaging the system if compromise is confirmed
+', '["https://attack.mitre.org/techniques/T1562/001/","https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal"]', '(equals("log.winlogEventId", "4104") &&
+ ((contains("log.winlogEventDataScriptBlockText", "[Ref].Assembly.GetType") &&
+ contains("log.winlogEventDataScriptBlockText", "amsi") &&
+ contains("log.winlogEventDataScriptBlockText", "SetValue")) ||
+ contains("log.winlogEventDataScriptBlockText", "AmsiUtils") ||
+ contains("log.winlogEventDataScriptBlockText", "amsiInitFailed") ||
+ contains("log.winlogEventDataScriptBlockText", "Bypass.AMSI") ||
+ contains("log.winlogEventDataScriptBlockText", "AmsiScanBuffer"))) ||
+(equals("log.winlogEventId", "4688") &&
+ contains("log.winlogEventDataCommandLine", "powershell") &&
+ (contains("log.winlogEventDataCommandLine", "amsi.dll") ||
+ contains("log.winlogEventDataCommandLine", "AmsiScanBuffer") ||
+ contains("log.winlogEventDataCommandLine", "amsiInitFailed")))
+', '2026-02-09 16:55:26.867981', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (571, 'AppInit DLLs Persistence Detection', 3, 3, 2, 'Persistence', 'T1546.010 - Event Triggered Execution: AppInit DLLs', 'Detects modifications to the AppInit_DLLs registry key, which causes specified DLLs to be
+loaded into every process that loads User32.dll. Attackers use this technique for persistence
+and DLL injection, as the malicious DLL will be loaded into virtually every user-mode process.
+On modern Windows with Secure Boot, this requires LoadAppInit_DLLs to also be enabled.
+
+Next Steps:
+1. Identify the DLL path being added to the AppInit_DLLs registry value
+2. Analyze the referenced DLL for malicious functionality
+3. Check if LoadAppInit_DLLs was also enabled (required on modern Windows)
+4. Remove the malicious DLL path from the registry value
+5. Delete the malicious DLL file from disk
+6. Reboot the system to stop the DLL from being loaded into new processes
+7. Investigate the initial compromise that led to this persistence
+', '["https://attack.mitre.org/techniques/T1546/010/","https://docs.microsoft.com/en-us/windows/win32/dlls/secure-boot-and-appinit-dlls","https://pentestlab.blog/2020/01/07/persistence-appinit-dlls/"]', '(
+ equals("log.eventCode", "13") &&
+ equals("log.winlog.provider_name", "Microsoft-Windows-Sysmon") &&
+ regexMatch("log.winlog.event_data.TargetObject", "(?i)\\\\Windows\\\\CurrentVersion\\\\Windows\\\\(AppInit_DLLs|LoadAppInit_DLLs)$") &&
+ exists("log.winlog.event_data.Details")
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)reg(.exe)?\\s+add.*AppInit_DLLs") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)reg(.exe)?\\s+add.*AppInit_DLLs")
+ )
+)
+', '2026-02-09 16:55:27.028009', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (655, 'Windows Defender Exclusions Added via PowerShell', 2, 2, 3, 'Defense Evasion', 'T1562 - Impair Defenses', 'Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/"]', 'regexMatch("log.message", "(-Exclusion(.+)(Add-MpPreference|Set-MpPreference)|(Add-MpPreference|Set-MpPreference)(.+)-Exclusion)") && regexMatch("log.winlogEventDataProcessName", "(powershell.exe|pwsh.exe|powershell_ise.exe)")', '2026-02-09 16:57:23.086717', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (572, 'AS-REP Roasting Attack Detection', 3, 2, 1, 'Credential Access', 'T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting', 'Detects AS-REP Roasting attacks targeting accounts with Kerberos pre-authentication disabled.
+Attackers request AS-REP messages encrypted with RC4 (0x17) for accounts that do not require
+pre-authentication, enabling offline password cracking. This is a companion technique to Kerberoasting
+and targets a different set of vulnerable accounts.
+
+Next Steps:
+1. Identify accounts with pre-authentication disabled and evaluate business justification
+2. Enable Kerberos pre-authentication on all identified accounts
+3. Verify the requesting source IP is not a known attack tool
+4. Reset passwords for targeted accounts using strong, complex passwords
+5. Audit Active Directory for accounts with DONT_REQUIRE_PREAUTH flag
+6. Monitor for subsequent credential usage from the requesting IP
+', '["https://attack.mitre.org/techniques/T1558/004/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4768","https://blog.harmj0y.net/activedirectory/roasting-as-reps/"]', 'equals("log.eventCode", "4768") &&
+equals("log.winlogChannel", "Security") &&
+equals("log.winlog.event_data.TicketEncryptionType", "0x17") &&
+equals("log.winlog.event_data.PreAuthType", "0") &&
+!regexMatch("log.winlog.event_data.TargetUserName", "(?i)\\$$") &&
+exists("log.winlog.event_data.TargetUserName")
+', '2026-02-09 16:55:27.173053', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"}],"or":null,"within":"now-15m","count":3}]', '["lastEvent.log.winlogEventDataIpAddress","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (573, 'BITSAdmin Abuse Detection', 2, 3, 1, 'Defense Evasion', 'T1197 - BITS Jobs', 'Detects abuse of bitsadmin.exe for downloading files from remote URLs, creating persistent BITS
+jobs, and transferring payloads. BITS (Background Intelligent Transfer Service) is a Windows
+service commonly abused by attackers for both download and persistence because BITS jobs survive
+reboots and can be configured to execute commands upon completion.
+
+Next Steps:
+1. Examine the download URL and destination path in the command line
+2. Review the BITS job for any notification command (persistence mechanism)
+3. Check the downloaded file for malicious content
+4. List all BITS jobs on the system using ''bitsadmin /list /allusers /verbose''
+5. Remove suspicious BITS jobs and quarantine downloaded files
+6. Block the download URL at the proxy/firewall level
+7. Search for similar BITS abuse across other endpoints
+', '["https://attack.mitre.org/techniques/T1197/","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)bitsadmin\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)bitsadmin\\.exe$")
+) &&
+(
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(/transfer|/addfile|/resume|/create|/setnotifycmdline|/setnotifyflags)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(http://|https://|ftp://)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)/SetMinRetryDelay") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(/transfer|/addfile|/resume|/create|/setnotifycmdline)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(http://|https://|ftp://)")
+)
+', '2026-02-09 16:55:27.312682', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (574, 'BloodHound Reconnaissance Activity', 3, 2, 1, 'Discovery', 'T1087 - Account Discovery', 'Detects potential BloodHound Active Directory reconnaissance tool usage through LDAP queries, characteristic patterns, and AD enumeration activities. BloodHound is commonly used by attackers to map Active Directory relationships and identify privilege escalation paths.
+
+Next Steps:
+1. Investigate the source host and user account involved in the activity
+2. Review network logs for LDAP queries to domain controllers around the same timeframe
+3. Check for other reconnaissance tools or suspicious PowerShell activity on the same host
+4. Examine Active Directory audit logs for unusual object access patterns
+5. Verify if the user account has legitimate reasons for AD enumeration activities
+6. Look for signs of lateral movement or privilege escalation following this reconnaissance
+7. Consider isolating the affected host if malicious activity is confirmed
+', '["https://attack.mitre.org/techniques/T1087/","https://bloodhound.readthedocs.io/","https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662"]', '(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)bloodhound") ||
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)sharphound") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(bloodhound|sharphound)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)--CollectionMethod\\s+(All|Session|LoggedOn)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(DCOnly|ComputerOnly|LocalGroup)")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)invoke-bloodhound") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Get-BloodHoundData") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Get-NetSession") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Get-NetLoggedOn") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Get-DomainTrust")
+ )
+) ||
+(
+ equals("log.eventCode", "4662") &&
+ regexMatch("log.winlog.event_data.ObjectType", "(?i)(bf967aba-0de6-11d0-a285-00aa003049e2|bf967a9c-0de6-11d0-a285-00aa003049e2)") &&
+ oneOf("log.winlog.event_data.AccessMask", ["0x100", "0x10000"])
+) ||
+(
+ equals("log.eventCode", "5156") &&
+ equals("log.winlog.event_data.DestinationPort", "389") &&
+ equals("log.winlog.event_data.Direction", "%%14592")
+)
+', '2026-02-09 16:55:27.472521', true, false, 'origin', '["adversary.host","lastEvent.log.winlogEventDataSubjectUserName"]', '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-2h","count":10}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (575, 'Boot and Logon Script Persistence Detection', 2, 3, 2, 'Persistence', 'T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)', 'Detects modifications to Windows logon script registry keys including UserInitMprLogonScript,
+Userinit, and Shell values. Attackers modify these keys to execute malicious scripts or
+binaries during user logon, providing persistent access that survives reboots. These keys
+are commonly abused because they execute with the logged-on user''s privileges.
+
+Next Steps:
+1. Examine the registry value data to identify the script or binary being persisted
+2. Analyze the referenced script or executable for malicious content
+3. Verify the parent process that modified the registry key
+4. Restore the original Userinit or Shell values
+5. Remove any malicious scripts from the referenced paths
+6. Search for additional persistence mechanisms on the same host
+7. Investigate the initial compromise vector
+', '["https://attack.mitre.org/techniques/T1037/001/","https://www.cybereason.com/blog/persistence-techniques-that-persist","https://pentestlab.blog/2020/01/14/persistence-logon-scripts/"]', '(
+ equals("log.eventCode", "13") &&
+ equals("log.winlog.provider_name", "Microsoft-Windows-Sysmon") &&
+ (
+ regexMatch("log.winlog.event_data.TargetObject", "(?i)\\\\Windows\\\\CurrentVersion\\\\(Winlogon\\\\(Userinit|Shell)|Policies\\\\Explorer\\\\Run)") ||
+ regexMatch("log.winlog.event_data.TargetObject", "(?i)UserInitMprLogonScript$") ||
+ regexMatch("log.winlog.event_data.TargetObject", "(?i)\\\\Environment\\\\UserInitMprLogonScript$")
+ ) &&
+ !regexMatch("log.winlog.event_data.Details", "(?i)^C:\\\\Windows\\\\system32\\\\userinit\\.exe,?\\s*$") &&
+ !regexMatch("log.winlog.event_data.Details", "(?i)^explorer\\.exe\\s*$")
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)reg(.exe)?\\s+add.*Winlogon.*(Userinit|Shell)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)reg(.exe)?\\s+add.*Winlogon.*(Userinit|Shell)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)reg(.exe)?\\s+add.*UserInitMprLogonScript") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)reg(.exe)?\\s+add.*UserInitMprLogonScript")
+ )
+)
+', '2026-02-09 16:55:27.642406', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (656, 'Windows: Delete Volume USN Journal with Fsutil', 1, 2, 3, 'Defense Evasion', 'T1070.004 - Indicator Removal: File Deletion', 'Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1070/004/"]', 'regexMatch("log.message", "(deletejournal(.+)usn|usn(.+)deletejournal)") && regexMatch("log.winlogEventDataProcessName", "fsutil.exe")', '2026-02-09 16:57:23.232186', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (576, 'Certificate Services Abuse Detection', 3, 3, 1, 'Credential Access', 'T1558 - Steal or Forge Kerberos Tickets', 'Detects suspicious certificate requests and issuance that could indicate Golden Certificate attacks or unauthorized certificate generation for persistence. This rule monitors Windows Certificate Services events for potentially malicious certificate operations, particularly those involving machine accounts or anonymous logons that could be leveraged for persistence and privilege escalation.
+
+Next Steps:
+1. Investigate the certificate request details including the requesting user/machine
+2. Verify if the certificate request was legitimate and authorized
+3. Check for any recent changes to Certificate Authority policies or templates
+4. Review Certificate Authority logs for other suspicious certificate issuance
+5. Examine the requesting host for signs of compromise
+6. Consider revoking any suspicious certificates issued
+7. Validate Certificate Authority security configurations and access controls
+', '["https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html","https://attack.mitre.org/techniques/T1558/"]', '(equals("log.winlogEventId", "4886") || equals("log.winlogEventId", "4887")) && equals("log.winlogProviderName", "Microsoft-Windows-Security-Auditing") && (contains("log.winlogEventDataSubjectUserName", "$") || equals("log.winlogEventDataSubjectUserName", "ANONYMOUS LOGON"))', '2026-02-09 16:55:27.782041', true, false, 'origin', null, '[]', '["lastEvent.log.winlogEventDataSubjectUserName","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (577, 'Certutil LOLBIN Abuse Detection', 2, 3, 1, 'Defense Evasion', 'T1105 - Ingress Tool Transfer', 'Detects abuse of certutil.exe as a Living Off The Land Binary (LOLBIN) for downloading files from URLs,
+encoding/decoding Base64 payloads, and NTLM coercion. Certutil is a legitimate Windows certificate
+utility that is frequently abused by attackers for payload staging and defense evasion because it is
+a signed Microsoft binary that bypasses application whitelisting.
+
+Next Steps:
+1. Examine the full command line to identify downloaded URLs or encoded payloads
+2. Check the destination file path for downloaded or decoded files
+3. Analyze any downloaded files in a sandbox environment
+4. Review the parent process to understand how certutil was invoked
+5. Check for subsequent execution of downloaded payloads
+6. Block the identified download URLs at the proxy/firewall level
+7. Search for similar certutil abuse across other endpoints
+', '["https://attack.mitre.org/techniques/T1105/","https://attack.mitre.org/techniques/T1140/","https://lolbas-project.github.io/lolbas/Binaries/Certutil/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)certutil\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)certutil\\.exe$")
+) &&
+(
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(-urlcache|-URL)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(-encode|-decode)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(-ping|-generateSSTFromWU)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(http://|https://|ftp://)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)-verifyctl") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(-urlcache|-URL)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(-encode|-decode)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(http://|https://|ftp://)")
+)
+', '2026-02-09 16:55:27.962742', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (578, 'CMSTP UAC Bypass Detection', 2, 3, 1, 'Defense Evasion', 'T1218.003 - System Binary Proxy Execution: CMSTP', 'Detects CMSTP.exe (Microsoft Connection Manager Profile Installer) being used to bypass UAC
+and AppLocker restrictions. Attackers use CMSTP with specially crafted .inf files containing
+malicious commands in the RunPreSetupCommandsSection to execute arbitrary code with elevated
+privileges. This is a well-known UAC bypass technique.
+
+Next Steps:
+1. Examine the .inf file referenced in the command line for malicious content
+2. Check the RunPreSetupCommandsSection of the INF file for commands
+3. Identify the parent process and delivery mechanism
+4. Review if UAC was successfully bypassed
+5. Check for post-exploitation activity with elevated privileges
+6. Remove the malicious INF file and any created artifacts
+7. Search for similar CMSTP abuse across other endpoints
+', '["https://attack.mitre.org/techniques/T1218/003/","https://lolbas-project.github.io/lolbas/Binaries/Cmstp/","https://msitpros.com/?p=3960"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)cmstp\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)cmstp\\.exe$")
+) &&
+(
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)/s\\s+.*\\.inf") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)/ni\\s+/s\\s+") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)/au\\s+") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)/s\\s+.*\\.inf") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)/ni\\s+/s\\s+") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)/au\\s+")
+)
+', '2026-02-09 16:55:28.102454', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (579, 'Cobalt Strike Process Behavior Detection', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects Cobalt Strike beacon process creation patterns that are distinct from normal system behavior.
+These include rundll32.exe spawned without command-line arguments, dllhost.exe or runonce.exe spawning
+cmd.exe or powershell, and characteristic post-exploitation process injection patterns. Cobalt Strike
+is the most widely used commercial adversary simulation tool and is frequently found in real attacks.
+
+Next Steps:
+1. Examine the parent-child process relationships for injection patterns
+2. Check for rundll32 with no arguments (classic beacon default)
+3. Review named pipe activity on the host for CS pipe names
+4. Check for network beaconing behavior from the suspicious process
+5. Memory scan the suspicious processes for CS beacon shellcode
+6. Isolate the affected host immediately
+7. Hunt for lateral movement from this host to other systems
+8. Review the C2 infrastructure and block at network perimeter
+', '["https://attack.mitre.org/software/S0154/","https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/","https://redcanary.com/threat-detection-report/threats/cobalt-strike/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)rundll32\\.exe$") &&
+ (
+ !exists("log.winlog.event_data.CommandLine") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)^\"?[A-Z]:\\\\Windows\\\\(System32|SysWOW64)\\\\rundll32\\.exe\"?\\s*$")
+ )
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.ParentProcessName", "(?i)(dllhost\\.exe|runonce\\.exe|searchprotocolhost\\.exe)$") &&
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(cmd\\.exe|powershell\\.exe|pwsh\\.exe)$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.ParentProcessName", "(?i)rundll32\\.exe$") &&
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(cmd\\.exe|powershell\\.exe|pwsh\\.exe)$") &&
+ !exists("log.winlog.event_data.ParentCommandLine")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(MSSE-\\d+-server|status_\\d+|postex_\\d+|msagent_\\d+)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(MSSE-\\d+-server|status_\\d+|postex_\\d+|msagent_\\d+)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)\\\\\\\\\\.\\\\.pipe\\\\(MSSE-|postex_|status_|msagent_)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\\\\\\\\\.\\\\.pipe\\\\(MSSE-|postex_|status_|msagent_)")
+ )
+)
+', '2026-02-09 16:55:28.247505', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (657, 'Windows: Deleting Backup Catalogs with Wbadmin', 1, 2, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1490/"]', 'regexMatch("log.message", "(delete(.+)catalog|catalog(.+)delete)") && regexMatch("log.winlogEventDataProcessName", "(wbadmin.exe|WBADMIN.EXE)")', '2026-02-09 16:57:23.376637', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (683, 'Windows: Privilege Escalation via Named Pipe Impersonation', 3, 3, 2, 'Privilege Escalation', 'T1134 - Access Token Manipulation', 'Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit''s meterpreter getsystem command.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1134/"]', 'regexMatch("log.winlogEventDataProcessName", "(Cmd.Exe|PowerShell.EXE|powershell.exe|cmd.exe)") && contains("log.message", ">") && regexMatch("log.message", "(\\\\.\\pipe\\)")', '2026-02-09 16:57:27.032450', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (580, 'COM Hijacking Persistence Detection', 2, 3, 1, 'Persistence', 'T1546.015 - Event Triggered Execution: Component Object Model Hijacking', 'Detects COM (Component Object Model) hijacking used for persistence by modifying InProcServer32
+or LocalServer32 registry values. Attackers replace legitimate COM object DLLs with malicious ones
+to achieve persistence, as the malicious DLL will be loaded whenever the COM object is instantiated.
+This is a stealthy persistence mechanism that is difficult to detect without registry monitoring.
+
+Next Steps:
+1. Examine the modified InProcServer32/LocalServer32 value to identify the malicious DLL
+2. Verify if the new DLL path points to a legitimate or suspicious location
+3. Check the original COM object registration for comparison
+4. Analyze the replacement DLL in a sandbox
+5. Identify the CLSID being hijacked and what software uses it
+6. Restore the original COM registration
+7. Search for similar COM hijacking across other endpoints
+', '["https://attack.mitre.org/techniques/T1546/015/","https://pentestlab.blog/2020/05/20/persistence-com-hijacking/","https://bohops.com/2018/08/18/abusing-the-com-registry-structure-clsid-localserver32-inprocserver32/"]', 'equals("log.eventCode", "4657") &&
+equals("log.winlogChannel", "Security") &&
+regexMatch("log.winlog.event_data.ObjectName", "(?i)(InProcServer32|LocalServer32)") &&
+(
+ regexMatch("log.winlog.event_data.NewValue", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\|\\\\Desktop\\\\)") ||
+ regexMatch("log.winlog.event_data.NewValue", "(?i)(rundll32|regsvr32|mshta|powershell|cmd\\.exe|wscript|cscript)") ||
+ regexMatch("log.winlog.event_data.NewValue", "(?i)scrobj\\.dll") ||
+ regexMatch("log.winlog.event_data.NewValue", "(?i)(http://|https://)") ||
+ !regexMatch("log.winlog.event_data.NewValue", "(?i)^(C:\\\\Windows\\\\|C:\\\\Program Files)")
+) &&
+!regexMatch("log.winlogEventDataSubjectUserName", "(?i)^(SYSTEM|TrustedInstaller)$")
+', '2026-02-09 16:55:28.402474', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (581, 'Credential Dump via Registry Export', 3, 2, 1, 'Credential Access', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'Detects credential dumping via registry export of SAM, SYSTEM, and SECURITY hives using
+reg.exe save commands. Attackers export these hives to extract password hashes offline using
+tools like secretsdump.py or samdump2. This technique is commonly used after gaining local
+administrator privileges.
+
+Next Steps:
+1. Identify the user account executing the reg save commands
+2. Check if SAM, SYSTEM, and SECURITY hives were all exported (indicates deliberate extraction)
+3. Search for the output files on disk and check if they were exfiltrated
+4. Review for follow-up pass-the-hash or credential reuse activity
+5. Reset all local account passwords on the affected system
+6. Investigate how the attacker obtained local administrator privileges
+7. Check for domain credential exposure if SECURITY hive was exported
+', '["https://attack.mitre.org/techniques/T1003/004/","https://www.sans.org/blog/protecting-privileged-domain-accounts-safeguarding-password-hashes/","https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)reg(.exe)?\\s+(save|export)\\s+[\"'']?HKLM\\\\SAM") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)reg(.exe)?\\s+(save|export)\\s+[\"'']?HKLM\\\\SAM")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)reg(.exe)?\\s+(save|export)\\s+[\"'']?HKLM\\\\SYSTEM") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)reg(.exe)?\\s+(save|export)\\s+[\"'']?HKLM\\\\SYSTEM")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)reg(.exe)?\\s+(save|export)\\s+[\"'']?HKLM\\\\SECURITY") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)reg(.exe)?\\s+(save|export)\\s+[\"'']?HKLM\\\\SECURITY")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)esentutl.*/y.*/d.*ntds\\.dit") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)esentutl.*/y.*/d.*ntds\\.dit"))
+)
+', '2026-02-09 16:55:28.572208', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (582, 'Credential Manager Access Detection', 3, 2, 1, 'Credential Access', 'T1555.004 - Credentials from Password Stores: Windows Credential Manager', 'Detects access to Windows Credential Manager using vaultcmd.exe, cmdkey.exe, or credential
+enumeration via PowerShell. Attackers use these tools to extract stored credentials including
+web passwords, Windows credentials, and RDP saved logins. This is a common post-exploitation
+technique for credential harvesting.
+
+Next Steps:
+1. Identify the user account and process executing credential manager commands
+2. Verify if this is authorized administrative activity or penetration testing
+3. Review what credentials are stored in the affected user''s vault
+4. Check for follow-up lateral movement using extracted credentials
+5. Reset any credentials that may have been exposed
+6. Review if remote desktop saved credentials were compromised
+7. Investigate the initial access vector that led to credential access
+', '["https://attack.mitre.org/techniques/T1555/004/","https://www.passcape.com/index.php?section=docsys&cmd=details&id=28","https://blog.malwarebytes.com/threat-analysis/2020/12/credential-stealing/"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)vaultcmd(.exe)?\\s+/(list|listcreds|listproperties)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)vaultcmd(.exe)?\\s+/(list|listcreds|listproperties)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)cmdkey(.exe)?\\s+/list") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)cmdkey(.exe)?\\s+/list")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)(CredentialManager|Windows\\s+Vault|VaultSvc)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(CredentialManager|Windows\\s+Vault|VaultSvc)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Get-VaultCredential|Get-CachedGPPPassword") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Get-VaultCredential|Get-CachedGPPPassword"))
+)
+', '2026-02-09 16:55:28.698132', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (583, 'DCOM Lateral Movement Detection', 3, 3, 2, 'Lateral Movement', 'T1021.003 - Remote Services: Distributed Component Object Model', 'Detects potential DCOM lateral movement attempts by monitoring for suspicious process creation with DCOM-related command line parameters. Looks for processes with automation embedding flags and specific DCOM object CLSIDs commonly abused for lateral movement such as ShellWindows and MMC20.Application.
+
+Next Steps:
+1. Investigate the source host and user account that initiated the DCOM activity
+2. Review network connections between the source and target systems around the time of the alert
+3. Check for additional lateral movement indicators on both source and target systems
+4. Examine the specific DCOM objects and CLSIDs being accessed for known malicious usage
+5. Verify if the DCOM activity aligns with legitimate business processes or scheduled tasks
+6. Look for privilege escalation attempts following the lateral movement
+7. Check for any data exfiltration or persistence mechanisms deployed post-compromise
+', '["https://medium.com/@cY83rR0H1t/detecting-dcom-lateral-movement-ee2b461a8705","https://attack.mitre.org/techniques/T1021/003/"]', 'equals("log.eventCode", "4688") && exists("log.winlogEventDataProcessCommandLine") && (contains("log.winlogEventDataProcessCommandLine", "/automation -Embedding") || contains("log.winlogEventDataProcessCommandLine", "9BA05972-F6A8-11CF-A442-00A0C90A8F39") || contains("log.winlogEventDataProcessCommandLine", "c08afd90-f2a1-11d1-8455-00a0c91f3880") || contains("log.winlogEventDataProcessCommandLine", "MMC20.Application") || contains("log.winlogEventDataProcessCommandLine", "Document.Application.ShellExecute") || contains("log.winlogEventDataProcessCommandLine", "GetTypeFromCLSID") || contains("log.winlogEventDataProcessCommandLine", "GetTypeFromProgID"))', '2026-02-09 16:55:28.837321', true, false, 'origin', null, '[]', '["lastEvent.log.winlogEventDataProcessName","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (658, 'Windows: PowerShell Keylogging Script', 3, 2, 2, 'Collection', 'T1056.001 - Input Capture: Keylogging', 'Detects the use of Win32 API Functions that can be used to capture user keystrokes in PowerShell scripts. Attackers use this technique to capture user input, looking for credentials and/or other valuable data.', '["https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1056/","https://attack.mitre.org/techniques/T1056/001/"]', 'regexMatch("log.message", "(GetAsyncKeyState|NtUserGetAsyncKeyState|GetKeyboardState|Get-Keystrokes|SetWindowsHookA|SetWindowsHookW|SetWindowsHookEx|SetWindowsHookExA|NtUserSetWindowsHookEx|GetForegroundWindow|GetWindowTextA|GetWindowTextW|WM_KEYBOARD_LL)") && regexMatch("log.winlogEventDataProcessName", "(powershell.exe|pwsh.exe|powershell_ise.exe)")', '2026-02-09 16:57:23.537531', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (584, 'DCShadow Attack Detection', 3, 3, 2, 'Defense Evasion', 'T1207 - Rogue Domain Controller', 'Detects DCShadow attacks where attackers register a rogue domain controller to push malicious Active Directory changes. This technique allows adversaries to modify Active Directory objects by registering a rogue domain controller and triggering replication, effectively bypassing security controls and detection mechanisms.
+
+The rule monitors for:
+- Computer account modifications with domain controller service principal names
+- Access to sensitive Active Directory objects and properties
+- Creation of server objects in the domain controller configuration
+
+Next Steps:
+1. Immediately investigate the source host and user account involved in the activity
+2. Check if the host is an authorized domain controller in your environment
+3. Review recent Active Directory changes and replication logs
+4. Examine authentication logs for the affected user account
+5. Verify the legitimacy of any recent domain controller promotions
+6. Check for signs of compromise on the source system
+7. Consider isolating the affected host if unauthorized activity is confirmed
+8. Review domain controller security policies and access controls
+', '["https://attack.mitre.org/techniques/T1207/","https://www.dcshadow.com/","https://blog.alsid.eu/dcshadow-explained-4510f52fc19d"]', '(
+ (equals("log.eventCode", "4742") &&
+ equals("log.winlogChannel", "Security") &&
+ contains("log.winlog.event_data.ServicePrincipalNames", "GC/") &&
+ contains("log.winlog.event_data.UserAccountControl", "SERVER_TRUST_ACCOUNT")) ||
+ (equals("log.eventCode", "4662") &&
+ equals("log.winlogChannel", "Security") &&
+ equals("log.winlog.event_data.ObjectType", "{bf967a92-0de6-11d0-a285-00aa003049e2}") &&
+ contains("log.winlog.event_data.Properties", "1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")) ||
+ (equals("log.eventCode", "5137") &&
+ equals("log.winlogChannel", "Security") &&
+ equals("log.winlog.event_data.ObjectClass", "server") &&
+ contains("log.winlog.event_data.ObjectDN", "CN=Servers,CN="))
+) &&
+!contains("origin.host", "DC")
+', '2026-02-09 16:55:28.992887', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-2h","count":2}]', '["lastEvent.log.winlog.event_data.SubjectUserName","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (585, 'DLL Sideloading Detection', 2, 3, 1, 'Defense Evasion', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'Detects DLL sideloading patterns where known vulnerable legitimate applications load malicious
+DLLs from non-system paths. Attackers place a malicious DLL alongside a vulnerable application
+that loads DLLs from its own directory rather than the system directory. This technique
+leverages trusted application signatures to execute malicious code and evade security controls.
+
+Next Steps:
+1. Verify the executable path - legitimate apps should be in Program Files, not user directories
+2. Check the DLL loaded alongside the executable for unexpected modifications
+3. Compare DLL hashes against known good versions
+4. Examine the parent process to understand how the vulnerable app was launched
+5. Review file creation timestamps for the executable and DLL pair
+6. Analyze the suspicious DLL in a sandbox
+7. Search for similar sideloading patterns across other endpoints
+', '["https://attack.mitre.org/techniques/T1574/002/","https://www.mandiant.com/resources/blog/dll-side-loading-a-thorn-in-the-side-of-the-anti-virus-industry","https://hijacklibs.net/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Desktop\\\\|\\\\Users\\\\Public\\\\)") &&
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(OneDriveStandaloneUpdater|colorcpl|consent|dxcap|eudcedit|eventvwr|isoburn|msconfig|msdt|mstsc|narrator|netplwiz|odbcad32|presentationhost|rstrui|sdclt|sethc|sigverif|utilman|write)\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlogEventDataProcessName", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Desktop\\\\)") &&
+ regexMatch("log.winlogEventDataProcessName", "(?i)(OneDriveStandaloneUpdater|colorcpl|consent|dxcap|eudcedit|eventvwr|isoburn|msconfig|msdt|mstsc|narrator|netplwiz|odbcad32|presentationhost|rstrui|sdclt|sethc|sigverif|utilman|write)\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Desktop\\\\|\\\\Users\\\\Public\\\\)") &&
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(WerFault|SearchProtocolHost|SearchFilterHost|WmiPrvSE|backgroundTaskHost|RuntimeBroker|smartscreen|tabcal|winsat)\\.exe$")
+ )
+)
+', '2026-02-09 16:55:29.152908', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (586, 'DCSync Attack Detection', 3, 3, 1, 'Credential Access', 'T1003.006 - OS Credential Dumping: DCSync', 'Detects DCSync attacks where attackers use directory replication services to retrieve password hashes from domain controllers.
+This technique exploits legitimate Active Directory replication functionality to extract credentials without directly accessing the domain controller''s files.
+The rule monitors for specific replication GUIDs associated with credential access operations in Windows Event ID 4662.
+
+Next Steps:
+- Immediately verify the legitimacy of the user account performing the replication operation
+- Check if the source host is an authorized domain controller or backup system
+- Review recent privilege escalation activities for the identified user account
+- Examine network traffic for additional signs of credential harvesting
+- Consider resetting passwords for high-privilege accounts if compromise is confirmed
+- Review domain controller access logs for unauthorized administrative activities
+', '["https://attack.mitre.org/techniques/T1003/006/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4662","https://www.elastic.co/guide/en/security/current/potential-credential-access-via-dcsync.html"]', 'equals("log.eventCode", "4662") &&
+equals("log.winlogChannel", "Security") &&
+equals("log.winlog.event_data.ObjectServer", "DS") &&
+(
+ contains("log.winlog.event_data.Properties", "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2") ||
+ contains("log.winlog.event_data.Properties", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2") ||
+ contains("log.winlog.event_data.Properties", "89e95b76-444d-4c62-991a-0facbeda640c") ||
+ contains("log.winlog.event_data.Properties", "19195a5b-6da0-11d0-afd3-00c04fd930c9")
+) &&
+!regexMatch("log.winlogEventDataSubjectUserName", ".*\\$$") &&
+!contains("origin.host", "DC")
+', '2026-02-09 16:55:29.297946', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataSubjectUserName","operator":"filter_term","value":"{{log.winlogEventDataSubjectUserName}}"}],"or":null,"within":"now-1h","count":1}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (587, 'Domain Trust Discovery Detection', 2, 1, 1, 'Discovery', 'T1482 - Domain Trust Discovery', 'Detects domain trust enumeration using nltest, dsquery, Get-ADTrust, and other Active
+Directory discovery tools. Attackers enumerate domain trusts to identify additional targets
+for lateral movement between trusted domains and forests. This is typically an early
+reconnaissance step in Active Directory attacks.
+
+Next Steps:
+1. Identify the user account performing domain trust enumeration
+2. Verify if this is authorized security assessment or IT administration
+3. Check for other discovery commands from the same user or host
+4. Review if the user subsequently accessed resources in trusted domains
+5. Correlate with other reconnaissance activities (BloodHound, SharpHound)
+6. Monitor for lateral movement into discovered trusted domains
+7. Review trust configurations for unnecessary or overly permissive trusts
+', '["https://attack.mitre.org/techniques/T1482/","https://adsecurity.org/?p=1588","https://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)nltest(.exe)?\\s+/(domain_trusts|trusted_domains|dclist|dsgetdc)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)nltest(.exe)?\\s+/(domain_trusts|trusted_domains|dclist|dsgetdc)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)dsquery(.exe)?\\s+trust") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)dsquery(.exe)?\\s+trust")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Get-ADTrust|Get-DomainTrust|Get-ForestTrust|Get-NetForestTrust") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Get-ADTrust|Get-DomainTrust|Get-ForestTrust|Get-NetForestTrust")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)\\[System\\.DirectoryServices\\.ActiveDirectory\\.(Domain|Forest)\\]") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\[System\\.DirectoryServices\\.ActiveDirectory\\.(Domain|Forest)\\]")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)adfind(.exe)?.*-f.*trustdirection") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)adfind(.exe)?.*-f.*trustdirection"))
+)
+', '2026-02-09 16:55:29.447553', true, false, 'origin', '["adversary.host","adversary.user"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (659, 'Windows: Kerberos Pre-authentication Disabled for User', 2, 2, 3, 'Credential Access', 'T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting', 'Identifies the modification of an accounts Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1558/","https://attack.mitre.org/techniques/T1558/004/"]', 'regexMatch("log.message", "(('')?[Dd]on('')?t [Rr]equire [Pp]reauth('')?(\\s)?(-)?(\\s)?[Ee]nabled)") && equals("log.eventCode", 4738)', '2026-02-09 16:57:23.682331', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (588, 'ETW Patching and Tampering Detection', 3, 3, 2, 'Defense Evasion', 'T1562.006 - Impair Defenses: Indicator Blocking', 'Detects attempts to tamper with Event Tracing for Windows (ETW) to blind security tools.
+Attackers patch ETW functions in memory (NtTraceEvent, EtwEventWrite) or use PowerShell
+Reflection to disable .NET ETW providers, preventing security tools from receiving telemetry.
+This technique is frequently used before executing post-exploitation tools to evade detection.
+
+Next Steps:
+1. Investigate the process that attempted ETW tampering
+2. Check what malicious activity followed the ETW patching
+3. Review PowerShell script block logs for ETW manipulation code
+4. Examine if the .NET ETW provider was targeted (common for AMSI bypass chains)
+5. Verify that ETW providers are functioning correctly after remediation
+6. Search for additional evasion techniques on the same host
+7. Isolate the host and investigate the full attack chain
+', '["https://attack.mitre.org/techniques/T1562/006/","https://blog.xpnsec.com/hiding-your-dotnet-etw/","https://www.mdsec.co.uk/2020/03/hiding-your-net-etw/"]', '(
+ (equals("log.eventCode", "4104") || equals("log.eventCode", "4103")) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ contains("log.winlog.event_data.ScriptBlockText", "EtwEventWrite") ||
+ contains("log.winlog.event_data.ScriptBlockText", "NtTraceEvent") ||
+ contains("log.winlog.event_data.ScriptBlockText", "NtTraceControl") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)\\[Reflection\\.Assembly\\].*ETW") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)Patch.*ETW|ETW.*Patch") ||
+ contains("log.winlog.event_data.ScriptBlockText", "EventProvider") ||
+ contains("log.winlogEventDataScriptBlockText", "EtwEventWrite") ||
+ contains("log.winlogEventDataScriptBlockText", "NtTraceEvent")
+ )
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)logman.*stop.*EventLog") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)logman.*stop.*EventLog") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)auditpol.*/clear") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)auditpol.*/clear") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)Set-EtwTraceProvider.*0x0") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Set-EtwTraceProvider.*0x0")
+ )
+)
+', '2026-02-09 16:55:29.686961', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (589, 'DPAPI Domain Backup Key Extraction', 3, 3, 1, 'Credential Access', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'Detects extraction of the DPAPI domain backup key from a domain controller. The BCKUPKEY secret
+object contains the domain''s DPAPI backup key which can be used to decrypt any DPAPI-protected
+data for all domain users, including passwords, certificates, and other sensitive data. This is
+a high-severity credential access technique that indicates an attacker has domain admin access.
+
+Next Steps:
+1. Verify the account accessing the BCKUPKEY object is authorized (should only be DC replication)
+2. Check if the source host is a legitimate domain controller
+3. Review the user account for signs of compromise
+4. Investigate for related DCSync or NTDS.dit extraction attempts
+5. Assume all DPAPI-protected secrets are compromised if unauthorized
+6. Rotate the DPAPI domain backup key (requires careful planning)
+7. Reset credentials for all privileged accounts
+', '["https://attack.mitre.org/techniques/T1003/004/","https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/","https://adsecurity.org/?p=1785"]', 'equals("log.eventCode", "4662") &&
+equals("log.winlogChannel", "Security") &&
+contains("log.winlog.event_data.Properties", "BCKUPKEY") &&
+contains("log.winlog.event_data.ObjectServer", "DS") &&
+!regexMatch("log.winlogEventDataSubjectUserName", "(?i)\\$$")
+', '2026-02-09 16:55:29.911876', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (607, 'Network Sniffer and Packet Capture Detection', 3, 1, 0, 'Discovery', 'T1040 - Network Sniffing', 'Detects execution of network sniffing and packet capture tools that could be used to
+intercept network traffic, capture credentials, or perform man-in-the-middle attacks.
+Monitors for known sniffer binaries, raw socket creation, and promiscuous mode indicators.
+
+Next Steps:
+1. Verify if the packet capture tool usage was authorized (IT/security staff)
+2. Check which user account executed the tool and validate their role
+3. Determine what network interfaces were targeted for capture
+4. Review if any sensitive data (credentials, tokens) may have been captured
+5. Check for data exfiltration - captured packets being sent to external destinations
+6. Look for lateral movement from the host running the sniffer
+7. Investigate if the sniffer was installed recently or is part of standard tooling
+', '["https://attack.mitre.org/techniques/T1040/","https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688","https://www.sans.org/reading-room/whitepapers/detection/detecting-network-sniffers-1180"]', '(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(wireshark|tshark|dumpcap|windump|tcpdump|rawcap|netsh\\.exe|pktmon\\.exe)\\.exe$") ||
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(ettercap|NetworkMiner|Microsoft Network Monitor|nmcap)\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)(wireshark|tshark|dumpcap|windump|tcpdump|rawcap)\\.exe$") ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)netsh\\.exe$") &&
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(trace\\s+start|capture\\s+start)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)pktmon\\.exe$") &&
+ contains("log.winlog.event_data.CommandLine", "start")
+ ) ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(npcap|winpcap|pcap\\.dll|raw\\s+socket|promiscuous)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(npcap|winpcap|pcap\\.dll|raw\\s+socket|promiscuous)")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ contains("log.winlog.event_data.ScriptBlockText", "Net.Sockets.Socket") ||
+ contains("log.winlog.event_data.ScriptBlockText", "SocketType.Raw") ||
+ contains("log.winlog.event_data.ScriptBlockText", "ProtocolType.IP") ||
+ contains("log.winlog.event_data.ScriptBlockText", "IOControlCode") ||
+ contains("log.winlog.event_data.ScriptBlockText", "SIO_RCVALL") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-PacketCapture") ||
+ contains("log.winlog.event_data.ScriptBlockText", "New-NetEventSession")
+ )
+) ||
+(
+ equals("log.eventCode", "7045") &&
+ regexMatch("log.winlog.event_data.ServiceName", "(?i)(npcap|winpcap|npf|rawcap)")
+)
+', '2026-02-09 16:55:32.752288', true, false, 'origin', '["adversary.host","adversary.user"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (608, 'NTDS.dit Extraction Attempt', 3, 3, 1, 'Credential Access', 'T1003.003 - OS Credential Dumping: NTDS', 'Detects attempts to access or copy the Active Directory domain database (NTDS.dit) which contains password hashes for all domain users. This is a critical indicator of credential theft attempts and potential domain compromise.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent further compromise
+2. Review all recent activity from the source host and user account
+3. Check for signs of lateral movement from this system
+4. Verify integrity of domain controllers and examine recent administrative actions
+5. Look for evidence of credential harvesting tools (ntdsutil, vssadmin, mimikatz)
+6. Review privileged account usage and consider forcing password resets
+7. Examine network traffic for data exfiltration attempts
+8. Check backup systems and shadow copies for unauthorized access
+9. Coordinate with incident response team for full forensic analysis
+', '["https://attack.mitre.org/techniques/T1003/003/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4663"]', 'oneOf("log.eventCode", ["4663", "4656"]) &&
+equals("log.winlogChannel", "Security") &&
+(
+ endsWith("log.winlog.event_data.ObjectName", "\\ntds.dit") ||
+ contains("log.winlog.event_data.ObjectName", "\\NTDS\\") ||
+ endsWith("log.winlogEventDataProcessName", "\\ntdsutil.exe") ||
+ endsWith("log.winlogEventDataProcessName", "\\vssadmin.exe")
+) &&
+!equals("log.winlog.event_data.AccessMask", "0x0")
+', '2026-02-09 16:55:32.902746', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-30m","count":2}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (660, 'Windows: Disable Windows Firewall Rules via Netsh', 2, 2, 3, 'Defense Evasion', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'Identifies use of netsh.exe to disable Windows Firewall rules or turn off the firewall entirely. Adversaries may disable the Windows Firewall to enable network connections for lateral movement or command and control.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/004/"]', 'regexMatch("log.message", "(disable(.+)firewall(.+)set|disable(.+)set(.+)firewall|firewall(.+)disable(.+)set|firewall(.+)set(.+)disable|set(.+)disable(.+)firewall|set(.+)firewall(.+)disable|state(.+)advfirewall(.+)off|state(.+)off(.+)advfirewall|advfirewall(.+)state(.+)off|advfirewall(.+)off(.+)state|off(.+)state(.+)advfirewall|off(.+)advfirewall(.+)state)") && regexMatch("log.winlogEventDataProcessName", "netsh.exe")', '2026-02-09 16:57:23.822544', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (590, 'Event Log Clearing Detection', 3, 3, 2, 'Defense Evasion', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs', 'Detects when Windows event logs are cleared, which is often done by attackers to cover their tracks and remove evidence of malicious activities. This rule monitors for Event ID 1102 (Security log cleared), Event ID 104 (System log cleared), and command-line activities using wevtutil or PowerShell cmdlets to clear event logs.
+
+Next Steps:
+1. Identify the user account that performed the log clearing operation
+2. Review the timeline of events before the log clearing to identify potential malicious activities
+3. Check for any remaining forensic artifacts in other log sources (network logs, endpoint logs, etc.)
+4. Investigate if this was authorized maintenance or potential malicious activity
+5. Review user privileges and access patterns for the account involved
+6. Consider implementing additional logging and monitoring for critical systems
+', '["https://attack.mitre.org/techniques/T1070/001/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1102"]', 'equals("log.winlogEventId", "1102") ||
+equals("log.eventCode", "1102") ||
+(equals("log.winlogEventId", "104") &&
+ contains("log.winlogChannel", "System")) ||
+(equals("log.winlogEventId", "4688") &&
+ ((contains("log.winlogEventDataCommandLine", "wevtutil") &&
+ contains("log.winlogEventDataCommandLine", " cl ")) ||
+ contains("log.winlogEventDataCommandLine", "Clear-EventLog") ||
+ contains("log.winlogEventDataCommandLine", "Remove-EventLog") ||
+ contains("log.winlogEventDataCommandLine", "Limit-EventLog")))
+', '2026-02-09 16:55:30.057015', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (591, 'Golden Ticket Attack Detection', 3, 3, 3, 'Credential Access', 'T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket', 'Detects Golden Ticket attacks where adversaries forge Kerberos TGTs using the KRBTGT account
+hash, granting unlimited domain access. The rule detects anomalous TGT usage patterns including
+TGS requests with unusual encryption types, tickets with abnormally long lifetimes, and Kerberos
+authentication from non-domain-controller sources for the KRBTGT service.
+
+Next Steps:
+1. Immediately verify if the KRBTGT account password has been compromised
+2. Reset the KRBTGT password TWICE to invalidate all existing tickets
+3. Identify the source host and investigate for full domain compromise
+4. Review all domain admin activity from the suspected timeframe
+5. Check for DCSync or NTDS.dit extraction as precursor activities
+6. Audit all privileged account access across the domain
+7. Consider rebuilding the domain if compromise is confirmed
+8. Implement Kerberos armoring and constrained delegation
+', '["https://attack.mitre.org/techniques/T1558/001/","https://adsecurity.org/?p=1640","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4769"]', '(
+ equals("log.eventCode", "4769") &&
+ equals("log.winlogChannel", "Security") &&
+ equals("log.winlog.event_data.ServiceName", "krbtgt") &&
+ !equals("log.winlog.event_data.Status", "0x0") &&
+ exists("log.winlog.event_data.IpAddress")
+) ||
+(
+ equals("log.eventCode", "4768") &&
+ equals("log.winlogChannel", "Security") &&
+ !oneOf("log.winlog.event_data.TicketEncryptionType", ["0x12", "0x11"]) &&
+ exists("log.winlog.event_data.TargetUserName") &&
+ !regexMatch("log.winlog.event_data.TargetUserName", "(?i)\\$$")
+) ||
+(
+ equals("log.eventCode", "4672") &&
+ equals("log.winlogChannel", "Security") &&
+ contains("log.winlog.event_data.PrivilegeList", "SeTcbPrivilege") &&
+ !regexMatch("log.winlogEventDataSubjectUserName", "(?i)^(SYSTEM|LOCAL SERVICE|NETWORK SERVICE)$") &&
+ !regexMatch("log.winlogEventDataSubjectUserName", "(?i)\\$$")
+)
+', '2026-02-09 16:55:30.207385', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-30m","count":3}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (592, 'GPO Tampering Detection', 2, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1484.001 - Domain Policy Modification: Group Policy Modification', 'Detects modifications to Group Policy Objects (GPOs) which could indicate an adversary attempting to escalate privileges, deploy malware across the domain, or establish persistence. GPO tampering is a common technique used by attackers to enforce malicious configurations or deploy payloads to multiple systems simultaneously.
+
+**Next Steps:**
+1. Immediately review the specific GPO that was modified and identify what changes were made
+2. Verify if the modification was authorized by checking with the responsible administrator
+3. Examine the user account that made the changes for signs of compromise
+4. Review recent authentication logs for the user account to identify potential lateral movement
+5. Check domain controllers for additional suspicious activities around the same timeframe
+6. If unauthorized, immediately revert the GPO changes and investigate the compromise vector
+7. Consider temporarily disabling the affected user account pending investigation
+', '["https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing","https://attack.mitre.org/techniques/T1484/001/"]', 'equals("log.winlogEventId", "5136") && equals("log.winlogProviderName", "Microsoft-Windows-Security-Auditing") && contains("log.winlogEventDataObjectDN", "CN=Policies,CN=System")', '2026-02-09 16:55:30.352267', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (593, 'Image File Execution Options Debugger Persistence', 3, 3, 2, 'Persistence', 'T1546.012 - Event Triggered Execution: Image File Execution Options Injection', 'Detects abuse of Image File Execution Options (IFEO) registry keys to establish persistence
+or redirect program execution. Attackers set the Debugger value under IFEO to hijack
+execution of legitimate programs (like accessibility tools sethc.exe, utilman.exe, narrator.exe)
+and redirect them to cmd.exe or other malicious payloads. This technique is also used for
+persistence through GlobalFlag and SilentProcessExit monitoring.
+
+Next Steps:
+1. Check which program''s IFEO key was modified and what debugger was set
+2. Verify if accessibility tool hijacking was used (sethc, utilman, narrator, magnify, osk)
+3. Remove the malicious Debugger registry value
+4. Check for RDP access if accessibility tools were hijacked (sticky keys attack)
+5. Investigate the user account that made the registry modification
+6. Search for additional persistence mechanisms
+7. Review recent RDP login activity on the affected host
+', '["https://attack.mitre.org/techniques/T1546/012/","https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/","https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options/"]', '(
+ equals("log.eventCode", "13") &&
+ equals("log.winlog.provider_name", "Microsoft-Windows-Sysmon") &&
+ regexMatch("log.winlog.event_data.TargetObject", "(?i)\\\\Image File Execution Options\\\\.*\\\\(Debugger|GlobalFlag|MonitorProcess)$") &&
+ !regexMatch("log.winlog.event_data.Details", "(?i)(werfault|drwtsn32|vsjitdebugger|windbg)")
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)reg(.exe)?\\s+add.*Image File Execution Options.*Debugger") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)reg(.exe)?\\s+add.*Image File Execution Options.*Debugger")
+ )
+)
+', '2026-02-09 16:55:30.512604', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (661, 'Windows: Disabling Windows Defender Security Settings via PowerShell', 3, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/001/"]', 'regexMatch("log.message", "(Set-MpPreference)") && regexMatch("log.message", "(-Disable|Disabled|NeverSend|-Exclusion)") && regexMatch("log.winlogEventDataProcessName", "(powershell.exe|pwsh.dll|powershell_ise.exe)")', '2026-02-09 16:57:23.967424', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (594, 'Impacket Lateral Movement Detection', 3, 3, 2, 'Lateral Movement', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 'Detects Impacket framework lateral movement patterns including wmiexec, smbexec, dcomexec, and atexec.
+Impacket is the most commonly used lateral movement framework in real-world attacks. The characteristic
+pattern involves cmd.exe /Q /c with output redirection to 127.0.0.1 via named pipes or ADMIN$ share,
+as well as specific command-line patterns unique to each Impacket module.
+
+Next Steps:
+1. Identify the source of the lateral movement and the compromised credentials used
+2. Examine the full command line for data exfiltration or payload delivery
+3. Check for Impacket artifacts in the ADMIN$ share or temp directories
+4. Review authentication logs for the credential source
+5. Isolate affected hosts and block lateral movement paths
+6. Reset credentials for all accounts used in the lateral movement
+7. Hunt for Impacket usage across all domain-joined systems
+8. Review network logs for SMB traffic patterns consistent with Impacket
+', '["https://attack.mitre.org/techniques/T1021/002/","https://github.com/fortra/impacket","https://www.13cubed.com/downloads/impacket_exec_commands_cheat_sheet.pdf"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)cmd\\.exe\\s+/Q\\s+/c\\s+.+\\s+1>\\s*\\\\\\\\127\\.0\\.0\\.1\\\\") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)cmd\\.exe\\s+/Q\\s+/c\\s+.+\\s+1>\\s*\\\\\\\\127\\.0\\.0\\.1\\\\")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)cmd\\.exe\\s+/Q\\s+/c\\s+.+\\s+2>&1") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)cmd\\.exe\\s+/Q\\s+/c\\s+.+\\s+2>&1")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.ParentProcessName", "(?i)wmiprvse\\.exe$") &&
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)cmd\\.exe\\s+/Q\\s+/c")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)\\\\__output\\s") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\\\__output\\s")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)cmd\\.exe\\s+/C\\s+.+\\\\ADMIN\\$\\\\__\\d+\\.\\d+") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)cmd\\.exe\\s+/C\\s+.+\\\\ADMIN\\$\\\\__\\d+\\.\\d+")
+ )
+)
+', '2026-02-09 16:55:30.672382', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (595, 'Kerberoasting Attack Detection', 3, 2, 1, 'Credential Access', 'T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting', 'Detects Kerberoasting attacks where adversaries request Kerberos TGS tickets encrypted with RC4 (0x17) for
+service accounts in order to crack them offline and obtain plaintext credentials. This is the most common
+Active Directory credential theft technique used in real-world compromises. The rule monitors Event ID 4769
+(Kerberos Service Ticket Operations) for RC4 encryption requests while excluding machine accounts (ending in $)
+and legitimate system services.
+
+Next Steps:
+1. Identify the requesting user account and verify if this is authorized security testing
+2. Check which service account SPNs were targeted for TGS requests
+3. Review if the requesting account has been compromised
+4. Audit all service accounts with SPNs for weak passwords
+5. Consider implementing AES-only Kerberos encryption policies
+6. Rotate passwords for targeted service accounts immediately
+7. Enable Group Managed Service Accounts (gMSA) where possible
+8. Monitor for follow-up lateral movement using obtained credentials
+', '["https://attack.mitre.org/techniques/T1558/003/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4769","https://adsecurity.org/?p=2293"]', 'equals("log.eventCode", "4769") &&
+equals("log.winlogChannel", "Security") &&
+equals("log.winlog.event_data.TicketEncryptionType", "0x17") &&
+!regexMatch("log.winlog.event_data.ServiceName", "(?i)\\$$") &&
+!equals("log.winlog.event_data.ServiceName", "krbtgt") &&
+!oneOf("log.winlog.event_data.TicketOptions", ["0x40810000", "0x40800000", "0x40810010"]) &&
+exists("log.winlog.event_data.ServiceName")
+', '2026-02-09 16:55:30.807277', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"}],"or":null,"within":"now-15m","count":3}]', '["lastEvent.log.winlogEventDataIpAddress","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (596, 'Keylogger Activity Detection', 3, 2, 0, 'Collection', 'T1056.001 - Input Capture: Keylogging', 'Detects keylogger activity through Windows API hook installation, clipboard monitoring,
+keyboard input capture, and known keylogger tool execution. Attackers use keyloggers
+to capture user credentials, sensitive data, and communications.
+
+Next Steps:
+1. Immediately isolate the affected host to stop credential capture
+2. Identify the source process installing keyboard hooks and its origin
+3. Check if the hooking process is a known legitimate application
+4. Review what user accounts have been active on the host during the capture period
+5. Force password resets for all accounts used on the compromised system
+6. Check for data exfiltration - keylog data being sent externally
+7. Examine the process tree to find how the keylogger was installed
+8. Scan for persistence mechanisms associated with the keylogger
+9. Review MFA tokens and session cookies that may have been captured
+', '["https://attack.mitre.org/techniques/T1056/001/","https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexw","https://www.sans.org/reading-room/whitepapers/detection/detecting-keyloggers-36062"]', '(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(GetAsyncKeyState|GetKeyState|GetKeyboardState|SetWindowsHookEx|SetWindowsHookExW|SetWindowsHookExA)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(keylog|key.?log|key.?stroke|key.?capture|keystroke.?log)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(Get-Clipboard|Set-Clipboard|clipboard.?monitor|ClipboardChanged)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(GetAsyncKeyState|GetKeyState|SetWindowsHookEx)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(keylog|key.?log|key.?stroke|key.?capture)")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ contains("log.winlog.event_data.ScriptBlockText", "GetAsyncKeyState") ||
+ contains("log.winlog.event_data.ScriptBlockText", "GetKeyboardState") ||
+ contains("log.winlog.event_data.ScriptBlockText", "SetWindowsHookEx") ||
+ contains("log.winlog.event_data.ScriptBlockText", "WH_KEYBOARD_LL") ||
+ contains("log.winlog.event_data.ScriptBlockText", "WH_KEYBOARD") ||
+ contains("log.winlog.event_data.ScriptBlockText", "MapVirtualKey") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Get-Keystrokes") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-Keylogger") ||
+ (
+ contains("log.winlog.event_data.ScriptBlockText", "user32.dll") &&
+ (
+ contains("log.winlog.event_data.ScriptBlockText", "GetAsyncKeyState") ||
+ contains("log.winlog.event_data.ScriptBlockText", "GetForegroundWindow") ||
+ contains("log.winlog.event_data.ScriptBlockText", "GetWindowText")
+ )
+ ) ||
+ (
+ contains("log.winlog.event_data.ScriptBlockText", "DllImport") &&
+ contains("log.winlog.event_data.ScriptBlockText", "user32") &&
+ contains("log.winlog.event_data.ScriptBlockText", "KeyState")
+ ) ||
+ contains("log.winlog.event_data.ScriptBlockText", "OpenClipboard") ||
+ contains("log.winlog.event_data.ScriptBlockText", "GetClipboardData") ||
+ contains("log.winlogEventDataScriptBlockText", "GetAsyncKeyState") ||
+ contains("log.winlogEventDataScriptBlockText", "SetWindowsHookEx") ||
+ contains("log.winlogEventDataScriptBlockText", "WH_KEYBOARD_LL")
+ )
+) ||
+(
+ equals("log.eventCode", "8") &&
+ contains("log.winlog.event_data.StartModule", "user32.dll") &&
+ contains("log.winlog.event_data.StartFunction", "SetWindowsHookEx")
+)
+', '2026-02-09 16:55:30.947595', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-15m","count":2}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (597, 'LaZagne Credential Harvester Detection', 3, 2, 1, 'Credential Access', 'T1555 - Credentials from Password Stores', 'Detects LaZagne credential harvesting tool execution. LaZagne is an open-source tool that
+retrieves credentials stored on a local computer from 25+ sources including browsers, email
+clients, databases, Wi-Fi passwords, Windows credentials, and more. The rule monitors for
+both the executable name and characteristic command-line arguments used by LaZagne.
+
+Next Steps:
+1. Immediately isolate the affected host to prevent credential abuse
+2. Identify all credential stores that may have been accessed
+3. Review the command-line arguments to determine which modules were used
+4. Reset passwords for all accounts stored on the compromised system
+5. Check browser credential stores, email clients, and Windows vaults
+6. Review Wi-Fi profiles for exposed network credentials
+7. Investigate the initial access vector and delivery mechanism
+8. Search for LaZagne execution across other endpoints
+', '["https://attack.mitre.org/techniques/T1555/","https://github.com/AlessandroZ/LaZagne","https://www.sans.org/blog/detecting-lazagne/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)lazagne\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)lazagne\\.exe$") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)lazagne\\s+(all|browsers|chats|databases|games|git|mails|maven|memory|multimedia|php|svn|sysadmin|wifi|windows)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)lazagne\\s+(all|browsers|chats|databases|games|git|mails|maven|memory|multimedia|php|svn|sysadmin|wifi|windows)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)lazagne\\.exe") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)lazagne\\.exe")
+)
+', '2026-02-09 16:55:31.086951', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (662, 'Windows: Credential Acquisition via Registry Hive Dumping', 3, 1, 1, 'Credential Access', 'T1003.002 - OS Credential Dumping: Security Account Manager', 'Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/","https://attack.mitre.org/techniques/T1003/002/"]', 'regexMatch("log.winlogEventDataProcessName", "reg.exe") && regexMatch("log.message", "(save|export)") && regexMatch("log.message", "(hklm\\sam|hklm\\security)")', '2026-02-09 16:57:24.102055', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (684, 'Windows: Multiple TS Gateway login failures', 3, 3, 2, 'Credential Access', 'T1110 - Brute Force', 'Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.', '["https://attack.mitre.org/techniques/T1110/"]', 'equals("log.eventCode", 1001) && contains("log.message", "Microsoft-Windows-TerminalServices")', '2026-02-09 16:57:27.167142', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (598, 'Regsvr32 LOLBIN Abuse Detection', 3, 3, 2, 'Defense Evasion', 'T1218.010 - System Binary Proxy Execution: Regsvr32', 'Detects suspicious regsvr32.exe usage including Squiblydoo attacks (loading remote SCT files),
+AppLocker bypass techniques, and execution of DLLs from suspicious locations. Regsvr32 is a
+signed Microsoft binary that can be abused to proxy execution of malicious code, bypassing
+application whitelisting controls.
+
+Next Steps:
+1. Examine the DLL or SCT file being loaded by regsvr32
+2. Check if a remote URL was used (Squiblydoo attack indicator)
+3. Analyze the parent process that launched regsvr32
+4. Review network connections made by the regsvr32 process
+5. Check if the loaded DLL is from a suspicious location (Temp, AppData, etc.)
+6. Block the remote URL if a network-based attack was used
+7. Investigate what payload was delivered through the proxy execution
+', '["https://attack.mitre.org/techniques/T1218/010/","https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/","https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)regsvr32\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)regsvr32\\.exe$")
+) &&
+(
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)/s.*/u.*/i:") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)/s.*/u.*/i:")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)/i:(http|https|ftp)://") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)/i:(http|https|ftp)://")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)\\.sct") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\.sct")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)scrobj\\.dll") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)scrobj\\.dll"))
+)
+', '2026-02-09 16:55:31.317477', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (599, 'LSASS Credential Dumping Detection', 3, 3, 1, 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'Detects multiple LSASS credential dumping techniques beyond Mimikatz, including comsvcs.dll MiniDump,
+procdump, nanodump, pypykatz, Task Manager dump, rundll32 with comsvcs.dll, and direct NT API calls.
+LSASS holds credentials for all authenticated users and is a primary target for credential theft.
+This rule complements the existing Mimikatz detection by covering alternative dumping methods.
+
+Next Steps:
+1. Immediately isolate the affected host to prevent lateral movement
+2. Identify the dumping technique used and the resulting dump file location
+3. Check if the dump file has been exfiltrated to an external destination
+4. Review the process tree to understand how the dumping tool was executed
+5. Reset passwords for all accounts that were logged into the compromised system
+6. Enable Credential Guard or RunAsPPL to protect LSASS
+7. Search for the same dumping technique across other endpoints
+8. Investigate the initial compromise vector
+', '["https://attack.mitre.org/techniques/T1003/001/","https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/","https://redcanary.com/threat-detection-report/techniques/lsass-memory/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)comsvcs\\.dll[,\\s]+(MiniDump|#24)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)comsvcs\\.dll[,\\s]+(MiniDump|#24)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)procdump.*-ma\\s+(lsass|\\d+)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)procdump.*-ma\\s+(lsass|\\d+)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)rundll32\\.exe.*comsvcs") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)rundll32\\.exe.*comsvcs")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(nanodump|handlekatz|physmem2profit|dumpert)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(nanodump|handlekatz|physmem2profit|dumpert)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)taskmgr.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)taskmgr.*lsass")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(Out-Minidump|Get-Process.*lsass.*\\.DumpProcess)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(Out-Minidump|Get-Process.*lsass.*\\.DumpProcess)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)sqldumper\\.exe.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)sqldumper\\.exe.*lsass")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)createdump\\.exe.*(-f|--full)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)createdump\\.exe.*(-f|--full)")
+ )
+)
+', '2026-02-09 16:55:31.677305', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (600, 'LSASS Memory Dump Alternatives', 3, 3, 1, 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'Detects alternatives to Mimikatz for dumping LSASS process memory, including procdump.exe,
+comsvcs.dll MiniDump via rundll32, Task Manager LSASS dump, and direct process access to LSASS.
+These tools are commonly used by attackers who avoid Mimikatz to extract credentials from memory.
+
+Next Steps:
+1. Isolate the affected host immediately to prevent lateral movement
+2. Identify the user account and parent process that initiated the dump
+3. Check if procdump or comsvcs.dll was used and from what directory
+4. Review for any exfiltration of the dump file to external destinations
+5. Reset all credentials that were potentially exposed on the affected host
+6. Investigate how the attacker obtained the privileges needed for LSASS access
+7. Search for evidence of credential reuse across the environment
+', '["https://attack.mitre.org/techniques/T1003/001/","https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/","https://redcanary.com/threat-detection-report/techniques/lsass-memory/"]', '(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)procdump.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)procdump.*lsass")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)rundll32.*comsvcs\\.dll.*MiniDump") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)rundll32.*comsvcs\\.dll.*MiniDump")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Out-Minidump.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Out-Minidump.*lsass")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)taskmgr.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)taskmgr.*lsass")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)sqldumper\\.exe.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)sqldumper\\.exe.*lsass")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)createdump\\.exe.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)createdump\\.exe.*lsass")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)rdrleakdiag\\.exe.*lsass") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)rdrleakdiag\\.exe.*lsass"))
+ )
+) ||
+(
+ equals("log.eventCode", "10") &&
+ regexMatch("log.winlog.event_data.TargetImage", "(?i)lsass\\.exe$") &&
+ oneOf("log.winlog.event_data.GrantedAccess", ["0x1010", "0x1038", "0x1fffff", "0x1410", "0x143a"])
+)
+', '2026-02-09 16:55:31.787234', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (601, 'Malicious PowerShell Execution', 3, 3, 2, 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'Detects malicious PowerShell execution patterns including encoded commands, download cradles,
+AMSI bypass attempts, execution policy bypasses, and common offensive PowerShell techniques.
+These patterns are frequently used by attackers for initial access, lateral movement, and
+payload delivery.
+
+Next Steps:
+1. Isolate the affected host immediately
+2. Decode any Base64-encoded command content for analysis
+3. Check parent process - unexpected parents (e.g., Word, Excel) indicate macro-based attacks
+4. Review network connections for download cradle destinations
+5. Examine PowerShell transcription and script block logs for full command content
+6. Search for persistence mechanisms created by the script
+7. Check if AMSI was successfully bypassed and what payload was executed
+8. Correlate with any recent phishing emails received by the user
+', '["https://attack.mitre.org/techniques/T1059/001/","https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging","https://www.fireeye.com/blog/threat-research/2016/02/greater_visibility_t.html"]', '(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)powershell\\.exe$|pwsh\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)powershell\\.exe$|pwsh\\.exe$")
+ ) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)-[eE][nN][cC]\\s+[A-Za-z0-9+/=]{50,}") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(-nop|-noni|-w\\s+hidden|-ep\\s+bypass|-exec\\s+bypass)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(DownloadString|DownloadFile|DownloadData|WebClient|Invoke-WebRequest|wget|curl|Start-BitsTransfer)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(Invoke-Expression|IEX|Invoke-Command)\\s*[\\(\\{]") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(Net\\.WebClient|IO\\.MemoryStream|IO\\.StreamReader|IO\\.Compression)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(FromBase64String|ToBase64String|\\[Convert\\]::)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)-[eE][nN][cC]\\s+[A-Za-z0-9+/=]{50,}") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(-nop|-noni|-w\\s+hidden|-ep\\s+bypass|-exec\\s+bypass)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(DownloadString|DownloadFile|DownloadData|WebClient|Invoke-WebRequest)")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ contains("log.winlog.event_data.ScriptBlockText", "AmsiInitFailed") ||
+ contains("log.winlog.event_data.ScriptBlockText", "amsiContext") ||
+ contains("log.winlog.event_data.ScriptBlockText", "AmsiUtils") ||
+ contains("log.winlog.event_data.ScriptBlockText", "amsi.dll") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)(Invoke-Obfuscation|Invoke-CradleCrafter|Out-EncodedCommand)") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)(New-Object\\s+Net\\.Sockets\\.TCPClient|Net\\.WebClient\\)?\\.DownloadString)") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)(\\$env:COMSPEC|cmd\\.exe.*/c)") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)(Add-Type.*DllImport|\\[DllImport)") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Reflection.Assembly") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-Shellcode") ||
+ contains("log.winlogEventDataScriptBlockText", "AmsiInitFailed") ||
+ contains("log.winlogEventDataScriptBlockText", "AmsiUtils") ||
+ regexMatch("log.winlogEventDataScriptBlockText", "(?i)(Invoke-Obfuscation|Invoke-CradleCrafter|Out-EncodedCommand)")
+ )
+)
+', '2026-02-09 16:55:31.922465', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-10m","count":2}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (602, 'Process Masquerading Detection', 2, 3, 2, 'Defense Evasion', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'Detects executables masquerading as legitimate Windows system processes but running from
+incorrect locations. For example, svchost.exe should only run from C:\Windows\System32,
+and explorer.exe should only run from C:\Windows. Malware commonly uses legitimate process
+names to avoid detection by analysts and automated tools.
+
+Next Steps:
+1. Identify the actual file path of the masquerading process
+2. Compare the file hash against known good versions of the legitimate binary
+3. Check the digital signature of the suspicious executable
+4. Analyze the executable in a sandbox environment
+5. Review the parent process that launched the masquerading binary
+6. Kill the suspicious process and quarantine the file
+7. Search for other instances of the same file across the environment
+', '["https://attack.mitre.org/techniques/T1036/005/","https://www.elastic.co/blog/how-hunt-masquerade-ball","https://redcanary.com/threat-detection-report/techniques/masquerading/"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\svchost\\.exe$") &&
+ !regexMatch("log.winlog.event_data.NewProcessName", "(?i)^C:\\\\Windows\\\\(System32|SysWOW64)\\\\svchost\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\csrss\\.exe$") &&
+ !regexMatch("log.winlog.event_data.NewProcessName", "(?i)^C:\\\\Windows\\\\(System32|SysWOW64)\\\\csrss\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\lsass\\.exe$") &&
+ !regexMatch("log.winlog.event_data.NewProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\lsass\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\services\\.exe$") &&
+ !regexMatch("log.winlog.event_data.NewProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\services\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\smss\\.exe$") &&
+ !regexMatch("log.winlog.event_data.NewProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\smss\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\wininit\\.exe$") &&
+ !regexMatch("log.winlog.event_data.NewProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\wininit\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\explorer\\.exe$") &&
+ !regexMatch("log.winlog.event_data.NewProcessName", "(?i)^C:\\\\Windows\\\\explorer\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlogEventDataProcessName", "(?i)\\\\svchost\\.exe$") &&
+ !regexMatch("log.winlogEventDataProcessName", "(?i)^C:\\\\Windows\\\\(System32|SysWOW64)\\\\svchost\\.exe$")
+ ) ||
+ (
+ regexMatch("log.winlogEventDataProcessName", "(?i)\\\\lsass\\.exe$") &&
+ !regexMatch("log.winlogEventDataProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\lsass\\.exe$")
+ )
+)
+', '2026-02-09 16:55:32.057137', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (603, 'Mimikatz Tool Usage Detection', 3, 3, 1, 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'Detects potential Mimikatz credential dumping tool usage through various indicators including characteristic command patterns, LSASS access, and known Mimikatz modules. Mimikatz is a well-known post-exploitation tool used to extract plaintext passwords, hash, PIN code and kerberos tickets from memory.
+
+Next Steps:
+1. Immediately isolate the affected host to prevent lateral movement
+2. Review the full command line and process execution details
+3. Check for any credential theft or privilege escalation activities
+4. Examine recent logon events and account usage patterns
+5. Scan for additional persistence mechanisms or backdoors
+6. Reset passwords for all potentially compromised accounts
+7. Review security logs for signs of lateral movement to other systems
+8. Conduct forensic analysis of memory dumps and system artifacts
+', '["https://attack.mitre.org/techniques/T1003/001/","https://github.com/gentilkiwi/mimikatz","https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688"]', '(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)mimikatz") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(sekurlsa|kerberos|crypto|vault|lsadump|dpapi)::") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(logonpasswords|pth|golden|silver|ticket)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)privilege::debug") ||
+ contains("log.winlog.event_data.CommandLine", "coffee") ||
+ contains("log.winlog.event_data.CommandLine", "kirbi")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)invoke-mimikatz") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)mimikatz\\.ps1") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)DumpCreds|DumpCerts") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Win32_ShadowCopy")
+ )
+) ||
+(
+ equals("log.eventCode", "10") &&
+ regexMatch("log.winlog.event_data.TargetImage", "(?i)lsass\\.exe") &&
+ oneOf("log.winlog.event_data.GrantedAccess", ["0x1010", "0x1038", "0x1418", "0x1438"])
+)
+', '2026-02-09 16:55:32.206941', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (604, 'MSHTA Suspicious Execution Detection', 2, 3, 2, 'Defense Evasion', 'T1218.005 - System Binary Proxy Execution: Mshta', 'Detects suspicious mshta.exe execution patterns including remote HTA file execution, inline
+VBScript/JavaScript execution, and COM scriptlet execution. MSHTA is a signed Microsoft binary
+that executes Microsoft HTML Applications (HTA) and is frequently abused for initial access,
+defense evasion, and payload delivery because it bypasses application whitelisting.
+
+Next Steps:
+1. Examine the full command line for remote URLs or inline script content
+2. Identify the parent process to determine the initial delivery mechanism
+3. Check for downloaded HTA files and analyze their contents
+4. Review network connections made by the mshta.exe process
+5. Block identified malicious URLs at the proxy/firewall
+6. Search for similar mshta executions across other endpoints
+7. Check for persistence mechanisms established after mshta execution
+', '["https://attack.mitre.org/techniques/T1218/005/","https://lolbas-project.github.io/lolbas/Binaries/Mshta/","https://redcanary.com/threat-detection-report/techniques/mshta/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)mshta\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)mshta\\.exe$")
+) &&
+(
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(http://|https://|ftp://)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(vbscript:|javascript:)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(GetObject|Execute|CreateObject|WScript\\.Shell)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)sct:") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)\\.hta\\s") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(http://|https://|ftp://)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(vbscript:|javascript:)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(GetObject|Execute|CreateObject|WScript\\.Shell)")
+)
+', '2026-02-09 16:55:32.342785', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (605, 'MSIExec Remote Payload Installation', 2, 3, 2, 'Defense Evasion', 'T1218.007 - System Binary Proxy Execution: Msiexec', 'Detects abuse of msiexec.exe for installing MSI packages from remote URLs, executing DLLs,
+or running packages with quiet/silent flags to avoid user interaction. Attackers use msiexec
+as a proxy to execute malicious code because it is a signed Microsoft binary that can download
+and execute payloads from remote locations.
+
+Next Steps:
+1. Examine the MSI package URL or path for malicious content
+2. Review the quiet/silent installation flags for evasion intent
+3. Check the parent process to determine the delivery mechanism
+4. Analyze the MSI package contents in a sandbox
+5. Review network connections to the MSI download source
+6. Block the identified URL at the proxy/firewall
+7. Search for the same MSI package hash across other endpoints
+', '["https://attack.mitre.org/techniques/T1218/007/","https://lolbas-project.github.io/lolbas/Binaries/Msiexec/","https://www.trendmicro.com/en_us/research/19/b/msiexec-abuse.html"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)msiexec\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)msiexec\\.exe$")
+) &&
+(
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)/i\\s+(http://|https://)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)/y\\s+") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)/z\\s+(http://|https://)") ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(/q|/quiet|/passive)") &&
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(http://|https://|\\\\\\\\)")
+ ) ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)/i\\s+(http://|https://)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)/y\\s+") ||
+ (
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(/q|/quiet|/passive)") &&
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(http://|https://|\\\\\\\\)")
+ )
+)
+', '2026-02-09 16:55:32.477220', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (606, 'Named Pipe Impersonation Attack', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1134.001 - Access Token Manipulation: Token Impersonation/Theft', 'Detects potential named pipe impersonation attacks used for privilege escalation. Monitors for suspicious process creation patterns including cmd.exe or powershell.exe with pipe-related commands, and processes creating named pipes with suspicious naming patterns commonly used by attack tools like Meterpreter and Cobalt Strike.
+
+Next Steps:
+1. Verify the legitimacy of the process and command line parameters
+2. Check for any privilege escalation activities following this event
+3. Examine the process parent-child relationship and execution context
+4. Review recent logon events (4672) for the affected host
+5. Investigate any unusual network connections or file access patterns
+6. Consider isolating the affected system if malicious activity is confirmed
+', '["https://bherunda.medium.com/hunting-named-pipe-token-impersonation-abuse-573dcca36ae0","https://attack.mitre.org/techniques/T1134/001/"]', 'equals("log.eventCode", "4688") &&
+exists("log.winlogEventDataProcessName") &&
+(contains("log.winlogEventDataProcessName", "cmd.exe") || contains("log.winlogEventDataProcessName", "powershell.exe")) &&
+exists("log.winlogEventDataProcessCommandLine") &&
+(contains("log.winlogEventDataProcessCommandLine", "\\\\.\\pipe\\") ||
+ (contains("log.winlogEventDataProcessCommandLine", "echo") && contains("log.winlogEventDataProcessCommandLine", "pipe")) ||
+ contains("log.winlogEventDataProcessCommandLine", "CreateNamedPipe") ||
+ contains("log.winlogEventDataProcessCommandLine", "ImpersonateNamedPipeClient"))
+', '2026-02-09 16:55:32.617610', true, false, 'origin', null, '[]', '["lastEvent.log.winlogEventDataProcessId","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (609, 'NTLM Authentication Downgrade Attack', 3, 3, 1, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects NTLM authentication downgrade attacks via registry modifications to LMCompatibilityLevel,
+NtlmMinClientSec, and NtlmMinServerSec. Attackers modify these registry values to weaken NTLM
+authentication security, enabling credential interception, relay attacks, and offline cracking
+of captured NTLM hashes. Downgrading to LM or NTLMv1 authentication makes credential theft
+significantly easier.
+
+Next Steps:
+1. Check the new registry value to determine the downgrade severity
+2. LMCompatibilityLevel < 3 enables NTLMv1 which is trivially crackable
+3. Identify the process and user that made the registry modification
+4. Restore the registry values to enforce NTLMv2 (LMCompatibilityLevel = 5)
+5. Review Group Policy for conflicting NTLM settings
+6. Check for NTLM relay attacks following the downgrade
+7. Audit network traffic for NTLMv1 authentication attempts
+8. Consider disabling NTLM entirely where possible
+', '["https://attack.mitre.org/techniques/T1562/001/","https://www.praetorian.com/blog/ntlm-relaying-attacks/","https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level"]', 'equals("log.eventCode", "4657") &&
+equals("log.winlogChannel", "Security") &&
+(
+ regexMatch("log.winlog.event_data.ObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\LMCompatibilityLevel") ||
+ regexMatch("log.winlog.event_data.ObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\NtlmMinClientSec") ||
+ regexMatch("log.winlog.event_data.ObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\NtlmMinServerSec") ||
+ regexMatch("log.winlog.event_data.ObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\RestrictSendingNTLMTraffic") ||
+ regexMatch("log.winlog.event_data.ObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\AuditReceivingNTLMTraffic") ||
+ regexMatch("log.winlog.event_data.ObjectName", "(?i)\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\RequireSignOrSeal")
+) &&
+!regexMatch("log.winlogEventDataSubjectUserName", "(?i)^(SYSTEM|TrustedInstaller)$")
+', '2026-02-09 16:55:33.052802', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (610, 'Pass-the-Hash Attack Detection', 3, 3, 2, 'Lateral Movement', 'T1550.002 - Use Alternate Authentication Material: Pass the Hash', 'Detects Pass-the-Hash attacks by monitoring for NTLM authentication (Event ID 4624) with
+LogonType 9 (NewCredentials) or LogonType 3 (Network) from unusual sources, combined with
+the use of Seclogon service. Attackers use stolen NTLM hashes to authenticate without
+knowing the plaintext password, commonly through tools like Mimikatz sekurlsa::pth,
+Impacket, or CrackMapExec.
+
+Next Steps:
+1. Identify the source IP and user account used for the NTLM authentication
+2. Verify if the source host should be authenticating with NTLM to this target
+3. Check for prior credential dumping activity on the source host
+4. Review if the authentication was followed by lateral movement or data access
+5. Reset the compromised account password and any related accounts
+6. Implement NTLM restrictions via Group Policy where possible
+7. Enable Windows Defender Credential Guard to protect NTLM hashes
+', '["https://attack.mitre.org/techniques/T1550/002/","https://www.sans.org/blog/pass-the-hash-attack-detection/","https://stealthbits.com/blog/how-to-detect-pass-the-hash-attacks/"]', '(
+ equals("log.eventCode", "4624") &&
+ equals("log.winlogChannel", "Security") &&
+ equals("log.winlog.event_data.LogonType", "9") &&
+ equals("log.winlog.event_data.AuthenticationPackageName", "Negotiate") &&
+ !regexMatch("log.winlogEventDataSubjectUserName", "(?i)^(SYSTEM|LOCAL SERVICE|NETWORK SERVICE|ANONYMOUS LOGON|-|\\$)") &&
+ exists("log.winlog.event_data.TargetUserName") &&
+ !regexMatch("log.winlog.event_data.TargetUserName", "(?i)\\$$")
+) ||
+(
+ equals("log.eventCode", "4624") &&
+ equals("log.winlogChannel", "Security") &&
+ equals("log.winlog.event_data.LogonType", "3") &&
+ equals("log.winlog.event_data.LmPackageName", "NTLM V1") &&
+ exists("log.winlog.event_data.IpAddress") &&
+ !equals("log.winlog.event_data.IpAddress", "-") &&
+ !equals("log.winlog.event_data.IpAddress", "::1") &&
+ !equals("log.winlog.event_data.IpAddress", "127.0.0.1")
+)
+', '2026-02-09 16:55:33.207633', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"},{"field":"log.eventCode","operator":"filter_term","value":"4624"}],"or":null,"within":"now-30m","count":3}]', '["lastEvent.log.winlogEventDataIpAddress","adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (611, 'Pass-the-Ticket Attack Detection', 3, 3, 2, 'Lateral Movement', 'T1550.003 - Use Alternate Authentication Material: Pass the Ticket', 'Detects Pass-the-Ticket attacks where attackers steal and reuse Kerberos tickets from one
+endpoint to authenticate on another. The rule monitors for Kerberos authentication events
+(Event ID 4624 LogonType 3 with Kerberos package) combined with anomalous ticket usage
+patterns and tools like Rubeus, Mimikatz kerberos::ptt, and Invoke-Mimikatz.
+
+Next Steps:
+1. Identify the source of the Kerberos ticket and the target system
+2. Check if the ticket was exported using Mimikatz or Rubeus
+3. Verify if the original ticket owner''s host is compromised
+4. Review Kerberos TGS/TGT events from the source IP
+5. Force Kerberos ticket renewal by resetting the user''s password
+6. Check for additional lateral movement from the authenticated session
+7. Implement Kerberos constrained delegation and armoring
+', '["https://attack.mitre.org/techniques/T1550/003/","https://adsecurity.org/?p=2011","https://www.sans.org/blog/kerberos-in-the-crosshairs-golden-tickets-silver-tickets-mitm-and-more/"]', '(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)kerberos::ptt") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)kerberos::ptt")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Rubeus.*ptt") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Rubeus.*ptt")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Rubeus.*(asktgt|asktgs|renew|s4u|createnetonly)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Rubeus.*(asktgt|asktgs|renew|s4u|createnetonly)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Invoke-Mimikatz.*kerberos") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Invoke-Mimikatz.*kerberos")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)klist.*purge|klist.*tickets") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)klist.*purge|klist.*tickets"))
+ )
+) ||
+(
+ equals("log.eventCode", "4768") &&
+ equals("log.winlogChannel", "Security") &&
+ !equals("log.winlog.event_data.Status", "0x0") &&
+ oneOf("log.winlog.event_data.Status", ["0x1f", "0x20", "0x25"]) &&
+ exists("log.winlog.event_data.IpAddress")
+)
+', '2026-02-09 16:55:33.357311', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (612, 'PetitPotam NTLM Relay Attack Detection', 3, 3, 2, 'Credential Access', 'T1187 - Forced Authentication', 'Detects PetitPotam NTLM relay attacks that abuse EFS RPC calls to coerce domain controller
+authentication. The attack forces a DC to authenticate to an attacker-controlled host, enabling
+NTLM relay to Active Directory Certificate Services (AD CS) for domain compromise. The rule
+monitors Event ID 5145 (network share access) for IPC$ share access to specific EFS-related
+named pipes used by PetitPotam.
+
+Next Steps:
+1. Identify the source IP attempting the EFS pipe access
+2. Check if the source is an authorized system or a potential attacker
+3. Verify if AD CS is configured and potentially vulnerable to NTLM relay
+4. Apply Microsoft patches for PetitPotam (KB5005413)
+5. Enable Extended Protection for Authentication on AD CS
+6. Disable NTLM authentication where possible
+7. Monitor for certificate enrollment from the relayed authentication
+8. Restrict access to EFS RPC endpoints via Windows Firewall rules
+', '["https://attack.mitre.org/techniques/T1187/","https://github.com/topotam/PetitPotam","https://msrc.microsoft.com/update-guide/vulnerability/ADV210003"]', 'equals("log.eventCode", "5145") &&
+equals("log.winlogChannel", "Security") &&
+equals("log.winlog.event_data.ShareName", "\\\\*\\IPC$") &&
+(
+ contains("log.winlog.event_data.RelativeTargetName", "efsrpc") ||
+ contains("log.winlog.event_data.RelativeTargetName", "lsarpc") ||
+ contains("log.winlog.event_data.RelativeTargetName", "efsr") ||
+ contains("log.winlog.event_data.RelativeTargetName", "samr")
+)
+', '2026-02-09 16:55:33.503148', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"}],"or":null,"within":"now-5m","count":3}]', '["lastEvent.log.winlogEventDataIpAddress","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (663, 'Windows: Detection of Exchange mail exported through PowerShell', 3, 1, 1, 'Collection', 'T1005 - Data from Local System', 'This rule identifies the use of an Exchange PowerShell cmdlet, which is used to export the contents of a core file. mailbox or archive to a .pst file. Adversaries can target user email to collect sensitive information.', '["https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1005/","https://attack.mitre.org/techniques/T1114/","https://attack.mitre.org/techniques/T1114/002/"]', 'regexMatch("log.winlogEventDataProcessName", "(powershell.exe|pwsh.exe|powershell_ise.exe)") && regexMatch("log.message", "(New-MailboxExportRequest)")', '2026-02-09 16:57:24.257506', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (613, 'PowerShell Empire Detection', 3, 3, 2, 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'Detects potential PowerShell Empire framework usage based on characteristic command patterns, obfuscation techniques, and encoded payloads commonly used by this post-exploitation framework. PowerShell Empire is a post-exploitation framework that uses PowerShell and Python agents to maintain persistence and execute commands on compromised systems.
+
+Next Steps:
+1. Immediately isolate the affected host to prevent lateral movement
+2. Analyze the complete PowerShell script block content for additional IOCs
+3. Check for persistence mechanisms (scheduled tasks, registry entries, services)
+4. Review network connections from the host for C2 communication
+5. Examine process tree and parent processes that spawned PowerShell
+6. Search for additional Empire artifacts across the environment
+7. Reset credentials for any accounts used on the compromised system
+8. Conduct memory analysis to identify injected code or payloads
+9. Review recent user activity and file access patterns
+10. Update endpoint detection rules based on specific Empire techniques observed
+', '["https://attack.mitre.org/techniques/T1059/001/","https://www.powershellempire.com/","https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging"]', '(equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+(
+ contains("log.winlog.event_data.ScriptBlockText", "System.Management.Automation.AmsiUtils") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)(empire|invoke-empire|invoke-psempire)") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)\\[System\\.Convert\\]::FromBase64String") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)IEX\\s*\\(\\s*New-Object") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)-enc\\s+[A-Za-z0-9+/=]{100,}") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)\\$DoIt\\s*=\\s*@") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)\\[System\\.Text\\.Encoding\\]::Unicode\\.GetString") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-Shellcode") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-ReflectivePEInjection") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-Mimikatz")
+)
+', '2026-02-09 16:55:33.596740', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (614, 'Print Spooler Exploitation Detection', 3, 3, 2, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects potential PrintNightmare exploitation attempts through suspicious print spooler activity including DLL loading and driver installation. This rule identifies suspicious activity related to the Print Spooler service that could indicate CVE-2021-34527 (PrintNightmare) exploitation attempts.
+
+Next Steps:
+1. Investigate the affected host for unauthorized driver installations
+2. Check for recent DLL files placed in the print spooler drivers directory
+3. Review print spooler service logs for unusual activity
+4. Examine process execution context and parent processes
+5. Verify if print driver installations were authorized
+6. Check for lateral movement from the affected system
+7. Consider isolating the affected host if exploitation is confirmed
+', '["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527","https://attack.mitre.org/techniques/T1068/"]', '(equals("log.winlogProviderName", "Microsoft-Windows-PrintService") && equals("log.winlogEventId", "316") && contains("log.message", "kernelbase.dll")) || (equals("log.winlogEventDataProcessName", "spoolsv.exe") && contains("log.winlogEventDataTargetFilename", "\\spool\\drivers\\x64\\") && endsWith("log.winlogEventDataTargetFilename", ".dll"))', '2026-02-09 16:55:33.682568', true, false, 'origin', null, '[]', '["lastEvent.log.winlogEventDataTargetFilename","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (615, 'Process Injection Techniques Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055 - Process Injection', 'Detects various process injection techniques including CreateRemoteThread, SetWindowsHookEx, and other methods used by malware to inject code into legitimate processes. This rule monitors for suspicious cross-process activities targeting critical Windows processes and detects PowerShell/command line usage of injection APIs.
+
+Next Steps:
+1. Investigate the source process and command line arguments for suspicious activity
+2. Examine the target process for signs of compromise or abnormal behavior
+3. Review process tree and parent-child relationships for the involved processes
+4. Check for additional suspicious network connections or file system activities from the same host
+5. Analyze memory dumps of target processes if available to confirm injection
+6. Review system logs for privilege escalation attempts around the same timeframe
+7. Correlate with threat intelligence to identify known malware families using similar techniques
+8. Consider isolating the affected system if malicious activity is confirmed
+', '["https://attack.mitre.org/techniques/T1055/","https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon","https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"]', '(
+ equals("log.eventCode", "8") &&
+ (
+ regexMatch("log.winlog.event_data.TargetImage", "(?i)(lsass\\.exe|csrss\\.exe|services\\.exe|winlogon\\.exe|svchost\\.exe|explorer\\.exe)") ||
+ (
+ regexMatch("log.winlog.event_data.SourceImage", "(?i)(powershell\\.exe|cmd\\.exe|rundll32\\.exe|regsvr32\\.exe)") &&
+ !regexMatch("log.winlog.event_data.TargetImage", "(?i)(conhost\\.exe)")
+ )
+ )
+) ||
+(
+ equals("log.eventCode", "10") &&
+ regexMatch("log.winlog.event_data.TargetImage", "(?i)(lsass\\.exe|csrss\\.exe|services\\.exe)") &&
+ oneOf("log.winlog.event_data.GrantedAccess", ["0x1F0FFF", "0x1F1FFF", "0x1FFFFF", "0x1F3FFF"]) &&
+ !regexMatch("log.winlog.event_data.SourceImage", "(?i)(taskmgr\\.exe|procexp\\.exe|procmon\\.exe|svchost\\.exe)")
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)VirtualAllocEx") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)WriteProcessMemory") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)CreateRemoteThread") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)NtQueueApcThread") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)SetWindowsHookEx") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)RtlCreateUserThread")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ (
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)\\[Kernel32\\]::(VirtualAllocEx|WriteProcessMemory|CreateRemoteThread)") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)\\[ntdll\\]::(NtQueueApcThread|RtlCreateUserThread)") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-ReflectivePEInjection") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Invoke-ProcessHollowing")
+ )
+)
+', '2026-02-09 16:55:33.887736', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.host","adversary.process"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (616, 'PsExec Lateral Movement Detection', 3, 3, 2, 'Lateral Movement', 'T1569.002 - System Services: Service Execution', 'Detects PsExec-style lateral movement by monitoring for the creation of the PSEXESVC service
+(Event ID 7045), PsExec named pipe creation, and process execution patterns characteristic
+of PsExec and its variants (Impacket PSExec, Metasploit PSExec). PsExec is the most common
+tool for lateral movement in enterprise environments.
+
+Next Steps:
+1. Identify the source host that initiated the PsExec connection
+2. Verify if this is authorized administrative activity
+3. Check what command was executed via PsExec on the target host
+4. Review the service account credentials used for PsExec authentication
+5. Search for evidence of PsExec usage across other hosts in the environment
+6. Check for credential theft that may have enabled the lateral movement
+7. Block PsExec at the network level if not authorized
+', '["https://attack.mitre.org/techniques/T1569/002/","https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PsExec.htm","https://www.sans.org/blog/psexec-and-lateral-movement/"]', '(
+ equals("log.eventCode", "7045") &&
+ (
+ regexMatch("log.winlog.event_data.ServiceName", "(?i)^(PSEXESVC|psexec|PAExec|csexec|remcom)") ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)(PSEXESVC|psexec|PAExec)\\.exe") ||
+ (regexMatch("log.winlog.event_data.ServiceFileName", "(?i)%SystemRoot%\\\\[a-zA-Z]{8}\\.exe") &&
+ regexMatch("log.winlog.event_data.ServiceName", "(?i)^[a-zA-Z]{8}$")) ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)cmd\\.exe\\s+/c.*\\\\\\\\[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+\\\\")
+ )
+) ||
+(
+ equals("log.eventCode", "17") &&
+ equals("log.winlog.provider_name", "Microsoft-Windows-Sysmon") &&
+ regexMatch("log.winlog.event_data.PipeName", "(?i)\\\\(psexesvc|paexec|csexec|remcom)")
+) ||
+(
+ equals("log.eventCode", "4688") &&
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\PSEXESVC\\.exe$") &&
+ exists("log.winlog.event_data.ParentProcessName")
+)
+', '2026-02-09 16:55:34.022716', true, false, 'origin', null, '[]', '["adversary.host","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (617, 'RDP Brute Force Attack', 3, 2, 2, 'Credential Access', 'T1110.001 - Brute Force: Password Guessing', 'Detects multiple failed RDP login attempts from the same source IP address, indicating a potential brute force attack. This rule monitors Windows Event ID 4625 (failed logon) with focus on network logon types (type 3) which are commonly used for RDP connections. The rule triggers when 10 or more failed attempts occur from the same IP within 15 minutes.
+
+Next Steps:
+1. Investigate the source IP address for malicious indicators and geolocation
+2. Check if the targeted user accounts are legitimate and active
+3. Review successful logons from the same IP after failed attempts
+4. Implement IP blocking or rate limiting for the source address
+5. Enable account lockout policies if not already configured
+6. Consider implementing multi-factor authentication for RDP access
+7. Review RDP access logs for any successful connections during the attack timeframe
+', '["https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625","https://attack.mitre.org/techniques/T1110/001/"]', 'equals("log.eventCode", "4625") && equals("log.winlogEventDataLogonType", "3") && exists("log.winlogEventDataIpAddress") && !equals("log.winlogEventDataIpAddress", "-") && !equals("log.winlogEventDataIpAddress", "::1") && !equals("log.winlogEventDataIpAddress", "127.0.0.1")', '2026-02-09 16:55:34.177974', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"},{"field":"log.eventCode","operator":"filter_term","value":"4625"},{"field":"log.winlogEventDataLogonType","operator":"filter_term","value":"3"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (618, 'RDP Session Hijacking Detection', 3, 3, 2, 'Lateral Movement', 'T1563.002 - Remote Service Session Hijacking: RDP Hijacking', 'Detects RDP session hijacking using tscon.exe, which allows a user with SYSTEM privileges
+to connect to another user''s RDP session without authentication. This is commonly used
+after privilege escalation to gain access to active sessions of other users, potentially
+including domain administrators.
+
+Next Steps:
+1. Identify which user''s session was hijacked via tscon
+2. Verify the SYSTEM-level access method used (service, scheduled task, etc.)
+3. Check what actions were performed in the hijacked session
+4. Review if the target session had access to sensitive resources
+5. Force logout the compromised session
+6. Investigate how the attacker obtained SYSTEM privileges
+7. Review all active RDP sessions on the affected server
+', '["https://attack.mitre.org/techniques/T1563/002/","https://medium.com/@youraveragetechnoob/rdp-session-hijacking-55ef3f85feaa","https://www.keysight.com/blogs/tech/nwvs/2022/09/21/rdp-session-hijacking"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)tscon(.exe)?\\s+\\d+\\s+/dest:") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)tscon(.exe)?\\s+\\d+\\s+/dest:")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)query\\s+session.*tscon") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)query\\s+session.*tscon")) ||
+ (regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\tscon\\.exe$") &&
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)\\d+\\s+/dest:"))
+)
+', '2026-02-09 16:55:34.322249', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (619, 'Registry Run Key Persistence Detection', 2, 3, 2, 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'Detects modifications to Windows Registry Run and RunOnce keys, which are the most fundamental
+Windows persistence mechanism. Attackers add entries to these keys to execute malicious code
+every time a user logs on or the system starts. The rule monitors Event ID 4657 (registry value
+modifications) for changes to Run/RunOnce keys with suspicious values pointing to unusual
+executable paths, scripts, or LOLBINs.
+
+Next Steps:
+1. Examine the registry value data to identify the persistence payload
+2. Verify if the modification was made by a legitimate software installer
+3. Check the modifying process and user account for compromise indicators
+4. Remove the malicious registry entry immediately
+5. Analyze the payload binary or script referenced in the registry value
+6. Search for additional persistence mechanisms on the same host
+7. Review the timeline of events leading to the registry modification
+', '["https://attack.mitre.org/techniques/T1547/001/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4657","https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"]', 'equals("log.eventCode", "4657") &&
+equals("log.winlogChannel", "Security") &&
+regexMatch("log.winlog.event_data.ObjectName", "(?i)(\\\\Run\\\\|\\\\RunOnce\\\\|\\\\RunOnceEx\\\\|\\\\RunServices\\\\|\\\\RunServicesOnce\\\\)") &&
+(
+ regexMatch("log.winlog.event_data.ObjectValueName", "(?i)(powershell|cmd|mshta|rundll32|regsvr32|certutil|wscript|cscript|bitsadmin)") ||
+ regexMatch("log.winlog.event_data.NewValue", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\)") ||
+ regexMatch("log.winlog.event_data.NewValue", "(?i)(powershell|cmd\\.exe\\s*/c|mshta|rundll32|regsvr32|certutil|wscript|cscript)") ||
+ regexMatch("log.winlog.event_data.NewValue", "(?i)(http://|https://|\\\\\\\\[0-9]+\\.[0-9]+)") ||
+ regexMatch("log.winlog.event_data.NewValue", "(?i)(-enc\\s|-encodedcommand|-w\\s+hidden)")
+)
+', '2026-02-09 16:55:34.457661', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (620, 'Rundll32 Suspicious Abuse Detection', 2, 3, 2, 'Defense Evasion', 'T1218.011 - System Binary Proxy Execution: Rundll32', 'Detects suspicious rundll32.exe usage patterns including loading DLLs from non-system paths,
+comsvcs.dll MiniDump for LSASS dumping, JavaScript/VBScript execution, and loading from Temp
+or Downloads directories. Rundll32 is a signed Microsoft binary frequently abused for defense
+evasion and code execution.
+
+Next Steps:
+1. Examine the DLL path and export function being called
+2. Verify the DLL is not loading from a suspicious location (Temp, Downloads, AppData)
+3. Check the parent process for delivery mechanism indicators
+4. Analyze the loaded DLL in a sandbox environment
+5. Review network connections made by the rundll32 process
+6. Check for process injection from the rundll32 process
+7. Search for the same DLL hash across other endpoints
+', '["https://attack.mitre.org/techniques/T1218/011/","https://lolbas-project.github.io/lolbas/Binaries/Rundll32/","https://redcanary.com/threat-detection-report/techniques/rundll32/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)rundll32\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)rundll32\\.exe$")
+) &&
+(
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)comsvcs\\.dll.*(MiniDump|#24)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(javascript:|vbscript:)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\).*\\.dll") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)shell32\\.dll.*ShellExec_RunDLL") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)advpack\\.dll.*RegisterOCX") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)url\\.dll.*FileProtocolHandler") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)zipfldr\\.dll.*RouteTheCall") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)comsvcs\\.dll.*(MiniDump|#24)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(javascript:|vbscript:)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\).*\\.dll")
+)
+', '2026-02-09 16:55:34.607663', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (621, 'SAM Database Access Attempt', 3, 3, 1, 'Credential Access', 'T1003.002 - OS Credential Dumping: Security Account Manager', 'Detects attempts to access the Security Account Manager (SAM) database, which contains local user account hashes. This activity may indicate credential dumping attempts by attackers trying to extract password hashes for offline cracking or lateral movement.
+
+Next Steps:
+1. Immediately investigate the user account and process that accessed the SAM database
+2. Check for any unusual processes running on the affected system
+3. Review recent logon events and privilege escalation activities
+4. Examine network connections from the affected host for lateral movement
+5. Consider isolating the affected system if malicious activity is confirmed
+6. Review security policies for SAM database access permissions
+7. Check for presence of credential dumping tools or suspicious files
+', '["https://attack.mitre.org/techniques/T1003/002/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661"]', 'equals("log.eventCode", "4663") &&
+equals("log.winlogChannel", "Security") &&
+(
+ endsWith("log.winlog.event_data.ObjectName", "\\SAM") ||
+ endsWith("log.winlog.event_data.ObjectName", "\\SECURITY") ||
+ endsWith("log.winlog.event_data.ObjectName", "\\SYSTEM")
+) &&
+oneOf("log.winlog.event_data.AccessMask", ["0x20019", "0x1f01ff", "0x40", "0x20", "0x1"])
+', '2026-02-09 16:55:34.738110', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (664, 'Windows: Remote Desktop Enabled in Windows Firewall by Netsh', 3, 3, 1, 'Defense Evasion', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/004/"]', 'regexMatch("log.winlogEventDataProcessName", "netsh.exe") && regexMatch("log.message", "(action=allow|enable=Yes|enable)") && regexMatch("log.message", "(localport=3389|RemoteDesktop|group=(.+)remote desktop(.+))")', '2026-02-09 16:57:24.361323', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (685, 'Windows: Outlook add-in was loaded by powershell, possible use for email collection', 3, 2, 1, 'Execution', 'T1114.001 - Email Collection: Local Email Collection', 'Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user is local system, such as Outlook storage or cache files.', '["https://attack.mitre.org/techniques/T1114/001/"]', 'contains("log.message", "Microsoft.Office.Interop.Outlook")', '2026-02-09 16:57:27.537070', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (622, 'Suspicious Scheduled Task Persistence', 2, 3, 2, 'Persistence', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'Detects creation of scheduled tasks from suspicious locations or executing suspicious binaries,
+which is one of the most common persistence mechanisms used by attackers. The rule monitors
+Event ID 4698 (scheduled task creation) for tasks that reference suspicious paths such as
+Temp, Downloads, AppData, or ProgramData directories, or execute known LOLBINs like
+PowerShell, certutil, rundll32, mshta, regsvr32, or cmd.exe with suspicious arguments.
+
+Next Steps:
+1. Examine the full TaskContent XML to understand what the scheduled task executes
+2. Identify the user account that created the task and verify authorization
+3. Check the task execution path for malicious payloads or scripts
+4. Review the trigger schedule for persistence timing patterns
+5. Remove the suspicious scheduled task immediately
+6. Search for additional persistence mechanisms on the same host
+7. Investigate the initial access vector that led to task creation
+', '["https://attack.mitre.org/techniques/T1053/005/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698","https://posts.specterops.io/abstracting-scheduled-task-creation-6d22febc27e7"]', 'equals("log.eventCode", "4698") &&
+equals("log.winlogChannel", "Security") &&
+(
+ regexMatch("log.winlog.event_data.TaskContent", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Public\\\\|\\\\Users\\\\Public\\\\)") ||
+ regexMatch("log.winlog.event_data.TaskContent", "(?i)(powershell|pwsh|cmd\\.exe|certutil|mshta|rundll32|regsvr32|cscript|wscript|msiexec|bitsadmin)") ||
+ regexMatch("log.winlog.event_data.TaskContent", "(?i)(-enc\\s|-encodedcommand|-nop|-w\\s+hidden|downloadstring|invoke-expression|iex)") ||
+ regexMatch("log.winlog.event_data.TaskContent", "(?i)(http://|https://|ftp://|\\\\\\\\[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+\\\\)")
+) &&
+!regexMatch("log.winlogEventDataSubjectUserName", "(?i)^(SYSTEM|LOCAL SERVICE|NETWORK SERVICE)$")
+', '2026-02-09 16:55:34.877531', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (625, 'Silver Ticket Attack Detection', 3, 3, 2, 'Credential Access', 'T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket', 'Detects Silver Ticket attacks where adversaries forge Kerberos TGS tickets using a service
+account''s NTLM hash, bypassing the KDC entirely. Unlike Golden Tickets, Silver Tickets target
+specific services. The rule detects TGS tickets presented without corresponding TGT requests,
+and service access events with anomalous Kerberos authentication patterns.
+
+Next Steps:
+1. Identify the targeted service and its associated service account
+2. Verify if the service account hash has been compromised via Kerberoasting
+3. Reset the targeted service account password immediately
+4. Review access logs for the targeted service for unauthorized activity
+5. Check for prior Kerberoasting activity targeting the same service SPN
+6. Investigate the source host for compromise indicators
+7. Implement AES-only encryption for service accounts
+8. Enable Kerberos PAC validation on the targeted services
+', '["https://attack.mitre.org/techniques/T1558/002/","https://adsecurity.org/?p=2011","https://www.sans.org/blog/kerberos-in-the-crosshairs-golden-tickets-silver-tickets-mitm-and-more/"]', 'equals("log.eventCode", "4769") &&
+equals("log.winlogChannel", "Security") &&
+(
+ equals("log.winlog.event_data.TicketEncryptionType", "0x17") &&
+ !regexMatch("log.winlog.event_data.ServiceName", "(?i)(krbtgt|\\$$)") &&
+ !oneOf("log.winlog.event_data.Status", ["0x0", "0x6"]) &&
+ exists("log.winlog.event_data.IpAddress")
+)
+', '2026-02-09 16:55:35.318520', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"}],"or":null,"within":"now-15m","count":5}]', '["lastEvent.log.winlogEventDataIpAddress","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (626, 'Sliver C2 Framework Detection', 3, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects Sliver C2 framework execution patterns and artifacts. Sliver is an increasingly popular
+open-source C2 framework replacing Cobalt Strike in many threat actor toolkits. The rule monitors
+for characteristic Sliver implant patterns including specific PowerShell stager patterns,
+named pipe names, and executable naming conventions.
+
+Next Steps:
+1. Identify the Sliver implant type (HTTP, HTTPS, mTLS, DNS, WireGuard)
+2. Check for network beaconing to C2 infrastructure
+3. Review the process tree for injection and post-exploitation activity
+4. Memory scan affected processes for Sliver implant shellcode
+5. Isolate the compromised host immediately
+6. Block identified C2 domains and IPs at the network perimeter
+7. Hunt for Sliver artifacts across all endpoints
+8. Review initial access vector (phishing, exploitation, etc.)
+', '["https://github.com/BishopFox/sliver","https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/","https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"]', '(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(sliver|sliverpb|silver-implant)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(sliver|sliverpb|silver-implant)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)\\\\\\\\.\\\\pipe\\\\(sliverpb|sliver-)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\\\\\\\.\\\\pipe\\\\(sliverpb|sliver-)") ||
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(DECISIVE_|MANAGING_|IMPRESSED_|LITERARY_|ENORMOUS_)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)\\$s=New-Object\\s+IO\\.MemoryStream.*FromBase64String.*IO\\.Compression\\.GzipStream.*IO\\.Compression\\.CompressionMode.*ReadToEnd") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\$s=New-Object\\s+IO\\.MemoryStream.*FromBase64String.*IO\\.Compression\\.GzipStream")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)\\$s=New-Object\\s+IO\\.MemoryStream.*IO\\.Compression\\.GzipStream.*IO\\.Compression\\.CompressionMode.*ReadToEnd") ||
+ contains("log.winlog.event_data.ScriptBlockText", "sliverpb") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)New-Object\\s+System\\.Net\\.Sockets\\.TCPClient.*IO\\.StreamReader.*IO\\.StreamWriter.*GetStream")
+ )
+)
+', '2026-02-09 16:55:35.462027', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (627, 'SMBv1 Usage Detection', 3, 2, 2, 'Lateral Movement', 'T1210 - Exploitation of Remote Services', 'Detects usage of the deprecated and vulnerable SMBv1 protocol which could be exploited for lateral movement or ransomware propagation. SMBv1 is susceptible to numerous security vulnerabilities including EternalBlue and should be disabled in favor of SMBv2/SMBv3.
+
+Next Steps:
+1. Immediately investigate the source system using SMBv1 and identify which service or application is still dependent on this protocol
+2. Review network traffic logs to determine if this is internal communication or external access attempts
+3. Check for any signs of exploitation attempts or successful compromises on the affected system
+4. Identify all systems in the environment that may still have SMBv1 enabled
+5. Plan migration to SMBv2/SMBv3 and disable SMBv1 on all systems where possible
+6. Monitor for any lateral movement patterns that may indicate ongoing compromise
+7. Consider implementing network segmentation to limit exposure if SMBv1 cannot be immediately disabled
+', '["https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3","https://attack.mitre.org/techniques/T1210/"]', 'equals("log.winlogEventId", "3000") && equals("log.winlogProviderName", "Microsoft-Windows-SMBServer") && contains("log.message", "SMB1")', '2026-02-09 16:55:35.601918', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (628, 'Startup Folder Persistence Detection', 2, 3, 2, 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'Detects file creation or modification in Windows Startup folders, which execute programs
+automatically on user login. Attackers drop malicious scripts, executables, or shortcut files
+into Startup folders for persistence. The rule monitors both per-user and system-wide Startup
+directories for suspicious file types.
+
+Next Steps:
+1. Identify the file dropped into the Startup folder and analyze its contents
+2. Check the parent process that created the file for suspicious origins
+3. Verify if the file is a legitimate application shortcut or a malicious payload
+4. Remove the suspicious file from the Startup folder
+5. Analyze the executable or script for malicious behavior in a sandbox
+6. Search for additional persistence mechanisms on the same host
+7. Investigate the initial access vector
+', '["https://attack.mitre.org/techniques/T1547/001/","https://docs.microsoft.com/en-us/windows/win32/shell/manage-program-startup","https://www.cybereason.com/blog/persistence-techniques-that-persist"]', '(
+ equals("log.eventCode", "11") &&
+ equals("log.winlog.provider_name", "Microsoft-Windows-Sysmon") &&
+ (
+ regexMatch("log.winlog.event_data.TargetFilename", "(?i)\\\\Start Menu\\\\Programs\\\\Startup\\\\") ||
+ regexMatch("log.winlog.event_data.TargetFilename", "(?i)\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\")
+ ) &&
+ regexMatch("log.winlog.event_data.TargetFilename", "(?i)\\.(exe|dll|bat|cmd|vbs|vbe|js|jse|wsf|wsh|ps1|hta|lnk|scr|pif)$")
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)copy.*\\\\Start Menu\\\\Programs\\\\Startup") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)copy.*\\\\Start Menu\\\\Programs\\\\Startup")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)move.*\\\\Start Menu\\\\Programs\\\\Startup") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)move.*\\\\Start Menu\\\\Programs\\\\Startup"))
+ )
+)
+', '2026-02-09 16:55:35.727202', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (629, 'Suspicious Service Installation Detection', 3, 3, 2, 'Persistence', 'T1543.003 - Create or Modify System Process: Windows Service', 'Detects installation of suspicious Windows services matching patterns from Cobalt Strike, Metasploit,
+Impacket PSExec, and Meterpreter payloads. Attackers commonly install malicious services for persistence,
+privilege escalation (getsystem), and lateral movement. The rule monitors Event ID 4697 for service
+installations with characteristic names, binary paths, or command-line patterns used by offensive frameworks.
+
+Next Steps:
+1. Examine the service binary path for malicious executables or scripts
+2. Check if the service name matches known offensive tool patterns
+3. Verify the installing user account and their authorization level
+4. Review the service configuration for suspicious startup types
+5. Stop and disable the suspicious service immediately
+6. Analyze the service binary in a sandbox environment
+7. Search for lateral movement indicators from the source host
+8. Check for other persistence mechanisms installed by the same actor
+', '["https://attack.mitre.org/techniques/T1543/003/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4697","https://www.sans.org/blog/red-team-tactics-hiding-windows-services/"]', 'equals("log.eventCode", "4697") &&
+equals("log.winlogChannel", "Security") &&
+(
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)(cmd\\.exe\\s*/c|powershell|pwsh|%COMSPEC%)") ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)(\\\\ADMIN\\$|\\\\C\\$|127\\.0\\.0\\.1)") ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)(rundll32|msiexec|regsvr32|mshta|certutil|bitsadmin)") ||
+ regexMatch("log.winlog.event_data.ServiceName", "(?i)^[a-zA-Z]{4,8}$") ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\)") ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)\\.exe\\s+[a-zA-Z0-9+/=]{50,}") ||
+ regexMatch("log.winlog.event_data.ServiceName", "(?i)(BTOBTO|meterpreter|msf|payload|beacon|cobalt)") ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)(comsvcs\\.dll|MiniDump|procdump|lsass)")
+)
+', '2026-02-09 16:55:35.872431', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (630, 'Sysmon Service Tampering Detection', 3, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects attempts to tamper with the Sysmon monitoring service including unloading the Sysmon
+driver, stopping or deleting the Sysmon service, modifying Sysmon configuration, or renaming
+the Sysmon binary. Attackers target Sysmon specifically because it provides rich endpoint
+telemetry that enables threat detection. Disabling Sysmon is a critical defense evasion step.
+
+Next Steps:
+1. Immediately investigate the process and user that tampered with Sysmon
+2. Restore Sysmon service and verify it is running correctly
+3. Check if the Sysmon driver is still loaded in the kernel
+4. Review what malicious activity occurred during the Sysmon outage
+5. Re-apply the Sysmon configuration from a known good backup
+6. Investigate the full attack chain that led to Sysmon tampering
+7. Consider implementing tamper protection for Sysmon
+', '["https://attack.mitre.org/techniques/T1562/001/","https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon","https://undev.ninja/sysmon-evasion-techniques/"]', '(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)sysmon.*-u") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)sysmon.*-u")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)sc(.exe)?\\s+(stop|delete|config)\\s+sysmon") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)sc(.exe)?\\s+(stop|delete|config)\\s+sysmon")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)net(.exe)?\\s+stop\\s+sysmon") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)net(.exe)?\\s+stop\\s+sysmon")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)fltMC(.exe)?\\s+unload\\s+sysmon") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)fltMC(.exe)?\\s+unload\\s+sysmon")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)taskkill.*/f.*/im\\s+sysmon") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)taskkill.*/f.*/im\\s+sysmon"))
+ )
+) ||
+(
+ equals("log.eventCode", "7045") &&
+ regexMatch("log.winlog.event_data.ServiceName", "(?i)sysmon") &&
+ !equals("log.winlog.event_data.ServiceType", "kernel mode driver")
+)
+', '2026-02-09 16:55:36.022480', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (631, 'File Timestomping Detection', 1, 3, 1, 'Defense Evasion', 'T1070.006 - Indicator Removal: Timestomp', 'Detects timestomping activities where attackers modify file creation or modification timestamps
+to blend malicious files with legitimate system files. Common tools include PowerShell
+Set-ItemProperty, timestomp.exe, NirCmd, and direct API calls to SetFileTime. This technique
+is used to evade forensic timeline analysis and make malicious files appear older.
+
+Next Steps:
+1. Identify which files had their timestamps modified
+2. Check if the modified timestamps match legitimate system file dates (common pattern)
+3. Analyze the files with modified timestamps for malicious content
+4. Review the process and user that performed the timestamp modification
+5. Investigate what the attacker was trying to hide with timestomping
+6. Use $MFT analysis to detect original timestamps vs modified ones
+7. Search for additional anti-forensic techniques on the same host
+', '["https://attack.mitre.org/techniques/T1070/006/","https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html","https://andreafortuna.org/2017/10/06/timestomping-what-it-is-and-how-to-detect-it/"]', '(
+ equals("log.eventCode", "2") &&
+ equals("log.winlog.provider_name", "Microsoft-Windows-Sysmon") &&
+ exists("log.winlog.event_data.PreviousCreationUtcTime") &&
+ exists("log.winlog.event_data.CreationUtcTime") &&
+ !regexMatch("log.winlog.event_data.Image", "(?i)(setup|install|update|patch|msiexec|TiWorker|TrustedInstaller|svchost)\\.exe$")
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)Set-ItemProperty.*CreationTime|Set-ItemProperty.*LastWriteTime|Set-ItemProperty.*LastAccessTime") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Set-ItemProperty.*CreationTime|Set-ItemProperty.*LastWriteTime|Set-ItemProperty.*LastAccessTime") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)timestomp|SetFileTime|NirCmd.*setfiletime") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)timestomp|SetFileTime|NirCmd.*setfiletime") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)\\[IO\\.File\\]::SetCreationTime|\\[IO\\.File\\]::SetLastWriteTime") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\[IO\\.File\\]::SetCreationTime|\\[IO\\.File\\]::SetLastWriteTime")
+ )
+)
+', '2026-02-09 16:55:36.173045', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (632, 'Windows Token Manipulation', 3, 3, 3, 'Defense Evasion, Privilege Escalation', 'Access Token Manipulation', 'Detects potential token manipulation attacks used for privilege escalation. Monitors for suspicious combinations of privileged service calls (4673) and operations on privileged objects (4674) along with special privilege assignments (4672) that include sensitive privileges like SeDebugPrivilege, SeImpersonatePrivilege, or SeTcbPrivilege commonly abused for token manipulation.', '["https://medium.com/palantir/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e","https://attack.mitre.org/techniques/T1134/"]', 'equals("log.eventCode", "4672") && exists("log.winlogEventDataPrivilegeList") && (contains("log.winlogEventDataPrivilegeList", "SeDebugPrivilege") || contains("log.winlogEventDataPrivilegeList", "SeImpersonatePrivilege") || contains("log.winlogEventDataPrivilegeList", "SeTcbPrivilege") || contains("log.winlogEventDataPrivilegeList", "SeAssignPrimaryTokenPrivilege") || contains("log.winlogEventDataPrivilegeList", "SeLoadDriverPrivilege") || contains("log.winlogEventDataPrivilegeList", "SeRestorePrivilege"))', '2026-02-09 16:55:36.322285', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"origin.host","operator":"filter_term","value":"{{origin.host}}"},{"field":"log.winlogEventDataTargetLogonId","operator":"filter_term","value":"{{log.winlogEventDataTargetLogonId}}"},{"field":"log.eventCode","operator":"should_terms","value":"4673,4674"}],"or":null,"within":"now-10m","count":3}]', '["lastEvent.log.winlogEventDataTargetLogonId","lastEvent.log.winlogEventDataTargetUserName","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (666, 'Windows: Microsoft Build Engine Started by an Office Application', 3, 3, 1, 'Defense Evasion', 'T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild', 'An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1127/001/"]', 'regexMatch("log.winlogEventDataProcessName", "MSBuild.exe") && regexMatch("log.winlogEventDataParentProcessName", "(eqnedt32.exe|excel.exe|fltldr.exe|msaccess.exe|mspub.exe|outlook.exe|powerpnt.exe|winword.exe)")', '2026-02-09 16:57:24.601846', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (633, 'Tunneling Service C2 Detection', 3, 2, 2, 'Command and Control', 'T1572 - Protocol Tunneling', 'Detects execution of tunneling services (ngrok, cloudflared, devtunnels, localtonet, bore, chisel)
+that create reverse tunnels for command and control or to expose internal services to the internet.
+These tools are increasingly abused by threat actors for persistent C2 channels that bypass
+network security controls because traffic appears as legitimate HTTPS connections.
+
+Next Steps:
+1. Identify the tunneling tool being used and its configuration
+2. Determine what internal service or port is being exposed
+3. Check if this is authorized usage (dev/test) or malicious
+4. Review the tunnel endpoint for C2 activity
+5. Block the tunneling tool and its associated domains at the firewall
+6. Terminate the tunnel process and remove the tool
+7. Check for data exfiltration through the tunnel
+8. Hunt for the same tunneling tool across other endpoints
+', '["https://attack.mitre.org/techniques/T1572/","https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/","https://ngrok.com/abuse"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)(ngrok|cloudflared|devtunnels|localtonet|bore|chisel|frpc|rathole)\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)(ngrok|cloudflared|devtunnels|localtonet|bore|chisel|frpc|rathole)\\.exe$") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)ngrok\\s+(http|tcp|tls|start)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)ngrok\\s+(http|tcp|tls|start)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)cloudflared\\s+tunnel\\s+(run|--url)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)cloudflared\\s+tunnel\\s+(run|--url)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)devtunnels\\s+(host|create|port)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)devtunnels\\s+(host|create|port)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)chisel\\s+(client|server)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)chisel\\s+(client|server)") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)frpc\\.exe.*-c") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)frpc\\.exe.*-c")
+)
+', '2026-02-09 16:55:36.471975', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (634, 'UAC Bypass Attempt Detection', 3, 3, 2, 'Privilege Escalation, Defense Evasion', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'Detects potential UAC bypass attempts by monitoring for processes with elevated privileges that were not launched through the proper UAC consent mechanism. This rule identifies processes running with elevated token types (TokenElevationTypeVirtual) without proper UAC consent flow, which may indicate an attempt to bypass User Account Control security measures.
+
+Next Steps:
+1. Investigate the process that triggered the alert - examine the process name, command line arguments, and parent process
+2. Check if the process is known legitimate software that should have elevated privileges
+3. Verify the user account that launched the process and their normal privilege level
+4. Look for other suspicious activities on the same host around the same time
+5. Check for known UAC bypass techniques such as DLL hijacking, registry manipulation, or abuse of auto-elevated processes
+6. Examine the process execution chain to identify the attack vector
+7. Consider isolating the affected system if malicious activity is confirmed
+8. Review security policies and UAC settings to prevent similar bypasses
+', '["https://attack.mitre.org/techniques/T1548/002/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4688"]', 'equals("log.winlogEventId", "4688") &&
+equals("log.winlogEventDataTokenElevationType", "2") &&
+!contains("log.winlogEventDataParentProcessName", "consent.exe") &&
+!contains("log.winlogEventDataProcessName", "TrustedInstaller.exe") &&
+!contains("log.winlogEventDataSubjectUserName", "SYSTEM") &&
+(contains("log.winlogEventDataParentProcessName", "fodhelper.exe") ||
+ contains("log.winlogEventDataParentProcessName", "computerdefaults.exe") ||
+ contains("log.winlogEventDataParentProcessName", "sdclt.exe") ||
+ contains("log.winlogEventDataParentProcessName", "slui.exe") ||
+ contains("log.winlogEventDataParentProcessName", "eventvwr.exe") ||
+ contains("log.winlogEventDataParentProcessName", "cmstp.exe") ||
+ contains("log.winlogEventDataParentProcessName", "msconfig.exe") ||
+ contains("log.winlogEventDataParentProcessName", "dccw.exe") ||
+ (contains("log.winlogEventDataProcessName", "cmd.exe") || contains("log.winlogEventDataProcessName", "powershell.exe") || contains("log.winlogEventDataProcessName", "pwsh.exe")))
+', '2026-02-09 16:55:36.612209', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (635, 'Volume Shadow Copy Deletion', 2, 3, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Detects deletion of Volume Shadow Copies which is commonly performed by ransomware to prevent recovery of encrypted files. This rule identifies various methods attackers use to delete shadow copies including vssadmin, wmic, PowerShell, wbadmin, and bcdedit commands.
+
+Next Steps:
+1. Immediately investigate the affected host for signs of ransomware activity
+2. Check for recent file encryption or unusual file modifications
+3. Review process execution timeline around the shadow copy deletion
+4. Verify if this was legitimate administrative activity or malicious
+5. Examine network connections and lateral movement indicators
+6. Check backup integrity and consider isolating the system if ransomware is confirmed
+7. Review user accounts and privileges involved in the activity
+', '["https://attack.mitre.org/techniques/T1490/","https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin"]', 'equals("log.winlogEventId", "4688") &&
+((endsWith("log.winlogEventDataProcessName", "vssadmin.exe") &&
+ (contains("log.winlogEventDataCommandLine", "delete shadows") ||
+ (contains("log.winlogEventDataCommandLine", "resize shadowstorage") &&
+ contains("log.winlogEventDataCommandLine", "maxsize=")))) ||
+ (endsWith("log.winlogEventDataProcessName", "wmic.exe") &&
+ contains("log.winlogEventDataCommandLine", "shadowcopy") &&
+ contains("log.winlogEventDataCommandLine", "delete")) ||
+ (endsWith("log.winlogEventDataProcessName", "powershell.exe") &&
+ (contains("log.winlogEventDataCommandLine", "Get-WmiObject") ||
+ contains("log.winlogEventDataCommandLine", "gwmi")) &&
+ contains("log.winlogEventDataCommandLine", "Win32_ShadowCopy") &&
+ contains("log.winlogEventDataCommandLine", "Delete()")) ||
+ (endsWith("log.winlogEventDataProcessName", "wbadmin.exe") &&
+ contains("log.winlogEventDataCommandLine", "delete") &&
+ (contains("log.winlogEventDataCommandLine", "catalog") ||
+ contains("log.winlogEventDataCommandLine", "backup"))) ||
+ (endsWith("log.winlogEventDataProcessName", "bcdedit.exe") &&
+ contains("log.winlogEventDataCommandLine", "recoveryenabled") &&
+ contains("log.winlogEventDataCommandLine", "no")))
+', '2026-02-09 16:55:36.752335', true, false, 'origin', null, '[]', '["lastEvent.log.winlogEventDataProcessName","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (636, 'Vulnerable Driver Loading Detection (BYOVD)', 3, 3, 3, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects Bring Your Own Vulnerable Driver (BYOVD) attacks where adversaries load known vulnerable
+kernel drivers to disable security tools, escalate privileges, or gain kernel-level access.
+This technique is increasingly used by ransomware groups and APTs to bypass endpoint protection.
+The rule monitors for service installations loading known vulnerable drivers and suspicious
+driver-related command patterns.
+
+Next Steps:
+1. Identify the loaded driver and check against known vulnerable driver lists (loldrivers.io)
+2. Examine the service installation that loaded the driver
+3. Check if endpoint security tools were disabled after driver loading
+4. Review the process that installed the vulnerable driver
+5. Remove the vulnerable driver and restore security tools
+6. Block the driver hash via WDAC or application control policies
+7. Check for privilege escalation or security tool tampering after driver load
+8. Search for the same driver across other endpoints
+', '["https://attack.mitre.org/techniques/T1068/","https://www.loldrivers.io/","https://github.com/magicsword-io/LOLDrivers"]', '(
+ equals("log.eventCode", "4697") &&
+ equals("log.winlogChannel", "Security") &&
+ (
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)(dbutil_2_3|dbutildrv2|rtcore64|gdrv|asio|ene\\.sys|procexp|viragt64|aswarpot|hw64|cpuz|gmer64|mhyprot2|kdmapper|iqvw64e|echo_driver|winio|amifldrv64|elby|vboxdrv|gpu_temp|nicm|phymemx64|micio64|directio64|blacklotus|irec|zemana)") ||
+ regexMatch("log.winlog.event_data.ServiceFileName", "(?i)\\.sys\\s*$")
+ )
+) ||
+(
+ (equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(sc\\.exe|sc)\\s+(create|start)\\s+.*type=\\s*kernel") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(sc\\.exe|sc)\\s+(create|start)\\s+.*type=\\s*kernel") ||
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(sc\\.exe|sc)\\s+create\\s+.*binPath=.*\\.sys") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(sc\\.exe|sc)\\s+create\\s+.*binPath=.*\\.sys")
+ )
+)
+', '2026-02-09 16:55:36.887600', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (667, 'Windows: Microsoft Build Engine Started by a Script Process', 3, 3, 2, 'Defense Evasion', 'T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild', 'An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1127/001/"]', 'regexMatch("log.winlogEventDataProcessName", "MSBuild.exe") && regexMatch("log.winlogEventDataParentProcessName", "(cmd.exe|powershell.exe|wscript.exe|cscript.exe)")', '2026-02-09 16:57:24.742855', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (637, 'Suspicious Admin Share Access Detection', 3, 3, 2, 'Lateral Movement', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 'Detects suspicious access to Windows administrative shares (C$, ADMIN$, IPC$) which is
+commonly used for lateral movement. While admin share access can be legitimate, attackers
+use these shares to copy payloads, execute remote commands, and move laterally across the
+network. The rule monitors Event ID 5140 (network share access) and Event ID 5145 (detailed
+share access) for admin share connections from non-standard sources.
+
+Next Steps:
+1. Identify the source IP and user account accessing the admin share
+2. Verify if this is authorized administrative access or IT operations
+3. Check what files were read or written to the admin share
+4. Review if tools or malware were copied via the share
+5. Check for service creation or scheduled task creation on the target
+6. Correlate with authentication events from the same source IP
+7. Block unauthorized admin share access via Group Policy
+', '["https://attack.mitre.org/techniques/T1021/002/","https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5140","https://www.sans.org/blog/detecting-lateral-movement-using-windows-admin-shares/"]', '(
+ equals("log.eventCode", "5140") &&
+ equals("log.winlogChannel", "Security") &&
+ regexMatch("log.winlog.event_data.ShareName", "(?i)\\\\\\*(C\\$|ADMIN\\$)$") &&
+ exists("log.winlog.event_data.IpAddress") &&
+ !equals("log.winlog.event_data.IpAddress", "::1") &&
+ !equals("log.winlog.event_data.IpAddress", "127.0.0.1") &&
+ !regexMatch("log.winlogEventDataSubjectUserName", "(?i)^(SYSTEM|LOCAL SERVICE|NETWORK SERVICE|\\$)") &&
+ !regexMatch("log.winlogEventDataSubjectUserName", "(?i)\\$$")
+) ||
+(
+ equals("log.eventCode", "5145") &&
+ equals("log.winlogChannel", "Security") &&
+ regexMatch("log.winlog.event_data.ShareName", "(?i)\\\\\\*(C\\$|ADMIN\\$)$") &&
+ regexMatch("log.winlog.event_data.RelativeTargetName", "(?i)\\.(exe|dll|bat|cmd|ps1|vbs|hta)$") &&
+ exists("log.winlog.event_data.IpAddress")
+)
+', '2026-02-09 16:55:37.037874', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataIpAddress","operator":"filter_term","value":"{{log.winlogEventDataIpAddress}}"}],"or":null,"within":"now-30m","count":3}]', '["lastEvent.log.winlogEventDataIpAddress","target.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (638, 'Windows Remote Management (WinRM) Abuse', 3, 3, 2, 'Lateral Movement', 'T1021.006 - Remote Services: Windows Remote Management', 'Detects potential abuse of Windows Remote Management (WinRM) for lateral movement. Monitors for successful logon events (4624) with network logon type 3 combined with privilege escalation (4672) and WinRM-related process activity, indicating remote command execution via WinRM.
+
+Next Steps:
+1. Investigate the source IP address and verify if it''s an authorized administrative workstation
+2. Review the target user account for any signs of compromise or unusual privilege usage
+3. Examine recent PowerShell execution logs and command history on the target system
+4. Check for concurrent suspicious activities from the same source IP across other systems
+5. Verify if the WinRM connection aligns with scheduled maintenance or authorized administrative tasks
+6. Review network traffic patterns between source and target systems for data exfiltration indicators
+7. Validate the legitimacy of any processes spawned through the WinRM session
+8. Consider implementing additional monitoring for WinRM usage if this represents unexpected activity
+', '["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WinRM.htm","https://attack.mitre.org/techniques/T1021/006/"]', 'equals("log.eventCode", "4624") && equals("log.winlogEventDataLogonType", "3") && exists("log.winlogEventDataProcessName") && (contains("log.winlogEventDataProcessName", "wsmprovhost.exe") || contains("log.winlogEventDataProcessName", "winrshost.exe") || contains("log.winlogEventDataProcessName", "powershell.exe"))', '2026-02-09 16:55:37.177609', true, false, 'origin', null, '[]', '["lastEvent.log.winlogEventDataTargetUserName","adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (639, 'Windows Defender Tampering Detection', 2, 3, 3, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects attempts to disable or tamper with Windows Defender components through registry modifications, service stops, or exclusion additions. This includes registry changes to disable antivirus features, stopping Windows Defender services, or using PowerShell commands to modify protection settings.
+
+Next Steps:
+1. Investigate the user account and process responsible for the tampering attempt
+2. Check if this is part of authorized maintenance or if it''s malicious activity
+3. Review recent logon events and process execution history on the affected host
+4. Verify Windows Defender configuration and ensure it''s properly restored
+5. Scan the system for malware that may have disabled protection
+6. Check for other security tool tampering attempts across the environment
+', '["https://attack.mitre.org/techniques/T1562/001/","https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus"]', '(equals("log.winlogEventId", "4657") &&
+ contains("log.winlogEventDataObjectName", "\\Windows Defender\\") &&
+ (contains("log.winlogEventDataObjectValueName", "DisableAntiSpyware") ||
+ contains("log.winlogEventDataObjectValueName", "DisableAntiVirus") ||
+ contains("log.winlogEventDataObjectValueName", "DisableRealtimeMonitoring"))) ||
+(equals("log.winlogEventId", "7040") &&
+ contains("log.winlogEventDataServiceName", "WinDefend") &&
+ equals("log.winlogEventDataNewState", "disabled")) ||
+(equals("log.winlogEventId", "4688") &&
+ contains("log.winlogEventDataCommandLine", "Set-MpPreference") &&
+ (contains("log.winlogEventDataCommandLine", "DisableRealtimeMonitoring") ||
+ contains("log.winlogEventDataCommandLine", "DisableIOAVProtection") ||
+ contains("log.winlogEventDataCommandLine", "DisableBehaviorMonitoring")))
+', '2026-02-09 16:55:37.322188', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (640, 'Windows Script Host Suspicious Execution', 3, 3, 2, 'Execution', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'Detects suspicious execution of wscript.exe and cscript.exe with potentially malicious script
+files or command-line arguments. Attackers commonly use Windows Script Host to execute VBScript
+and JScript payloads delivered via phishing emails, drive-by downloads, or as secondary
+payloads during an intrusion. The rule focuses on scripts executed from suspicious locations
+and with suspicious arguments.
+
+Next Steps:
+1. Identify the script file being executed and analyze its contents
+2. Check the parent process (e.g., Outlook, Word, browser) for phishing indicators
+3. Review the script file location for legitimacy
+4. Analyze any network connections made by the script
+5. Check if the script downloads or executes additional payloads
+6. Search for the same script across other endpoints
+7. Block the script and remove any persistence mechanisms it created
+', '["https://attack.mitre.org/techniques/T1059/005/","https://lolbas-project.github.io/lolbas/Binaries/Wscript/","https://lolbas-project.github.io/lolbas/Binaries/Cscript/"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ regexMatch("log.winlog.event_data.NewProcessName", "(?i)\\\\(wscript|cscript)\\.exe$") ||
+ regexMatch("log.winlogEventDataProcessName", "(?i)\\\\(wscript|cscript)\\.exe$")
+) &&
+(
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)//[eE]:(vbscript|jscript)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)//[eE]:(vbscript|jscript)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)(http://|https://|ftp://|\\\\\\\\[0-9])") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(http://|https://|ftp://|\\\\\\\\[0-9])")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)\\.(vbs|vbe|js|jse|wsf|wsh)\\s+(//B|//nologo)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)\\.(vbs|vbe|js|jse|wsf|wsh)\\s+(//B|//nologo)")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)(CreateObject|WScript\\.Shell|Scripting\\.FileSystemObject|ADODB\\.Stream)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(CreateObject|WScript\\.Shell|Scripting\\.FileSystemObject|ADODB\\.Stream)"))
+)
+', '2026-02-09 16:55:37.722818', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (668, 'Windows: Microsoft Build Engine Started by a System Process', 3, 3, 2, 'Defense Evasion', 'T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild', 'An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1127/001/"]', 'regexMatch("log.winlogEventDataProcessName", "MSBuild.exe") && regexMatch("log.winlogEventDataParentProcessName", "(explorer.exe|wmiprvse.exe)")', '2026-02-09 16:57:24.877528', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (641, 'WMI Event Subscription Persistence Detection', 2, 3, 2, 'Persistence', 'T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription', 'Detects creation of WMI event subscriptions used for stealthy persistence. Attackers create
+WMI event filters and consumers that execute commands when specific system events occur.
+This is a highly effective persistence mechanism because it survives reboots and is difficult
+to detect without specific monitoring. The rule monitors for wmic.exe commands creating
+event subscriptions and PowerShell WMI subscription creation patterns.
+
+Next Steps:
+1. Enumerate all WMI event subscriptions using Get-WMIObject or wmic
+2. Examine the event filter conditions and consumer actions
+3. Identify the command or script executed by the consumer
+4. Remove malicious WMI subscriptions immediately
+5. Check for related persistence mechanisms on the same host
+6. Review the timeline to identify the initial compromise
+7. Search for similar WMI persistence across other endpoints
+', '["https://attack.mitre.org/techniques/T1546/003/","https://www.fireeye.com/blog/threat-research/2016/08/wmi_vs_wmi_monitor.html","https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/"]', '(equals("log.eventCode", "4688") || equals("log.winlogEventId", 4688)) &&
+(
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)wmic.*(/namespace|__EventFilter|__EventConsumer|__FilterToConsumerBinding)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)wmic.*(/namespace|__EventFilter|__EventConsumer|__FilterToConsumerBinding)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)(Set-WmiInstance|New-CimInstance).*(__EventFilter|__EventConsumer|CommandLineEventConsumer|ActiveScriptEventConsumer)") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)(Set-WmiInstance|New-CimInstance).*(__EventFilter|__EventConsumer|CommandLineEventConsumer|ActiveScriptEventConsumer)")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)Register-WmiEvent") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Register-WmiEvent")
+ ) ||
+ (
+ regexMatch("log.winlog.event_data.CommandLine", "(?i)mofcomp\\.exe") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)mofcomp\\.exe")
+ )
+) ||
+(
+ (equals("log.eventCode", "4104") || equals("log.winlogEventId", 4104)) &&
+ equals("log.winlogProviderName", "Microsoft-Windows-PowerShell") &&
+ (
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)(__EventFilter|__EventConsumer|__FilterToConsumerBinding)") ||
+ regexMatch("log.winlog.event_data.ScriptBlockText", "(?i)(CommandLineEventConsumer|ActiveScriptEventConsumer)") ||
+ contains("log.winlog.event_data.ScriptBlockText", "Register-WmiEvent")
+ )
+)
+', '2026-02-09 16:55:37.832631', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (642, 'WMI Remote Command Execution Detection', 3, 3, 2, 'Lateral Movement', 'T1047 - Windows Management Instrumentation', 'Detects WMI-based remote command execution using wmic.exe /node: parameter or PowerShell
+Invoke-WmiMethod / Invoke-CimMethod for lateral movement. Attackers use WMI to execute
+commands on remote systems without dropping files to disk, making it a stealthy lateral
+movement technique that leverages built-in Windows functionality.
+
+Next Steps:
+1. Identify the target host specified in the /node: parameter
+2. Verify if this is authorized administrative WMI usage
+3. Check what process or command was executed on the remote host
+4. Review the credentials used for the WMI connection
+5. Search for WMI execution evidence on the target host
+6. Check for additional lateral movement from the same source
+7. Monitor for process creation events on the target system
+', '["https://attack.mitre.org/techniques/T1047/","https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf","https://www.sans.org/blog/wmi-for-detection-and-response/"]', '(equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
+(
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)wmic(.exe)?\\s+/node:") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)wmic(.exe)?\\s+/node:")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Invoke-WmiMethod.*-ComputerName") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Invoke-WmiMethod.*-ComputerName")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Invoke-CimMethod.*-ComputerName") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Invoke-CimMethod.*-ComputerName")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)Get-WmiObject.*-ComputerName.*Win32_Process") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)Get-WmiObject.*-ComputerName.*Win32_Process")) ||
+ (regexMatch("log.winlog.event_data.CommandLine", "(?i)wmic(.exe)?.*process\\s+call\\s+create") ||
+ regexMatch("log.winlogEventDataCommandLine", "(?i)wmic(.exe)?.*process\\s+call\\s+create"))
+)
+', '2026-02-09 16:55:37.932344', true, false, 'origin', null, '[]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (643, 'Windows: Changes to AdminSDHolder', 1, 2, 3, 'Privilege Escalation', 'T1087 - Account Discovery', 'This rule detects changes to the AdminSDHolder object within the Active Directory. The AdminSDHolder object is critical to maintaining the ACLs of highly privileged accounts and groups in the domain. Any unexpected modification to this object could indicate a privilege escalation attempt or malicious action.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1069/"]', 'regexMatch("log.action", "Directory Service Changes") && equals("log.eventCode", 5136) && regexMatch("log.eventDataObjectName", "AdminSDHolder")', '2026-02-09 16:57:21.592824', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (644, 'Windows: Hiding files with attrib.exe', 1, 2, 3, 'Defense Evasion', 'T1564 - Hide Artifacts', 'This correlation rule detects events where the attrib.exe tool is used to hide files on the system. Cloaking files using this tool can be an indicator of suspicious or malicious activity, as it could be used by malicious actors to evade detection and hide their presence on the system.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1564/"]', 'regexMatch("log.message", "(attrib +h|attrib.exe +h)")', '2026-02-09 16:57:21.731588', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (645, 'Windows: An attempt was made to set the Directory Services Restore Mode', 1, 2, 3, 'Collection', 'T1005 - Data from Local System', 'This event generates on every attempt made to set the Directory Services Restore Mode. Is a function on Active Directory Domain Controllers to take the server offline for emergency maintenance, particularly restoring backups of AD objects. It is accessed on Windows Server via the advanced startup menu, similarly to safe mode.', '["https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1005"]', 'equals("log.eventCode", 4794)', '2026-02-09 16:57:21.857127', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (646, 'Windows Defender: Antimalware engine found malware or other potentially unwanted software', 1, 2, 3, 'Execution', 'T1546 - Event Triggered Execution', 'This rule is triggered when the antimalware engine detects malware or potentially unwanted software on the system. This alert is critical to identify the presence of threats and unwanted software that may compromise system security and performance.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1546/"]', 'oneOf("log.eventCode", [1006, 1015, 1116]) && equals("log.winlogProviderName", "SecurityCenter")', '2026-02-09 16:57:22.002605', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (647, 'Windows: Possible Brute Force Attack', 2, 2, 3, 'Credential Access', 'T1110 - Brute Force', 'This rule is triggered when a pattern of repeated and rapid login attempts from the same IP address or source is detected. These login attempts may target specific user accounts or services in an attempt to crack passwords through automated brute force. The purpose of this rule is to identify possible malicious unauthorized access attempts and prevent a brute force attack against the system.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1110/"]', 'equals("log.eventCode", 4625)', '2026-02-09 16:57:22.123001', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventCode","operator":"filter_term","value":"{{log.eventCode}}"},{"field":"target.user","operator":"filter_term","value":"{{target.user}}"}],"or":null,"within":"now-5m","count":10}]', '["adversary.host","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (648, 'Windows Defender: Protection Disabled', 1, 2, 3, 'Defense Evasion', 'T1562 - Impair Defenses', 'This rule is triggered when it detects that Windows Defender protection has been turned off or disabled on the system. The alert is crucial to identify any unauthorized or malicious actions that may leave the system vulnerable to security threats.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/"]', 'oneOf("log.eventCode", [5001, 5012])', '2026-02-09 16:57:22.271978', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (649, 'Windows audit log was cleared', 1, 2, 3, 'Defense Evasion', 'T1070.001 - Indicator Removal: Clear Windows Event Logs', 'Detects when the Windows audit log (Security event log) has been cleared. Adversaries may clear event logs to remove evidence of an intrusion.', '["https://attack.mitre.org/techniques/T1070/001/"]', 'equals("log.eventCode", 1102)', '2026-02-09 16:57:22.382079', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (672, 'Windows: Possible sideloading of DLL via Microsoft antimalware service executable with MsMpEng process', 3, 3, 3, 'Defense Evasion', 'T1574 - Hijack Execution Flow', 'Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1574/"]', 'contains("log.winlogEventDataProcessName", "MsMpEng.exe") && !regexMatch("log.winlogEventDataProcessPath", "(:\\ProgramData\\Microsoft\\Windows Defender\\(.+).exe|:\\Program Files\\Windows Defender\\(.+).exe|:\\Program Files (x86)\\Windows Defender\\(.+).exe|:\\Program Files\\Microsoft Security Client\\(.+).exe|:\\Program Files (x86)\\Microsoft Security Client\\(.+).exe)")', '2026-02-09 16:57:25.447540', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (673, 'Windows: Microsoft IIS Service Account Password Dumped', 3, 2, 2, 'Credential Access', 'T1003 - OS Credential Dumping', 'Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'regexMatch("log.winlogEventDataProcessName", "appcmd.exe") && regexMatch("log.message", "(/list)") && regexMatch("log.message", "(/text(.+)password)")', '2026-02-09 16:57:25.592264', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (674, 'Windows: Microsoft IIS Connection Strings Decryption', 2, 3, 1, 'Credential Access', 'T1003 - OS Credential Dumping', 'Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'regexMatch("log.winlogEventDataProcessName", "aspnet_regiis.exe") && regexMatch("log.message", "(connectionStrings)") && regexMatch("log.message", "(-pdf)")', '2026-02-09 16:57:25.727013', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (675, 'Windows: IIS HTTP Logging Disabled', 3, 2, 3, 'Defense Evasion', 'T1562.002 - Impair Defenses: Disable Windows Event Logging', 'Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/002/"]', 'contains("log.winlogEventDataProcessName", "appcmd.exe") && regexMatch("log.message", "(/dontLog(.+):(.+)True)") && !(contains("log.winlogEventDataParentProcessName", "iissetup.exe"))', '2026-02-09 16:57:25.872866', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (676, 'Windows: LSASS Memory Dump Handle Access', 2, 3, 3, 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/","https://attack.mitre.org/techniques/T1003/001/"]', 'equals("log.eventCode", 4656) && regexMatch("log.winlogEventDataObjectName", "(:\\Windows\\System32\\lsass.exe|\\Device\\HarddiskVolume[A-Za-z?:\\]([A-Za-z?])?\\Windows\\System32\\lsass.exe)") && !regexMatch("log.winlogEventDataProcessName", "(:\\Program Files\\(.+).exe|:\\Program Files (x86)\\(.+).exe|:\\Windows\\system32\\wbem\\WmiPrvSE.exe|:\\Windows\\System32\\dllhost.exe|:\\Windows\\System32\\svchost.exe|:\\Windows\\System32\\msiexec.exe|:\\ProgramData\\Microsoft\\Windows Defender\\(.+).exe|:\\Windows\\explorer.exe)") && oneOf("log.winlogEventDataAccessMask", ["0x1fffff", "0x1010", "0x120089", "0x1F3FFF"])', '2026-02-09 16:57:26.037623', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (677, 'Windows: Microsoft security essentials - Virus detected', 3, 3, 2, 'Privilege Escalation', 'T1055 - Process Injection', 'Detect the presence of a virus or malware on the system using Microsoft Security Essentials. The rule correlates different threat detection events, represented by various Event IDs, to identify virus detection on the system.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1055/"]', 'oneOf("log.eventCode", [1107, 1117, 1116, 1118, 1119]) && equals("log.winlogProviderName", "Microsoft Antimalware")', '2026-02-09 16:57:26.177754', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (678, 'Windows: Potential Invoke-Mimikatz PowerShell Script', 3, 3, 2, 'Credential Access', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. This rule detects Invoke-Mimikatz PowerShell script and alike.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/","https://attack.mitre.org/techniques/T1003/001/"]', 'regexMatch("log.message", "(DumpCreds(.+)DumpCerts|DumpCerts(.+)DumpCreds|sekurlsa::logonpasswords|crypto::certificates(.+)CERT_SYSTEM_STORE_LOCAL_MACHINE|CERT_SYSTEM_STORE_LOCAL_MACHINE(.+)crypto::certificates)")', '2026-02-09 16:57:26.312528', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (679, 'Windows: Mounting Hidden or WebDav Remote Shares', 3, 2, 1, 'Lateral Movement', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 'Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration.', '["https://attack.mitre.org/tactics/TA0008/","https://attack.mitre.org/techniques/T1021/002/"]', 'regexMatch("log.winlogEventDataProcessName", "(net.exe|net1.exe)") && regexMatch("log.message", "(\\\\(.+)\\(.+)$|\\\\(.+)@SSL\\|http)") && contains("log.message", "/d") && contains("log.message", "use") && !(contains("log.winlogEventDataParentProcessName", "net.exe"))', '2026-02-09 16:57:26.462534', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (680, 'Windows: Multiple failed attempts to perform a privileged operation by the same user', 1, 2, 3, 'Privilege Escalation', 'T1110 - Brute Force', 'Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.', '["https://attack.mitre.org/techniques/T1110/"]', 'equals("log.eventCode", 577) || equals("log.eventCode", 4673)', '2026-02-09 16:57:26.607244', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventDataTargetUserName","operator":"filter_term","value":"{{log.eventDataTargetUserName}}"}],"or":null,"within":"now-10m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (686, 'Windows: Persistence via BITS Job Notify Cmdline', 2, 3, 2, 'Persistence', 'T1197 - BITS Jobs', 'An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1197/"]', 'contains("log.message", "BITS") && contains("log.eventDataParentProcessName", "svchost.exe") && !(regexMatch("log.winlogEventDataProcessName", "(:\\Windows\\System32\\WerFaultSecure.exe|:\\Windows\\System32\\WerFault.exe|:\\Windows\\System32\\wermgr.exe|:\\WINDOWS\\system32\\directxdatabaseupdater.exe)"))', '2026-02-09 16:57:27.643149', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (687, 'Windows: Persistence via TelemetryController Scheduled Task Hijack', 2, 3, 2, 'Persistence', 'T1053.005 - Scheduled Task', 'Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1053/005/"]', 'contains("log.message", "-cv") && contains("log.eventDataParentProcessName", "CompatTelRunner.exe") && !(regexMatch("log.winlogEventDataProcessName", "(conhost.exe|DeviceCensus.exe|CompatTelRunner.exe|DismHost.exe|rundll32.exe|powershell.exe)"))', '2026-02-09 16:57:27.782175', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (688, 'Windows: Persistence via Update Orchestrator Service Hijack', 2, 3, 2, 'Persistence', 'T1543.003 - Create or Modify System Process: Windows Service', 'Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1543/003/"]', 'contains("log.message", "UsoSvc") &&
+ regexMatch("log.eventDataParentProcessName", "C:\\\\Windows\\\\System32\\\\svchost\\.exe") &&
+ !regexMatch("log.winlogEventDataProcessName", "MoUsoCoreWorker\\.exe|OfficeC2RClient\\.exe") &&
+ !regexMatch("log.winlogEventDataProcessName", "ProgramData\\\\Microsoft\\\\Windows\\\\UUS\\\\Packages\\\\.*\\\\amd64\\\\MoUsoCoreWorker\\.exe|Windows\\\\System32\\\\UsoClient\\.exe|Windows\\\\System32\\\\MusNotification\\.exe|Windows\\\\System32\\\\MusNotificationUx\\.exe|Windows\\\\System32\\\\MusNotifyIcon\\.exe|Windows\\\\System32\\\\WerFault\\.exe|Windows\\\\System32\\\\WerMgr\\.exe|Windows\\\\UUS\\\\amd64\\\\MoUsoCoreWorker\\.exe|Windows\\\\System32\\\\MoUsoCoreWorker\\.exe|Windows\\\\UUS\\\\amd64\\\\UsoCoreWorker\\.exe|Windows\\\\System32\\\\UsoCoreWorker\\.exe|Program Files\\\\Common Files\\\\microsoft shared\\\\ClickToRun\\\\OfficeC2RClient\\.exe")
+', '2026-02-09 16:57:27.916875', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (689, 'Windows: Suspicious .NET Reflection via PowerShell', 3, 2, 1, 'Defense Evasion', 'T1055 - Process Injection', 'Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1055/"]', 'regexMatch("log.message", "(\\[Reflection.Assembly\\]::Load)")', '2026-02-09 16:57:28.062391', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (690, 'Windows: Persistence via WMI Event Subscription', 2, 3, 2, 'Persistence', 'T1546.003 - Event Triggered Execution: WMI Event Subscription', 'An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1546/003/"]', 'contains("log.message", "create") && regexMatch("log.message", "(ActiveScriptEventConsumer|CommandLineEventConsumer)") && contains("log.winlogEventDataProcessName", "wmic.exe")', '2026-02-09 16:57:28.217145', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (691, 'Windows: PowerShell Suspicious Payload Encoded and Compressed', 2, 3, 1, 'Defense Evasion', 'T1027 - Obfuscated Files or Information', 'Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1027/"]', 'regexMatch("log.message", "(FromBase64String)") && regexMatch("log.message", "(System.IO.Compression.DeflateStream|System.IO.Compression.GzipStream|IO.Compression.DeflateStream|IO.Compression.GzipStream)")', '2026-02-09 16:57:28.352028', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (692, 'Windows: PowerShell Share Enumeration Script', 3, 2, 1, 'Discovery', 'T1135 - Network Share Discovery', 'Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration.', '["https://attack.mitre.org/tactics/TA0007/","https://attack.mitre.org/techniques/T1135/"]', 'regexMatch("log.message", "(Invoke-ShareFinder|Invoke-ShareFinderThreaded|(shi1_netname(.+)shi1_remark)|shi1_remark(.+)shi1_netname|(NetShareEnum(.+)NetApiBufferFree)|(NetApiBufferFree(.+)NetShareEnum))")', '2026-02-09 16:57:28.487359', true, false, 'origin', '["adversary.user","adversary.ip"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (693, 'Windows: PowerShell MiniDump Script', 3, 3, 2, 'Credential Access', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1059/001/"]', 'regexMatch("log.message", "(MiniDumpWriteDump|MiniDumpWithFullMemory|pmuDetirWpmuDiniM)")', '2026-02-09 16:57:28.632435', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (694, 'Windows: Suspicious Portable Executable Encoded in Powershell Script', 2, 3, 1, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1059/"]', 'contains("log.message", "TVqQAAMAAAAEAAAA")', '2026-02-09 16:57:28.772158', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (695, 'Windows: Potential Process Injection via PowerShell', 3, 3, 2, 'Defense Evasion', 'T1055 - Process Injection', 'Detects the use of Windows API functions that are commonly abused by malware and security tools to load malicious code or inject it into remote processes.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1055/"]', 'regexMatch("log.message", "(WriteProcessMemory|CreateRemoteThread|NtCreateThreadEx|CreateThread|QueueUserAPC|SuspendThread|ResumeThread|GetDelegateForFunctionPointer)") && regexMatch("log.message", "(VirtualAlloc|VirtualAllocEx|VirtualProtect|LdrLoadDll|LoadLibrary|LoadLibraryA|LoadLibraryEx|GetProcAddress|OpenProcess|OpenProcessToken|AdjustTokenPrivileges)")', '2026-02-09 16:57:28.912487', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (698, 'Windows: PowerShell Suspicious Discovery Related Windows API Functions', 2, 1, 3, 'Discovery', 'T1069 - Permission Groups Discovery', 'This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.', '["https://attack.mitre.org/tactics/TA0007/","https://attack.mitre.org/techniques/T1069/"]', 'contains("log.message", ["NetShareEnum", "NetWkstaUserEnum", "NetSessionEnum", "NetLocalGroupEnum", "NetLocalGroupGetMembers", "DsGetSiteName", "DsEnumerateDomainTrusts", "WTSEnumerateSessionsEx", "WTSQuerySessionInformation", "LsaGetLogonSessionData", "QueryServiceObjectSecurity"])
+', '2026-02-09 16:57:29.362698', true, false, 'origin', '["adversary.user","adversary.ip"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (699, 'Windows: PowerShell Script with Token Impersonation Capabilities', 3, 3, 2, 'Privilege Escalation', 'Token Impersonation/Theft', 'Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user''s token to escalate privileges and bypass access controls.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1134/001/"]', 'oneOf("log.message", ["Invoke-TokenManipulation", "ImpersonateNamedPipeClient", "NtImpersonateThread"]) ||
+(regexMatch("log.message", "(UpdateProcThreadAttribute(.+)STARTUPINFOEX|STARTUPINFOEX(.+)UpdateProcThreadAttribute)") &&
+regexMatch("log.message", "(AdjustTokenPrivileges(.+)SeDebugPrivilege|SeDebugPrivilege(.+)AdjustTokenPrivileges)")) ||
+regexMatch("log.message", "((SetThreadToken|ImpersonateLoggedOnUser|CreateProcessWithTokenW|CreatePRocessAsUserW|CreateProcessAsUserA)(.+)(DuplicateToken|DuplicateTokenEx)|(DuplicateToken|DuplicateTokenEx)(.+)(SetThreadToken|ImpersonateLoggedOnUser|CreateProcessWithTokenW|CreatePRocessAsUserW|CreateProcessAsUserA))")
+', '2026-02-09 16:57:29.503068', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (700, 'Windows: Possible addition of new item to Windows startup registry', 2, 3, 1, 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the run keys in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account''s associated permissions level.', '["https://attack.mitre.org/techniques/T1547/001/"]', 'regexMatch("log.message", "(SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run)")', '2026-02-09 16:57:29.657594', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (701, 'Windows: User logged using Remote Desktop Connection from loopback address, possible exploit over reverse tunneling using stolen credentials', 3, 2, 1, 'Credential Access', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.', '["https://attack.mitre.org/techniques/T1021/001/"]', 'equals("log.eventData.logonType", "10") && oneOf("log.origin.ips", ["::1", "127.0.0.1"]) && oneOf("log.eventCode", [528, 540, 673, 4624, 4769])', '2026-02-09 16:57:29.803044', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (702, 'Windows: Probable Password guessing', 2, 2, 3, 'Credential Access', 'T1110.001 - Brute Force: Password Guessing', 'Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target''s policies on password complexity or use policies that may lock accounts out after a number of failed attempts.', '["https://attack.mitre.org/tactics/TA0006","https://attack.mitre.org/techniques/T1110/001/"]', 'oneOf("log.eventCode", [4625, 529, 530, 531, 532, 533, 534, 535, 536, 537, 539])', '2026-02-09 16:57:29.942456', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventCode","operator":"filter_term","value":"{{log.eventCode}}"},{"field":"log.eventDataTargetUserName","operator":"filter_term","value":"{{log.eventDataTargetUserName}}"}],"or":null,"within":"now-5m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (703, 'Windows: Printer driver failed to load, possible remote code execution using PrinterNightmare exploit: CVE-2021-34527', 3, 2, 1, 'Lateral Movement', 'T1210 - Exploitation of Remote Services', 'Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.', '["https://attack.mitre.org/techniques/T1210/"]', 'equals("log.eventCode", 808) && oneOf("log.severityLabel", ["Error", "error"])', '2026-02-09 16:57:30.092232', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (704, 'Windows: Potential DNS Tunneling via NsLookup', 3, 2, 1, 'Command and Control', 'T1071 - Application Layer Protocol', 'This rule identifies a large number of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol.', '["https://attack.mitre.org/tactics/TA0011/","https://attack.mitre.org/techniques/T1071/"]', 'contains("log.eventDataProcessName", "nslookup.exe") && regexMatch("log.message", "(-querytype=|-qt=|-q=|-type=)")', '2026-02-09 16:57:30.237296', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (705, 'Windows: Potential Credential Access via DuplicateHandle in LSASS', 3, 1, 2, 'Credential Access', 'T1003 - OS Credential Dumping', 'Identifies suspicious access to an LSASS handle via DuplicateHandle. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'equals("log.eventCode", 10) && contains("log.eventDataProcessName", "lsass.exe") && equals("log.eventDataGrantedAccess", "0x40") && regexMatch("log.eventDataCallTrace", "(UNKNOWN)")', '2026-02-09 16:57:30.612281', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (708, 'Windows: Persistence via PowerShell profile', 2, 3, 1, 'Persistence', 'T1546.013 - Event Triggered Execution: PowerShell Profile', 'Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1098/002/"]', 'regexMatch("log.eventDataProcessName", "(:\\Users\\(.+)\\Documents\\WindowsPowerShell\\|:\\Users\\(.+)\\Documents\\PowerShell\\|:\\Windows\\System32\\WindowsPowerShell\\)") && regexMatch("log.eventDataProcessName", "(profile.ps1|Microsoft.Powershell_profile.ps1)")', '2026-02-09 16:57:31.091997', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (710, 'Windows: Suspicious PrintSpooler Service Executable File Creation', 2, 3, 1, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE''s - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1068/"]', '!regexMatch("log.file.path", "(\\Windows\\System32\\spool\\|:\\Windows\\Temp\\|:\\Users\\)") && contains("log.winlogEventDataProcessName", "spoolsv.exe")
+', '2026-02-09 16:57:31.392689', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (711, 'Windows: Suspicious Print Spooler SPL File Created', 1, 3, 2, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1068/"]', '!regexMatch("log.winlogEventDataProcessName", "(spoolsv.exe|printfilterpipelinesvc.exe|PrintIsolationHost.exe|splwow64.exe|msiexec.exe|poqexec.exe)") && regexMatch("log.winlogEventDataProcessName", "(:\\Windows\\System32\\spool\\PRINTERS\\)")
+', '2026-02-09 16:57:31.567065', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (712, 'Windows: Potential Modification of Accessibility Binaries', 2, 3, 1, 'Persistence', 'T1546.008 - Event Triggered Execution: Accessibility Features', 'Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1546/008/"]', '!regexMatch("log.winlogEventDataProcessName", "(osk.exe|sethc.exe|utilman2.exe|DisplaySwitch.exe|ATBroker.exe|ScreenMagnifier.exe|SR.exe|Narrator.exe|magnify.exe|MAGNIFY.EXE)") &&
+ regexMatch("log.winlogEventDataParentProcessName", "(Utilman.exe|winlogon.exe)") &&
+ contains("log.winlogEventDataSubjectUserName", "SYSTEM") &&
+ regexMatch("log.message", "(C:\\Windows\\System32\\osk.exe|C:\\Windows\\System32\\Magnify.exe|C:\\Windows\\System32\\Narrator.exe|C:\\Windows\\System32\\Sethc.exe|utilman.exe|ATBroker.exe|DisplaySwitch.exe|sethc.exe)")
+', '2026-02-09 16:57:31.717760', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (713, 'Windows: Privilege Escalation via Rogue Named Pipe Impersonation', 1, 3, 2, 'Privilege Escalation', 'T1134 - Access Token Manipulation', 'Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1134/"]', 'regexMatch("log.winlogEventDataProcessName", "(\\(.+)\\Pipe\\)") && contains("log.action", "Pipe Created")', '2026-02-09 16:57:31.847939', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (714, 'Windows: Suspicious Microsoft Diagnostics Wizard Execution with args IT_RebrowseForFile=, ms-msdt:/id, ms-msdt:-id or FromBase64', 2, 3, 1, 'Defense Evasion', 'T1218 - System Binary Proxy Execution', 'Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1218/"]', 'contains("log.winlogEventDataProcessName", "msdt.exe") && regexMatch("log.message", "(IT_RebrowseForFile=|ms-msdt:/id|ms-msdt:-id|FromBase64)")', '2026-02-09 16:57:32.012613', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (715, 'Windows: Possible ransomware attack detected. Multiple File Deletion.', 1, 3, 2, 'Impact', 'T1486 - Data Encrypted for Impact', 'Detects potential ransomware activity by monitoring multiple file write/modification events (Event ID 4663) with write access masks in user directories within a short timeframe. Modern ransomware typically encrypts files in-place rather than deleting them, making write access monitoring more effective than deletion monitoring alone.', '["https://attack.mitre.org/tactics/TA0040/"]', 'equals("log.eventCode", 4663) &&
+oneOf("log.winlogEventDataAccessMask", ["0x2", "0x4", "0x6"]) &&
+!(regexMatch("log.winlogEventDataProcessName", "(?i).*(trustedinstaller|svchost|wuauclt|msiexec|windows10upgrade|setuphost|tiworker|dism).*")) &&
+regexMatch("log.winlogEventDataObjectName", "(?i).*\\\\(users|documents|desktop|downloads|pictures|videos|music)\\\\.*") &&
+!(regexMatch("log.winlogEventDataObjectName", "(?i).*(\\\\windows\\\\|\\\\program files|\\\\programdata\\\\|\\\\temp\\\\|\\\\appdata\\\\local\\\\temp|\\\\softwaredistribution\\\\|\\\\winsxs\\\\|\\\\logs\\\\|\\\\prefetch\\\\).*")) &&
+!(regexMatch("log.winlogEventDataObjectName", "(?i).*\\.(tmp|log|etl|dmp|pf|evtx|cache|dat|bak)$")) &&
+regexMatch("log.winlogEventDataObjectName", "(?i).*\\.(doc[x]?|xls[x]?|ppt[x]?|pdf|txt|jpg|jpeg|png|gif|bmp|mp4|avi|mp3|zip|rar|7z)$")
+', '2026-02-09 16:57:32.167948', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventCode","operator":"filter_term","value":"4663"},{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-5m","count":50}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (716, 'Windows: Possible ransomware attack detected. Ransomware Note Creation.', 3, 3, 2, 'Impact', 'T1486 - Data Encrypted for Impact', 'Ransomware, is a type of malware that prevents users from accessing their system or personal files and requires payment of a ransom in order to gain access to them again. Identifies ransomware attempts. A known ransomware note file has been detected, potentially indicating an active ransomware infection.', '["https://attack.mitre.org/tactics/TA0040/"]', 'equals("log.eventCode", 4663) && regexMatch("log.wineventlogEventDataFileName", "(README_TO_RESTORE_FILES|INSTRUCTION_TO_GET_FILES_BACK|HOW_TO_DECRYPT_FILES|DECRYPT_INSTRUCTION|RECOVER_INSTRUCTION|RESTORE_FILES|READ_ME_NOW|YOUR_FILES_ARE_ENCRYPTED|IMPORTANT_INSTRUCTIONS|NOTICE|DECRYPT_YOUR_FILES|HOW_TO_RESTORE_FILES|HELP_DECRYPT|RECOVERY_FILE|RECOVER-FILES|INSTRUCTION)\\.(txt|html|php)$")', '2026-02-09 16:57:32.327353', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventCode","operator":"filter_term","value":"{{log.eventCode}}"},{"field":"log.wineventlogEventDataFileName","operator":"filter_term","value":"{{log.wineventlogEventDataFileName}}"}],"or":null,"within":"now-60s","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (709, 'Windows Firewall Disabled via PowerShell', 1, 2, 3, 'Defense Evasion', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1562/004/"]', 'regexMatch("log.message", "(-All|Public|Domain|Private)") && contains("log.message", "False") && contains("log.message", "-Enabled") && contains("log.message", "Set-NetFirewallProfile") && regexMatch("log.winlogEventDataProcessName", "(powershell.exe|pwsh.exe|powershell_ise.exe)")', '2026-02-09 16:57:31.246608', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (717, 'Windows: Possible ransomware attack detected. Unusual File Extensions.', 3, 3, 3, 'Impact', 'T1486 - Data Encrypted for Impact', 'Ransomware, is a type of malware that prevents users from accessing their system or personal files and requires payment of a ransom in order to gain access to them again. Identifies ransomware attempts. Files with unusual file extensions have been detected, potentially indicating encrypted files created by ransomware.', '["https://attack.mitre.org/tactics/TA0040/"]', 'equals("log.eventCode", 4663) && regexMatch("log.eventDataFileName", "\\.(7z\\.encrypted|aaa|abcd|abtc|acc|aes256|aes_ni|aes256ctr|aes256encrypted|aes_gcm|ajp|alcatraz_locked|alfa|amnesia[1-9]?|amsi|apocalypse666|armadillo|arrow|asasin|asi|atom128|auditor|aurora|autoit|avastvirusinfo|avenger|av666|azero|barak|barrax|bart|beef|beetle|bip|bit|bitcoin|bl2r|blackblock|blackmail|blast|blind|bmw|boot|braincrypt[3-8]?|broken|btcware|budak|bull|buydecryptor|cakl|calipso|calum|carote|cats|cbf|cccmn|ccrypt|cerber[3-9]?|chifrator|chimera|ciphered|crypted|clover|cobra|codnat3|combo|comrade|conficker|coot|cpt|crash|crimson|cry|crypt\\d{3,4}|crypt38|crypt72|crypt888|cryptinfinite|cryptolocker|cryptowall|cryptxxx|crypz|csfr|csone|ctb[1-4]|ctb-locker|ctrsa|cryptowin|cube|dcrpt|ddtf|dr2|dragon|dried|druid|ducky|ecrpt|eeta|etr|ee|f[0-9]{3,4}|flock|grt|grt[0-9]+|grtlock|gwz|h3ll|hades|hakunamatata|hallucinating|happy|harmful|harrow|havoc|headdesk|helpdecrypt|hermes|hidden|hideous|hijack|hilda|hitler|hjg|hmpl|hrosas|hsdf|hushed|hwrm|ihsdj|ikarus|ikasir|ikayed|ill|imbtc|img|encrypted|improved|indrik|injected|innocent|insane|interesante|jungle|kaos|karl|katana|kimcilware|kin|kiratos|kiss|kjh|locked|locky|lokf|losers|lukitus|m3g4c0rtx|m4n1fest0|m4s4g3|maas|madmax|mafi|magic|maktub|malware|manamecrypt|mandelbrot|manic|matrix|max|md5|medusa|mega|melme|merry|mesmerize|metropolitan|mikey|mikibackup|milarepa.lotos@aol.com|mirror|mmnn|mole|monro|mosk|muslat|n1n1n1|nabr|napoleon|narrow|nasoh|nataniel|neitrino|neras|nlah|nosu|novasof|nozelesn|nuclear|nwa|nymaim|obelisk|off|offwhite|ogdo|omega|omerta|onion|ooss|opencode|openme|opqz|osiris|otx|p3rf0rm4|pabluk|pack14|packagetrackr@india.com|packrat|pahd|panda|pandemic|pandora|pansy|paradise|paris|paym3|paymer|payms|pcap|pclock|peet|pelikan|penis|petya|pewcrypt|phoenix|photominr|phobos|phps|pirated|pluto|po1|point|poop|potato|pr0tect|preppy|princesa|princess|prosper|prosperity|prq|pshy|pumas|pumax|pure|purple|purpler|pwnd|pysa|q9q9|qbtex|qiuu|qkkd|qscx|qtyop|quimera|r2d2|r5a|rabit|radman|raid10|rainbow|rakhni|rambo|ramses|rat|rcrypted|react|reactor|realtek|reaper|redlion|redmat|redrum|rekt|remk|removal|remsec|remy|renaming|revenge|rezuc|rhino|ribd|rich|rip|rire|rizonesoft@protonmail.ch|rk|rmdir|robinhood|rocke|rogue|roldat|rolin|ronzware|rosenquist|rotten|roza|rpcminer|rsalive|rumba|run|rxx|uak|udjvu|unlock92|unlckr|upd|urcp|usam|usbc|v8|vag|vandt|varasto|vault|vauw|vb|ve|vendetta|venom|veracrypt|versiegelt|veton|vhd|vindows|violate|virus|vivin|vk_677|vma|vmx|volcano|vorasto|vorphal|vos|vscrypt|vxl|w4b|wakanda|wannacash|wannacry|wanted|war|wasted|wcry|weapologize|webmafia|weird|weui|whatthefuck|whistler|white|whitenoise|whiterabbit|whorus|why!decryptor|wicked|wildfire|windows10|windows7|windows8|windowsupdate|winlock|wipe|wisconsin|wizard|wlu|woolger|worm|wormfubuki|wow|wpencrypt|wq!decryptor|wrui|wtg|x1881|x3m|xampug|xdata|xencrypt|xfiles|xhelper|xlr|xman|xmd|xmd|xtbl|xtbl|xtr|xtt|xtz|xyz|yakuza|yatron|ybn|year|yellow|yheq|yty|yuke|yxo|yyto|z3|zatrov|zax|zbot|zbt|zbt|zeppelin|zerber|zet|zet|zfj|zfj|zimbra|zip|zix|zlz|zobm|zoh|zorro|zphs)$")', '2026-02-09 16:57:32.417620', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.eventCode","operator":"filter_term","value":"4663"},{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-5m","count":20}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (718, 'Windows: Remote File Copy to a Hidden Share', 3, 2, 1, 'Lateral Movement', 'T1021 - Remote Services', 'Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.', '["https://attack.mitre.org/tactics/TA0008/","https://attack.mitre.org/techniques/T1021/"]', 'oneOf("log.winlogEventDataProcessName", ["cmd.exe", "powershell.exe", "robocopy.exe", "xcopy.exe"]) && contains("log.message", "$") && (contains("log.message", "copy") || contains("log.message", "move") || contains("log.message", " cp ") || contains("log.message", " mv "))', '2026-02-09 16:57:32.577227', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (719, 'Windows: Remote File Download via Desktopimgdownldr Utility', 2, 3, 1, 'Command and Control', 'T1105 - Ingress Tool Transfer', 'Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.', '["https://attack.mitre.org/tactics/TA0011/","https://attack.mitre.org/techniques/T1105/"]', 'contains("log.winlogEventDataProcessName", "desktopimgdownldr.exe")', '2026-02-09 16:57:32.717466', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (720, 'Windows: Remote File Download via MpCmdRun', 2, 3, 1, 'Command and Control', 'T1105 - Ingress Tool Transfer', 'Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file.', '["https://attack.mitre.org/tactics/TA0011/","https://attack.mitre.org/techniques/T1105/"]', 'contains("log.winlogEventDataProcessName", "MpCmdRun.exe") && contains("log.message", "-url") && contains("log.message", "-DownloadFile") && contains("log.message", "-path")', '2026-02-09 16:57:32.886796', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (721, 'Windows: Remote System Discovery Commands', 3, 1, 2, 'Discovery', 'T1018 - Remote System Discovery', 'Discovery of remote system information using built-in commands, which may be used to move laterally.', '["https://attack.mitre.org/tactics/TA0007/","https://attack.mitre.org/techniques/T1018/"]', 'regexMatch("log.message", "(-n|-s|-a)") && regexMatch("log.winlogEventDataProcessName", "(nbtstat.exe|arp.exe)")', '2026-02-09 16:57:33.046802', true, false, 'origin', '["adversary.user","adversary.ip"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (722, 'Windows: Remote Logon followed by Scheduled Task Creation', 3, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Identifies a remote logon followed by a scheduled task creation on the target host. This could be indicative of adversary lateral movement.', '["https://attack.mitre.org/tactics/TA0008/","https://attack.mitre.org/techniques/T1021/"]', 'equals("log.action", "logged-in") && equals("actionResult", "success") && !contains("log.wineventlogUserName", "ANONYMOUS LOGON") && !contains("log.wineventlogUserDomain", "NT AUTHORITY")', '2026-02-09 16:57:33.201971', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogHostId","operator":"filter_term","value":"{{log.winlogHostId}}"},{"field":"log.winlogEventDataSubjectLogonId","operator":"filter_term","value":"scheduled-task-created"}],"or":null,"within":"now-60s","count":3}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (723, 'Windows: Privilege Escalation via Windir Environment Variable', 2, 3, 2, 'Privilege Escalation', 'T1574.007 - Hijack Execution Flow: Path Interception by PATH Environment Variable', 'Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1574/007/"]', 'regexMatch("log.message", "(C:\\windows|%SystemRoot%)") && regexMatch("log.message", "(HKEY_USERS\\(.+)\\Environment\\windir|HKEY_USERS\\(.+)\\Environment\\systemroot)")', '2026-02-09 16:57:33.346892', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (724, 'Windows: Unusual Child Processes of RunDLL32', 2, 3, 2, 'Defense Evasion', 'T1218.011 - System Binary Proxy Execution: Rundll32', 'Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1218/011/"]', 'contains("log.winlogEventDataProcessName", "rundll32.exe")', '2026-02-09 16:57:33.527103', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (725, 'Windows: Execution of Persistent Suspicious Program', 2, 3, 2, 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 'Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1547/"]', 'contains("log.winlogEventDataProcessName", "explorer.exe")', '2026-02-09 16:57:33.687174', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (736, 'Windows: Sensitive Privilege SeEnableDelegationPrivilege assigned to a User', 3, 3, 1, 'Credential Access', 'T1212 - Exploitation for Credential Access', 'Identifies the assignment of the SeEnableDelegationPrivilege sensitive user right to a user. The SeEnableDelegationPrivilege user right enables computer and user accounts to be trusted for delegation. Attackers can abuse this right to compromise Active Directory accounts and elevate their privileges.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1212/"]', 'regexMatch("action", "([Aa]uthorization [Pp]olicy [Cc]hange)") && equals("log.eventCode", 4704) && contains("log.winlogEventDataPrivilegeList", "SeEnableDelegationPrivilege")', '2026-02-09 16:57:35.451792', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (726, 'Windows: Multiple Vault Web Credentials Read', 2, 3, 2, 'Credential Access', 'T1555.004 - Credentials from Password Stores: Windows Credential Manager', 'Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1555/004/"]', 'equals("log.eventCode", 5382) && !equals("log.winlogEventDataSubjectLogonId", "0x3e7") && (contains("log.winlogEventDataSchemaFriendlyName", "Windows Web Password Credential") || contains("log.winlogEventDataResource", "http"))', '2026-02-09 16:57:33.827446', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataProcessPid","operator":"filter_term","value":"{{log.winlogEventDataProcessPid}}"},{"field":"log.eventCode","operator":"filter_term","value":"5382"},{"field":"log.winlogEventDataSubjectLogonId","operator":"filter_not_match","value":"0x3e7"}],"or":[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataSchemaFriendlyName","operator":"filter_term","value":"Windows Web Password Credential"},{"field":"log.winlogEventDataResource","operator":"filter_term","value":"http"}],"or":null,"within":"now-60s","count":1}],"within":"now-60s","count":1}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (727, 'Windows: Potential Privileged Escalation via SamAccountName Spoofing', 2, 3, 1, 'Privilege Escalation', 'T1078 - Valid Accounts', 'Identifies a suspicious computer account name rename event, which may indicate an attempt to exploit CVE-2021-42278 to elevate privileges from a standard domain user to a user with domain admin privileges. CVE-2021-42278 is a security vulnerability that allows potential attackers to impersonate a domain controller via samAccountName attribute spoofing.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1078/"]', 'equals("action", "renamed-user-account") && endsWith("target.user", "$") && !endsWith("log.winlogEventDataNewTargetUserName", "$")', '2026-02-09 16:57:34.007594', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (728, 'Windows: Outbound Scheduled Task Activity via PowerShell', 2, 3, 2, 'Execution', 'T1053.005 - Scheduled Task', 'Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1053/005/"]', 'oneOf("log.winlogEventDataProcessName", ["powershell.exe", "pwsh.exe", "powershell_ise.exe"]) && regexMatch("log.message", "(powershell.exe|pwsh.exe|powershell_ise.exe)")', '2026-02-09 16:57:34.167419', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (729, 'Windows: Searching for Saved Credentials via VaultCmd', 3, 2, 1, 'Credential Access', 'T1555 - Credentials from Password Stores', 'Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1555/"]', 'contains("log.winlogEventDataProcessName", "vaultcmd.exe") && contains("log.message", "/list")', '2026-02-09 16:57:34.326412', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (730, 'Windows: Detection of a suspicious PowerShell Script with screenshot capabilities', 3, 2, 1, 'Collection', 'T1113 - Screen Capture', 'Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools', '["https://attack.mitre.org/tactics/TA0009/","https://attack.mitre.org/techniques/T1113/"]', 'regexMatch("log.message", "(CopyFromScreen(.+)Drawing.Bitmap|Drawing.Bitmap(.+)CopyFromScreen)")', '2026-02-09 16:57:34.471374', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (731, 'Windows: Remote Scheduled Task Creation', 2, 2, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement.', '["https://attack.mitre.org/tactics/TA0008/","https://attack.mitre.org/techniques/T1021/"]', 'contains("log.winlogProcessName", "svchost.exe") && oneOf("log.winlogEventDataSourceNetworkAddress", ["incoming", "ingress"]) && greaterOrEqual("origin.port", 49152) && greaterOrEqual("target.port", 49152) && !oneOf("origin.ip", ["127.0.0.1", "::1"])', '2026-02-09 16:57:34.647183', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (732, 'Windows Script Executing PowerShell', 2, 3, 2, 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 'Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1566/001/"]', 'equals("log.winlogEventDataEventType", "start") && oneOf("log.winlogEventDataParentProcessName", ["cscript.exe", "wscript.exe"]) && contains("log.winlogEventDataProcessName", "powershell.exe")', '2026-02-09 16:57:34.797283', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (733, 'Windows Script Interpreter Executing Process via WMI', 2, 2, 2, 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 'Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process via Windows Management Instrumentation (WMI). This may be indicative of malicious activity.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1566/001/"]', 'oneOf("log.winlogProcessName", ["wscript.exe", "cscript.exe"]) && contains("log.message", "wmiutils.dll")', '2026-02-09 16:57:34.967380', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (734, 'Windows: Potential Secure File Deletion via SDelete Utility', 3, 2, 2, 'Defense Evasion', 'T1070.004 - Indicator Removal: File Deletion', 'Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1070/004/"]', 'equals("log.winlogEventDataEventType", "change") && contains("log.winlogEventDataFileName", "AAA.AAA")', '2026-02-09 16:57:35.127611', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (735, 'Windows: Security Software Discovery using WMIC', 3, 2, 1, 'Discovery', 'T1518.001 - Software Discovery: Security Software Discovery', 'Identifies the use of Windows Management Instrumentation Command (WMIC) to discover certain System Security Settings such as AntiVirus or Host Firewall details.', '["https://attack.mitre.org/tactics/TA0007/","https://attack.mitre.org/techniques/T1518/001/"]', 'regexMatch("log.message", "(namespace:\\\\root\\SecurityCenter2)") && contains("log.message", "Get") && contains("log.winlogEventDataProcessName", "wmic.exe")', '2026-02-09 16:57:35.287368', true, false, 'origin', '["adversary.user","adversary.ip"]', '[]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (737, 'Windows: Potential Shadow Credentials added to AD Object', 3, 3, 2, 'Credential Access', 'T1556 - Modify Authentication Process', 'Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control over the object and create a key pair, append to raw public key in the attribute, and obtain persistent and stealthy access to the target user or computer object.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1556/"]', 'regexMatch("log.action", "([Dd]irectory [Ss]ervice [Cc]hanges)") && equals("log.eventCode", 5136) && regexMatch("log.message", "(msDS-KeyCredentialLink)") && contains("log.message", ":828")', '2026-02-09 16:57:35.597128', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (738, 'Windows: Service Control Spawned via Script Interpreter', 2, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.', '["https://attack.mitre.org/tactics/TA0008/","https://attack.mitre.org/techniques/T1021/"]', 'oneOf("log.winlogEventDataParentProcessName", ["cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe", "powershell.exe", "pwsh.exe"]) && oneOf("log.message", ["config", "create", "start", "delete", "stop", "pause"]) && !equals("log.winlogEventDataSubjectUserName", "S-1-5-18") && contains("log.winlogEventDataProcessName", "sc.exe")', '2026-02-09 16:57:35.732258', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (739, 'Windows: Execution via local SxS Shared Modules', 1, 2, 3, 'Execution', 'T1129 - Shared Modules', 'Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1129/"]', 'contains("log.file.extension", "dll") && regexMatch("log.file.path", "(C:\\\\(.+)\\\\.exe.local\\\\(.+).dll)")', '2026-02-09 16:57:35.902075', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (740, 'Windows: SIP Provider Modification', 1, 2, 3, 'Defense Evasion', 'T1553.003 - Subvert Trust Controls: SIP and Trust Provider Hijacking', 'Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1553/003/"]', 'equals("log.event.type", "change") && contains("log.registryDataStrings", ".dll") && regexMatch("log.registryPath", "(HKLM\\\\SOFTWARE(\\\\WOW6432Node)?\\\\Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllPutSignedDataMsg\\\\(.+)\\\\Dll|HKLM\\\\SOFTWARE(\\\\WOW6432Node)?\\\\Microsoft\\\\Cryptography\\\\Providers\\\\Trust\\\\FinalPolicy\\\\(.+)\\\\\\$Dll)")', '2026-02-09 16:57:36.036852', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (741, 'Windows: User account exposed to Kerberoasting', 3, 3, 2, 'Credential Access', 'T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting', 'Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1558/003/"]', 'regexMatch("log.action", "([Dd]irectory [Ss]ervice [Cc]hanges)") && equals("log.eventCode", 5136) && regexMatch("log.message", "(servicePrincipalName)")', '2026-02-09 16:57:36.176908', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (742, 'Windows: Startup Persistence by a Suspicious Process', 1, 2, 3, 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1547/001/"]', 'contains("log.message", "delet") && regexMatch("log.eventDataProcessName", "(cmd.exe|powershell.exe|wmic.exe|mshta.exe|pwsh.exe|cscript.exe|wscript.exe|regsvr32.exe|RegAsm.exe|rundll32.exe|EQNEDT32.EXE|WINWORD.EXE|EXCEL.EXE|POWERPNT.EXE|MSPUB.EXE|MSACCESS.EXE|iexplore.exe|InstallUtil.exe)") && regexMatch("log.message", "(C:\\Users\\(.+)\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\|C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\)") && !contains("target.domain", "NT AUTHORITY")', '2026-02-09 16:57:36.602184', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (743, 'Windows: Detection of SUNBURST command and control activity', 3, 3, 2, 'Command and Control', 'T1195 - Supply Chain Compromise', 'This rule detects post-exploitation command and control activity of the SUNBURST backdoor.', '["https://attack.mitre.org/tactics/TA0011/","https://attack.mitre.org/techniques/T1195/"]', 'regexMatch("log.eventDataProcessName", "(ConfigurationWizard.exe|NetFlowService.exe|NetflowDatabaseMaintenance.exe|SolarWinds.Administration.exe|SolarWinds.BusinessLayerHost.exe|SolarWinds.BusinessLayerHostx64.exe|SolarWinds.Collector.Service.exe|SolarwindsDiagnostics.exe)") && regexMatch("log.message", "(/swip/Upload.ashx(.+)(POST|PUT)|(POST|PUT)(.+)/swip/Upload.ashx|/swip/SystemDescription(.+)(GET|HEAD)|(GET|HEAD)(.+)/swip/SystemDescription)")', '2026-02-09 16:57:36.736895', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (744, 'Windows: Suspicious CertUtil Commands', 3, 2, 1, 'Defense Evasion', 'T1140 - Deobfuscate/Decode Files or Information', 'Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1140/"]', 'regexMatch("log.message", "(decode|encode|urlcache|verifyctl|encodehex|decodehex|exportPFX)") && contains("log.eventDataProcessName", "certutil.exe")', '2026-02-09 16:57:36.827079', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (745, 'Windows: Suspicious Cmd Execution via WMI', 1, 2, 3, 'Execution', 'T1047 - Windows Management Instrumentation', 'Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1047/"]', 'contains("log.eventDataParentProcessName", "WmiPrvSE.exe") && contains("log.eventDataProcessName", "cmd.exe") && contains("log.message", "\\\\127.0.0.1\\") && regexMatch("log.message", "(2>&1|1>)")', '2026-02-09 16:57:36.931954', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (746, 'Windows: Potential Credential Access via Renamed COM+ Services DLL', 3, 3, 2, 'Credential Access', 'T1003 - OS Credential Dumping', 'Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump function that can be used to dump a process memory. This may indicate an attempt to dump LSASS memory while bypassing command-line based detection in preparation for credential access.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/001/"]', 'contains("log.winlogEventCategory", "process") && contains("log.winlogEventProcessName", "rundll32.exe") && regexMatch("log.winlogEventDataset", "(windows.sysmon_operational)") && equals("log.winlogEventId", "7") && !equals("log.winlogFileName", "COMSVCS.DLL") && (regexMatch("log.winlogFilePeOriginalFileName", "(COMSVCS.DLL)") || regexMatch("log.winlogFilePeImphash", "(EADBCCBB324829ACB5F2BBE87E5549A8)"))', '2026-02-09 16:57:37.067457', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogProcessEntityId","operator":"filter_term","value":"{{log.winlogProcessEntityId}}"},{"field":"log.winlogEventCategory","operator":"filter_term","value":"process"}],"or":null,"within":"now-5m","count":3}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (747, 'Windows: Remote Computer Account DnsHostName Update', 3, 3, 2, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Identifies the remote update to a computer account''s DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it''s highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1068/"]', 'equals("log.action", "logged-in") && regexMatch("actionResult", "success") && !contains("log.userName", "ANONYMOUS LOGON") && !contains("log.eventData.subjectUserName", "ANONYMOUS LOGON") && startsWith("log.eventData.subjectUserName", "$") && !contains("log.userDomain", "NT AUTHORITY")', '2026-02-09 16:57:37.217011', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (748, 'Windows: New Windows Service Created to start from windows root path. Suspicious event as the binary may have been dropped using Windows Admin Shares', 1, 2, 3, 'Execution', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 'Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.', '["https://attack.mitre.org/techniques/T1021/002/"]', 'regexMatch("log.eventDataImagePath", "(^%systemroot%\\(.+)\\(.+).exe)") && equals("log.eventCode", 7045) && oneOf("log.logName", ["system", "System"])', '2026-02-09 16:57:37.362096', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (749, 'Windows: Suspicious Execution from mounted device', 1, 2, 3, 'Defense Evasion', 'T1055 - Process Injection', 'Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It''s possible to bypass hooked functions by writing malicious functions that call syscalls directly.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1055/"]', 'equals("log.eventType", "start") && regexMatch("log.process.executable", "(^C:\\\\)") && regexMatch("log.processWorkingDirectory", "((^\\w:\\\\)") && !regexMatch("log.processWorkingDirectory", "(^C:\\\\)") && contains("log.processParentName", "explorer.exe") && oneOf("log.processName", ["rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe", "cscript.exe", "wscript.exe"])', '2026-02-09 16:57:37.517061', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (750, 'Windows: Suspicious Image Load (taskschd.dll) from MS Office', 1, 2, 3, 'Persistence', 'T1053 - Scheduled Task/Job', 'Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1053/"]', 'regexMatch("log.eventDataProcessName", "(WINWORD.EXE|EXCEL.EXE|POWERPNT.EXE|MSPUB.EXE|MSACCESS.EXE)") && contains("log.message", "taskschd.dll")', '2026-02-09 16:57:37.657185', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (751, 'Windows: Suspicious WMI Image Load from MS Office', 1, 2, 3, 'Execution', 'T1047 - Windows Management Instrumentation', 'Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1047/"]', 'regexMatch("log.eventDataProcessName", "(WINWORD.EXE|EXCEL.EXE|POWERPNT.EXE|MSPUB.EXE|MSACCESS.EXE)") && contains("log.message", "wmiutils.dll")', '2026-02-09 16:57:37.787235', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (752, 'Windows: Potential Credential Access via LSASS Memory Dump', 3, 3, 2, 'Credential Access', 'T1003 - OS Credential Dumping', 'Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export the MiniDumpWriteDump method that can be used to dump LSASS memory content in preparation for credential access.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'equals("log.winlogEventId", "10") && regexMatch("log.eventDataTargetImage", "(C:\\\\WINDOWS\\\\system32\\\\lsass.exe)") && regexMatch("log.eventDataCallTrace", "(dbghelp|dbgcore)") && !regexMatch("log.eventDataProcessName", "(C:\\\\Windows\\\\System32\\\\WerFault.exe|C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe)")', '2026-02-09 16:57:37.927023', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (753, 'Windows: Potential LSASS Memory Dump via PssCaptureSnapShot', 3, 3, 2, 'Credential Access', 'T1003 - OS Credential Dumping', 'Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two successive process accesses are performed by the same process and target two different instances of LSASS. This may indicate an attempt to evade detection and dump LSASS memory for credential access.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'equals("log.winlogEventId", "10") && regexMatch("log.eventDataTargetImage", "([Cc]:\\Windows\\[Ss]ystem32\\lsass.exe)")', '2026-02-09 16:57:38.061786', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (754, 'Windows: Suspicious Managed Code Hosting Process', 3, 3, 2, 'Defense Evasion', 'T1055 - Process Injection', 'Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1055/"]', 'regexMatch("log.winlogEventDataProcessName", "(wscript.exe|cscript.exe|mshta.exe|wmic.exe|regsvr32.exe|svchost.exe|dllhost.exe|cmstp.exe)")', '2026-02-09 16:57:38.202800', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataProcessName","operator":"filter_term","value":"{{log.winlogEventDataProcessName}}"},{"field":"log.winlogEventdataProcessID","operator":"filter_term","value":"{{log.winlogEventdataProcessID}}"}],"or":null,"within":"now-5m","count":3}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (755, 'Windows: Microsoft Exchange Server UM Writing Suspicious Files', 2, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1190/"]', 'regexMatch("log.eventDataProcessName", "(UMWorkerProcess.exe|umservice.exe)") && regexMatch("log.message", "(php|jsp|js|aspx|asmx|asax|cfm|shtml)") && regexMatch("log.message", "(:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\|:\\\\(.+)\\\\Microsoft\\\\Exchange Server(.+)\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\)") && !regexMatch("log.message", "(:\\\\(.+)\\\\Microsoft\\\\Exchange Server(.+)\\\\FrontEnd\\\\HttpProxy\\\\(owa|ecp)\\\\auth\\\\version\\\\)")', '2026-02-09 16:57:38.346685', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (756, 'Windows: Microsoft Exchange Worker Spawning Suspicious Processes', 2, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1190/"]', 'regexMatch("log.winlogEventDataParentProcessName", "(UMService.exe|UMWorkerProcess.exe)") && !(regexMatch("log.winlogEventDataProcessName", "(:\\Windows\\System32\\werfault.exe|:\\Windows\\System32\\wermgr.exe|:\\Program Files\\Microsoft\\Exchange Server\\V(.+)\\Bin\\UMWorkerProcess.exe|D:\\Exchange 2016\\Bin\\UMWorkerProcess.exe|E:\\ExchangeServer\\Bin\\UMWorkerProcess.exe)"))', '2026-02-09 16:57:38.487286', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (757, 'Windows: Microsoft Exchange Worker Spawning Suspicious Processes', 2, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1190/"]', 'contains("log.winlogEventDataParentProcessName", "w3wp.exe") && regexMatch("log.message", "(MSExchange(.+)AppPool)") && regexMatch("log.winlogEventDataProcessName", "(md.exe|powershell.exe|pwsh.dll|powershell_ise.exe)")', '2026-02-09 16:57:38.627034', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (758, 'Windows: Suspicious MS Office Child Process', 1, 2, 3, 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 'Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1566/001/"]', 'oneOf("log.winlogEventDataProcessName", ["Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe", "certutil.exe", "cmd.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe", "iexpress.exe", "installutil.exe", "ipconfig.exe", "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe", "ping.exe", "powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe", "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe", "wmic.exe", "wscript.exe", "xwizard.exe", "explorer.exe", "rundll32.exe", "hh.exe", "msdt.exe"]) && oneOf("log.winlogEventDataParentProcessName", ["eqnedt32.exe", "excel.exe", "fltldr.exe", "msaccess.exe", "mspub.exe", "powerpnt.exe", "winword.exe", "outlook.exe"])', '2026-02-09 16:57:38.776934', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (759, 'Windows: Suspicious MS Outlook Child Process', 1, 3, 2, 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 'Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1566/001/"]', 'oneOf("log.winlogEventDataProcessName", ["Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe", "certutil.exe", "cmd.exe", "cmstp.exe", "cscript.exe", "csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe", "iexpress.exe", "installutil.exe", "ipconfig.exe", "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe", "ping.exe", "powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe", "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe", "wmic.exe", "wscript.exe", "xwizard.exe"]) && contains("log.winlogEventDataParentProcessName", "outlook.exe")', '2026-02-09 16:57:38.917132', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (760, 'Windows: Suspicious PDF Reader Child Process', 1, 1, 2, 'Execution', 'T1204 - User Execution', 'Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1204/"]', 'oneOf("log.winlogEventDataParentProcessName", ["AcroRd32.exe", "Acrobat.exe", "FoxitPhantomPDF.exe", "FoxitReader.exe"]) && oneOf("log.winlogEventDataProcessName", ["arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe", "hostname.exe", "ipconfig.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe", "bginfo.exe", "cdb.exe", "cmstp.exe", "csi.exe", "dnx.exe", "fsi.exe", "ieexec.exe", "iexpress.exe", "installutil.exe", "Microsoft.Workflow.Compiler.exe", "msbuild.exe", "mshta.exe", "msxsl.exe", "odbcconf.exe", "rcsi.exe", "regsvr32.exe", "xwizard.exe", "atbroker.exe", "forfiles.exe", "schtasks.exe", "regasm.exe", "regsvcs.exe", "cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe", "bitsadmin.exe", "certutil.exe", "ftp.exe"])', '2026-02-09 16:57:39.052384', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (768, 'Windows: System Shells via Services', 1, 3, 2, 'Persistence', 'T1543.003 - Create or Modify System Process: Windows Service', 'Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1543/003/"]', 'regexMatch("log.winlogEventDataProcessName", "(cmd.exe|powershell.exe|pwsh.exe|powershell_ise.exe)") &&
+ contains("log.winlogEventDataParentProcessName", "services.exe") &&
+ !(regexMatch("log.message", "(NVDisplay.ContainerLocalSystem)"))
+', '2026-02-09 16:57:40.307817', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (761, 'Windows: Suspicious PowerShell Engine ImageLoad', 1, 3, 2, 'Execution', 'T1059 - Command and Scripting Interpreter', 'Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1059/"]', '!(oneOf("log.winlogEventDataProcessName", ["Altaro.SubAgent.exe", "AppV_Manage.exe", "azureadconnect.exe", "CcmExec.exe", "configsyncrun.exe", "choco.exe", "ctxappvservice.exe", "DVLS.Console.exe", "edgetransport.exe", "exsetup.exe", "forefrontactivedirectoryconnector.exe", "InstallUtil.exe", "JenkinsOnDesktop.exe", "Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe", "mmc.exe", "mscorsvw.exe", "msexchangedelivery.exe", "msexchangefrontendtransport.exe", "msexchangehmworker.exe", "msexchangesubmission.exe", "msiexec.exe", "MsiExec.exe", "noderunner.exe", "NServiceBus.Host.exe", "NServiceBus.Host32.exe", "NServiceBus.Hosting.Azure.HostProcess.exe", "OuiGui.WPF.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "SCCMCliCtrWPF.exe", "ScriptEditor.exe", "ScriptRunner.exe", "sdiagnhost.exe", "servermanager.exe", "setup100.exe", "ServiceHub.VSDetouredHost.exe", "SPCAF.Client.exe", "SPCAF.SettingsEditor.exe", "SQLPS.exe", "telemetryservice.exe", "UMWokerProcess.exe", "w3wp.exe", "wsmprovhost.exe"])) &&
+!(regexMatch("log.winlogEventDataProcessName", "(C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe|C:\\Windows\\System32\\sdiagnhost.exe|C:\\Program Files( \\(x86\\))?\\(.+)\\.exe)")) &&
+oneOf("log.message", ["System.Management.Automation.ni.dll", "System.Management.Automation.dll"])
+', '2026-02-09 16:57:39.182551', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (762, 'Windows: Suspicious Process Access via Direct System Call', 1, 3, 2, 'Defense Evasion', 'T1055 - Process Injection', 'Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It''s possible to bypass hooked functions by writing malicious functions that call syscalls directly.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1055/"]', 'equals("log.eventCode", 10) && !(regexMatch("log.winlogEventDataCallTrace", "(:\\WINDOWS\\SYSTEM32\\ntdll.dll|:\\WINDOWS\\SysWOW64\\ntdll.dll|:\\Windows\\System32\\wow64cpu.dll|:\\WINDOWS\\System32\\wow64win.dll|:\\Windows\\System32\\win32u.dll)")) &&
+!(regexMatch("log.winlogEventDataTargetImage", "(:\\WINDOWS\\system32\\lsass.exe|:\\Program Files (x86)\\Malwarebytes Anti-Exploit\\mbae-svc.exe|:\\Program Files\\Cisco\\AMP\\(.+)\\sfc.exe|:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\(.+)\\msedgewebview2.exe|:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\(.+)\\AcroCEF.exe)")) &&
+!(regexMatch("log.winlogEventDataProcessName", "(:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe|:\\Program Files (x86)\\World of Warcraft\\_classic_\\WowClassic.exe)"))
+', '2026-02-09 16:57:39.321516', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (763, 'Windows: Suspicious Process Execution via Renamed PsExec Executable', 1, 3, 2, 'Execution', 'T1569 - System Services', 'Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to vade detection.', '["https://attack.mitre.org/tactics/TA0002/","https://attack.mitre.org/techniques/T1569/"]', 'equals("log.winlogEventDataEventType", "start") && (contains("log.winlogEventDataProcessName", "PSEXESVC.exe") || contains("log.winlogEventDataOriginalFileName", "psexesvc.exe"))', '2026-02-09 16:57:39.446892', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (764, 'Windows: Suspicious RDP ActiveX Client Loaded', 1, 3, 2, 'Lateral Movement', 'T1021 - Remote Services', 'Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability.', '["https://attack.mitre.org/tactics/TA0008/","https://attack.mitre.org/techniques/T1021/"]', '!(regexMatch("log.winlogEventDataProcessName", "(C:\\\\Windows\\\\System32\\\\mstsc\\.exe|C:\\\\Windows\\\\SysWOW64\\\\mstsc\\.exe)")) &&
+regexMatch("log.winlogEventDataProcessName", "(C:\\\\Windows\\\\|C:\\\\Users\\\\Public\\\\|C:\\\\Users\\\\Default\\\\|C:\\\\Intel\\\\|C:\\\\PerfLogs\\\\|C:\\\\ProgramData\\\\|\\\\Device\\\\Mup\\\\|\\\\\\\\)") &&
+contains("log.message", "mstscax.dll")
+', '2026-02-09 16:57:39.607364', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (765, 'Windows: Suspicious Execution via Scheduled Task', 1, 3, 2, 'Persistence', 'T1053.005 - Scheduled Task', 'Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1053/005/"]', 'equals("log.winlogEventDataEventType", "start") && contains("log.winlogEventDataProcessParentName", "svchost.exe") && contains("log.winlogEventDataProcessParentArgs", "Schedule") &&
+regexMatch("log.winlogEventDataOriginalFileName", "(cscript.exe|wscript.exe|PowerShell.EXE|Cmd.Exe|MSHTA.EXE|RUNDLL32.EXE|REGSVR32.EXE|MSBuild.exe|InstallUtil.exe|RegAsm.exe|RegSvcs.exe|msxsl.exe|CONTROL.EXE|EXPLORER.EXE|Microsoft.Workflow.Compiler.exe|msiexec.exe)") &&
+regexMatch("log.winlogEventDataProcessArgs", "(C:\\\\Users\\\\|C:\\\\ProgramData\\\\|C:\\\\Windows\\\\Temp\\\\|C:\\\\Windows\\\\Tasks\\\\|C:\\\\PerfLogs\\\\|C:\\\\Intel\\\\|C:\\\\Windows\\\\Debug\\\\|C:\\\\HP\\\\)") &&
+!regexMatch("log.winlogEventDataProcessName", "(cmd.exe|cscript.exe|powershell.exe|msiexec.exe)") &&
+!regexMatch("log.winlogEventDataProcessArgs", "(:\\\\(.+).bat|:\\\\Windows\\\\system32\\\\calluxxprovider.vbs|-File|-PSConsoleFile)") &&
+!regexMatch("log.winlogEventDataUserId", "(S-1-5-18)") && !regexMatch("log.winlogEventDataWorkingDirectory", "(:\\\\Windows\\\\System32\\\\)")
+', '2026-02-09 16:57:39.772826', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (766, 'Windows: Suspicious WMIC XSL Script Execution', 2, 3, 2, 'Defense Evasion', 'T1220 - XSL Script Processing', 'Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting libraries it may be indicative of an allowlist bypass.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1220/"]', 'regexMatch("log.message", "(?i)wmic.*format") && !contains("log.message", "/format:table") && regexMatch("log.message", "(?i)(jscript\\.dll|vbscript\\.dll)")', '2026-02-09 16:57:39.912618', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (767, 'Windows: Symbolic Link to Shadow Copy Created', 1, 3, 2, 'Credential Access', 'T1003 - OS Credential Dumping', 'Detects creation of a symbolic link to a volume shadow copy. Adversaries may use this technique to access and exfiltrate sensitive data such as NTDS.dit or SAM database from shadow copies.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'regexMatch("log.winlogEventDataProcessName", "(cmd.exe|powershell.exe|pwsh.exe|powershell_ise.exe)") && regexMatch("log.message", "(?i)(mklink|New-Item.*SymbolicLink)") && contains("log.message", "HarddiskVolumeShadowCopy")', '2026-02-09 16:57:40.087532', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (769, 'Windows: SeDebugPrivilege Enabled by a Suspicious Process', 1, 3, 2, 'Privilege Escalation', 'T1134 - Access Token Manipulation', 'Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1134/"]', 'regexMatch("log.action", "(Token Right Adjusted Events)") && regexMatch("log.eventProvider", "(Microsoft-Windows-Security-Auditing)") && regexMatch("log.eventDataEnabledPrivilegeList", "(SeDebugPrivilege)") && !(oneOf("log.eventDataSubjectUserSid", ["S-1-5-18", "S-1-5-19", "S-1-5-20"])) && !(regexMatch("log.eventDataProcessName", "(:\\Windows\\System32\\msiexec.exe|:\\Windows\\SysWOW64\\msiexec.exe|:\\Windows\\System32\\lsass.exe|:\\Windows\\WinSxS\\|:\\Program Files\\|:\\Program Files (x86)\\|:\\Windows\\System32\\MRT.exe|:\\Windows\\System32\\cleanmgr.exe|:\\Windows\\System32\\taskhostw.exe|:\\Windows\\System32\\mmc.exe|:\\Users\\(.+)\\AppData\\Local\\Temp\\(.+)-(.+)\\DismHost.exe|:\\Windows\\System32\\auditpol.exe|:\\Windows\\System32\\wbem\\WmiPrvSe.exe|:\\Windows\\SysWOW64\\wbem\\WmiPrvSe.exe)"))', '2026-02-09 16:57:40.491929', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (770, 'Windows: UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface', 1, 3, 2, 'Privilege Escalation', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1548/002/"]', 'contains("log.eventDataProcessName", "Clipup.exe") && !regexMatch("log.message", "(C:\\Windows\\System32\\ClipUp.exe)") && contains("log.eventDataParentProcessName", "dllhost.exe") && regexMatch("log.message", "(/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41)")', '2026-02-09 16:57:40.647315', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (771, 'Windows: UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer', 1, 3, 2, 'Privilege Escalation', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1548/002/"]', 'regexMatch("log.message", "(C:\\(.+)\\AppData\\(.+)\\Temp\\IDC(.+).tmp\\(.+).exe)") && contains("log.processParentName", "ieinstall.exe") && regexMatch("log.message", "(-Embedding)")', '2026-02-09 16:57:40.777235', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (772, 'Windows: UAC Bypass via ICMLuaUtil Elevated COM Interface', 1, 3, 2, 'Privilege Escalation', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1548/002/"]', 'contains("log.eventDataProcessName", "dllhost.exe") && !contains("log.message", "WerFault.exe") && regexMatch("log.message", "(/Processid:\\{3E5FC7F9-9A51-4367-9063-A120244FBEC7\\}|/Processid:\\{D2E7041B-2927-42FB-8E9F-7CE93B6DC937\\})")', '2026-02-09 16:57:40.962051', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (773, 'Windows: UAC Bypass Attempt via Privileged IFileOperation COM Interface', 1, 3, 2, 'Privilege Escalation', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1548/002/"]', 'regexMatch("log.eventDataFileName", "(wow64log.dll|comctl32.dll|DismCore.dll|OskSupport.dll|duser.dll|Accessibility.ni.dll)") && contains("log.eventDataProcessName", "dllhost.exe") && !regexMatch("log.eventDataFileName", "(C:\\Windows\\SoftwareDistribution\\|C:\\Windows\\WinSxS\\)")', '2026-02-09 16:57:41.112221', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (774, 'Windows: Bypass UAC via Event Viewer', 1, 3, 2, 'Privilege Escalation', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1548/002/"]', 'contains("log.eventDataParentProcessName", "eventvwr.exe") && !regexMatch("log.eventDataProcessName", "(:\\Windows\\SysWOW64\\mmc.exe|:\\Windows\\System32\\mmc.exe|:\\Windows\\SysWOW64\\WerFault.exe|:\\Windows\\System32\\WerFault.exe)")', '2026-02-09 16:57:41.277016', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (775, 'Windows: UAC Bypass via Windows Firewall Snap-In Hijack', 1, 3, 2, 'Privilege Escalation', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1548/002/"]', 'contains("log.eventDataProcessName", "mmc.exe") && !contains("log.message", "WerFault.exe") && contains("log.message", "WF.msc")', '2026-02-09 16:57:41.442054', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (785, 'Windows: Volume Shadow Copy Deletion via PowerShell', 1, 2, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks.', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1490/"]', 'regexMatch("log.eventDataProcessName", "(powershell.exe|pwsh.exe|powershell_ise.exe)") && regexMatch("log.message", "(Get-WmiObject|gwmi|Get-CimInstance|gcim)") && regexMatch("log.message", "(Win32_ShadowCopy)") && regexMatch("log.message", "(\\.Delete\\(\\)|Remove-WmiObject|rwmi|Remove-CimInstance|rcim)")', '2026-02-09 16:57:43.286926', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (777, 'Windows: Unusual File Creation - Alternate Data Stream', 1, 3, 2, 'Defense Evasion', 'T1564 - Hide Artifacts', 'Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1564/"]', 'regexMatch("log.eventDataFileName", "(^C:\\(.+):(.+))") && !regexMatch("log.eventDataFileName", "(C:\\(.+):zone.identifier)") && regexMatch("log.message", "(pdf|dll|png|exe|dat|com|bat|cmd|sys|vbs|ps1|hta|txt|vbe|js|wsh|docx|doc|xlsx|xls|pptx|ppt|rtf|gif|jpg|png|bmp|img|iso)") && !regexMatch("log.eventDataProcessName", "(:\\windows\\System32\\svchost.exe|:\\Windows\\System32\\inetsrv\\w3wp.exe|:\\Windows\\explorer.exe|:\\Windows\\System32\\sihost.exe|:\\Windows\\System32\\PickerHost.exe|:\\Windows\\System32\\SearchProtocolHost.exe|:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe|:\\Program Files\\Rivet Networks\\SmartByte\\SmartByteNetworkService.exe|:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe|:\\Program Files\\ExpressConnect\\ExpressConnectNetworkService.exe|:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe|:\\Program Files\\Google\\Chrome\\Application\\chrome.exe|:\\Program Files\\Mozilla Firefox\\firefox.exe)")', '2026-02-09 16:57:41.747064', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (778, 'Windows: Unusual Child Process of dns.exe', 1, 3, 2, 'Initial Access', 'T1133 - External Remote Services', 'Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1133/"]', 'contains("log.eventData.ProcessName", "dns.exe") && !contains("log.eventData.ParentProcessName", "conhost.exe")', '2026-02-09 16:57:41.886929', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (779, 'Windows: Unusual File Modification by dns.exe', 1, 3, 2, 'Initial Access', 'T1133 - External Remote Services', 'Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1133/"]', 'contains("log.eventDataProcessName", "dns.exe") && !contains("log.eventDataFileName", "dns.log")', '2026-02-09 16:57:42.031733', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (780, 'Windows: Unusual Network Connection via DllHost or via RunDLL32', 2, 3, 2, 'Defense Evasion', 'T1218 - System Binary Proxy Execution', 'Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity. Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial Command and Control activity.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1218/"]', 'regexMatch("log.eventDataProcessName", "(dllhost.exe|rundll32.exe)") && regexMatch("log.origin.ips", "((10.0.0.0/8,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.0.0.0/24,192.0.0.0/29,192.0.0.8/32,192.0.0.9/32,192.0.0.10/32,192.0.0.170/32,192.0.0.171/32,192.0.2.0/24,192.31.196.0/24,192.52.193.0/24,192.168.0.0/16,192.88.99.0/24,224.0.0.0/4,100.64.0.0/10,192.175.48.0/24,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,240.0.0.0/4,::1,FE80::/10,FF00::/8)")', '2026-02-09 16:57:42.197055', true, false, 'target', null, '[]', '["target.host","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (781, 'Windows: Unusual Print Spooler Child Process', 1, 3, 2, 'Privilege Escalation', 'T1068 - Exploitation for Privilege Escalation', 'Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1068/"]', 'contains("log.eventDataParentProcessName", "spoolsv.exe") && !regexMatch("log.eventDataProcessName", "(splwow64.exe|PDFCreator.exe|acrodist.exe|spoolsv.exe|msiexec.exe|route.exe|WerFault.exe|net.exe|cmd.exe|powershell.exe|netsh.exe|regsvr32.exe)") && !regexMatch("log.message", "(\\WINDOWS\\system32\\spool\\DRIVERS|stop|start|.spl|\\program files(.+)route add|add portopening|rule name|PrintConfig.dll)") && equals("log.logName", "System")', '2026-02-09 16:57:42.777069', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (782, 'Windows: Unusual Process Network Connection', 3, 3, 2, 'Defense Evasion', 'Trusted Developer Utilities Proxy Execution', 'Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1127/"]', 'regexMatch("log.eventDataProcessName", "(Microsoft.Workflow.Compiler.exe|bginfo.exe|cdb.exe|cmstp.exe|csi.exe|dnx.exe|fsi.exe|ieexec.exe|iexpress.exe|odbcconf.exe|rcsi.exe|xwizard.exe)")', '2026-02-09 16:57:42.876836', true, false, 'origin', null, '[{"indexPattern":"v11-log-wineventlog-*","with":[{"field":"log.winlogEventDataProcessID","operator":"filter_term","value":"{{log.winlogEventDataProcessID}}"}],"or":null,"within":"now-5m","count":3}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (783, 'Windows: Unusual Service Host Child Process - Childless Service', 1, 3, 2, 'Privilege Escalation', 'T1055 - Process Injection', 'Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1055/"]', 'contains("log.eventDataParentProcessName", "svchost.exe") && regexMatch("log.message", "(WdiSystemHost|LicenseManager|StorSvc|CDPSvc|cdbhsvc|BthAvctpSvc|SstpSvc|WdiServiceHost|imgsvc|TrkWks|WpnService|IKEEXT|PolicyAgent|CryptSvc|netprofm|ProfSvc|StateRepository|camsvc|LanmanWorkstation|NlaSvc|EventLog|hidserv|DisplayEnhancementService|ShellHWDetection|AppHostSvc|fhsvc|CscService|PushToInstall)") && !regexMatch("log.eventDataProcessName", "(WerFault.exe|WerFaultSecure.exe|wermgr.exe|rundll32.exe)") && !regexMatch("log.eventDataProcessName", "(:\\Windows\\System32\\RelPost.exe|:\\Program Files\\|:\\Program Files (x86)\\|:\\Windows\\System32\\Kodak\\kds_i4x50\\lib\\lexexe.exe)") && !regexMatch("log.message", "(WdiSystemHost|WdiServiceHost|imgsvc)") && !regexMatch("log.message", "(:\\WINDOWS\\System32\\winethc.dll,ForceProxyDetectionOnNextRun)")', '2026-02-09 16:57:43.012066', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (784, 'Windows: Volume Shadow Copy Deleted or Resized via VssAdmin', 1, 2, 3, 'Impact', 'T1490 - Inhibit System Recovery', 'Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1490/"]', 'regexMatch("log.message", "((delete|resize)(.+)shadows|shadows(.+)(delete|resize))") && contains("log.eventDataProcessName", "vssadmin.exe")', '2026-02-09 16:57:43.142024', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (789, 'Windows Service Installed via an Unusual Client', 3, 3, 2, 'Privilege Escalation', 'T1543.003 - Create or Modify System Process: Windows Service', 'Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM.', '["https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/techniques/T1543/003/"]', 'equals("action", "service-installed") && equals("clientProcessId", "0") && equals("parentProcessId", "0")', '2026-02-09 16:57:43.842017', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (790, 'Windows: Wireless Credential Dumping using Netsh Command', 3, 3, 2, 'Credential Access', 'T1003 - OS Credential Dumping', 'Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'contains("log.message", "wlan") && regexMatch("log.message", "(key(.+)clear)") && contains("log.winlogEventDataProcessName", "netsh.exe")', '2026-02-09 16:57:43.986689', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (791, 'Windows: Signed Proxy Execution via MS Work Folders', 1, 2, 3, 'Defense Evasion', 'T1218 - System Binary Proxy Execution', 'Identifies the use of Windows Work Folders to execute a potentially masqueraded control.exe file in the current working directory. Misuse of Windows Work Folders could indicate malicious activity.', '["https://attack.mitre.org/tactics/TA0005/","https://attack.mitre.org/techniques/T1218/"]', 'contains("log.winlogEventDataProcessName", "control.exe") && contains("log.winlogEventDataParentProcessName", "workfolders.exe") && !regexMatch("log.winlogEventDataProcessName", "(:\\Windows\\(System32|SysWOW64)\\control.exe)")', '2026-02-09 16:57:44.131829', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (792, 'Office 365 Anti-Phishing Policy Bypass Detected', 3, 3, 1, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects potential bypasses or modifications to anti-phishing policies including changes to safe sender lists, domain exclusions, or policy disabling that could allow phishing emails to reach users. This rule identifies successful administrative actions on anti-phishing configurations that could weaken email security defenses.
+
+Next Steps:
+1. Review the specific anti-phishing policy changes made by the user
+2. Verify if the changes were authorized and documented in change management
+3. Check if the user has legitimate administrative privileges for email security policies
+4. Examine the timing and context of the changes (e.g., during business hours vs. off-hours)
+5. Look for any subsequent phishing emails that may have bypassed detection
+6. Consider rolling back unauthorized changes and implementing additional approval workflows
+7. Monitor for any unusual email activity following the policy modifications
+', '["https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about","https://attack.mitre.org/techniques/T1562/001/"]', 'oneOf("log.Operation", ["Set-AntiPhishPolicy", "Remove-AntiPhishPolicy", "New-AntiPhishPolicy", "Disable-AntiPhishRule"]) &&
+equals("log.ResultStatus", "Success")
+', '2026-02-09 16:58:33.807960', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.Operation","operator":"filter_match","value":"AntiPhish"}],"or":null,"within":"now-4h","count":2}]', '["lastEvent.log.Operation","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (793, 'Office 365 App Consent Grants Detected', 3, 3, 1, 'Persistence', 'T1098.003 - Account Manipulation: Additional Cloud Credentials', 'Detects when OAuth consent is granted to an application in Office 365. Attackers may use malicious OAuth apps to gain persistent access to user data without requiring credentials. This technique allows attackers to maintain access even after password changes.
+
+Next Steps:
+1. Review the application that received consent and verify its legitimacy
+2. Check the permissions granted to the application
+3. Investigate the user who granted consent for suspicious activity
+4. Review application audit logs for any unauthorized data access
+5. If malicious, revoke the application consent and remove the app registration
+6. Consider implementing application consent policies to prevent unauthorized app installations
+', '["https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-grants","https://attack.mitre.org/techniques/T1098/003/"]', 'equals("action", "Consent to application") && equals("actionResult", "Success")
+', '2026-02-09 16:58:33.937499', true, false, 'origin', null, '[]', '["lastEvent.log.appAccessContextClientAppId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (794, 'Audit Log Tampering Detection', 3, 3, 2, 'Defense Evasion', 'T1070.001 - Indicator Removal: Clear Windows Event Logs', 'Detects attempts to tamper with audit logs by disabling auditing, modifying audit configurations, or clearing audit data. This could indicate an attempt to hide malicious activities.
+
+Next Steps:
+1. Investigate the user account that performed the audit configuration changes
+2. Review recent activities by this user to identify potential malicious actions
+3. Check if the audit configuration was restored after being disabled
+4. Correlate with other security events around the same timeframe
+5. Verify if this was an authorized administrative action
+6. Review any recent privilege escalation or account compromise indicators
+', '["https://learn.microsoft.com/en-us/purview/audit-log-enable-disable","https://attack.mitre.org/techniques/T1070/001/"]', '(oneOf("action", ["Set-AdminAuditLogConfig", "Remove-AdminAuditLogConfig", "Disable-OrganizationCustomization", "Set-OrganizationConfig"]) ||
+(equals("log.Workload", "Exchange") && contains("log.ObjectId", "AdminAuditLog")) ||
+(contains("log.Parameters", "UnifiedAuditLogIngestionEnabled") && contains("log.Parameters", "false"))) &&
+exists("origin.user") &&
+equals("actionResult", "Succeeded")
+', '2026-02-09 16:58:34.076846', true, false, 'origin', null, '[]', '["lastEvent.action","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (800, 'Potential Password Spraying of Microsoft 365 User Accounts', 3, 2, 2, 'Credential Access', 'T1110 - Brute Force', 'Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts.', '["https://attack.mitre.org/techniques/T1110/","https://attack.mitre.org/tactics/TA0006/"]', 'oneOf("log.Workload", ["Exchange", "AzureActiveDirectory"]) && oneOf("action", ["UserLoginFailed", "PasswordLogonInitialAuthUsingPassword"]) && oneOf("actionResult", ["Failed", "False"]) && exists("origin.ip")
+', '2026-02-09 16:58:34.932233', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-60s","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (795, 'Azure AD Integration Suspicious Activity', 2, 2, 1, 'Identity and Access Management', 'T1098 - Account Manipulation', 'Detects suspicious Azure Active Directory integration events including multiple failed authentication attempts, unusual role assignments, or bulk user modifications that could indicate an attempted compromise of identity management systems. This rule identifies patterns of authentication failures, privilege escalations, and bulk account modifications that may suggest malicious activity targeting the organization''s identity infrastructure.
+
+Next Steps:
+1. Review the specific Azure AD activity details and affected user accounts
+2. Analyze the frequency and timing of the detected events for patterns
+3. Verify the legitimacy of any role assignments or user modifications
+4. Check for concurrent suspicious activities from the same IP address or user
+5. Review Azure AD sign-in logs for additional context around failed authentications
+6. Validate whether the activities align with known business processes or authorized administrative tasks
+7. Consider implementing additional monitoring for the affected accounts
+8. If malicious activity is confirmed, immediately review and revoke any unauthorized permissions or access
+', '["https://learn.microsoft.com/en-us/purview/audit-log-activities","https://attack.mitre.org/techniques/T1098/"]', 'equals("log.Workload", "AzureActiveDirectory") &&
+(
+ (equals("action", "Add member to role") && equals("actionResult", "Success")) ||
+ (equals("action", "Delete user") && equals("actionResult", "Success")) ||
+ (equals("action", "Add service principal") && equals("actionResult", "Success"))
+)
+', '2026-02-09 16:58:34.222593', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.Workload","operator":"filter_term","value":"AzureActiveDirectory"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (796, 'Microsoft 365 New Inbox Rule Created', 3, 2, 1, 'Collection', 'T1114 - Email Collection', 'Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
Identifies when a new Inbox rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions, such as moving a message to a specified folder or deleting a message. Adequate permissions are required on the mailbox to create an Inbox rule.', '["https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide","https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps","https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack?view=o365-worldwide","https://attack.mitre.org/techniques/T1114/","https://attack.mitre.org/techniques/T1114/003/","https://attack.mitre.org/tactics/TA0009/"]', 'equals("log.Workload", "Exchange") && equals("action", "New-InboxRule") && oneOf("actionResult", ["Success","Succeeded","PartiallySucceeded","True"])
+', '2026-02-09 16:58:34.362451', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (797, 'Suspicious Compliance Alert Activity', 3, 3, 2, 'Policy and Compliance', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects suspicious patterns in compliance-related activities including alert suppression, policy modifications, or audit log tampering that could indicate attempts to evade security monitoring or hide malicious activities in Office 365 Security & Compliance Center.
+
+Next Steps:
+1. Review the specific compliance action performed and verify if it was authorized
+2. Check if the user has legitimate administrative privileges for compliance operations
+3. Analyze the timing and frequency of compliance changes - multiple rapid changes may indicate malicious activity
+4. Examine what compliance policies, rules, or alerts were modified and assess the security impact
+5. Review audit logs for any related suspicious activities before and after this event
+6. Verify if the changes align with documented change management processes
+7. Check for any correlation with other security alerts or unusual user behavior
+8. If unauthorized, immediately review and restore appropriate compliance settings
+9. Consider implementing additional monitoring on compliance configuration changes
+10. Escalate to security team if evidence suggests malicious intent or privilege abuse
+', '["https://learn.microsoft.com/en-us/purview/audit-log-activities","https://attack.mitre.org/techniques/T1562/001/"]', 'equals("log.Workload", "SecurityComplianceCenter") &&
+(
+ equals("action", "Set-ComplianceSecurityFilter") ||
+ equals("action", "New-ComplianceSecurityFilter") ||
+ equals("action", "Remove-ComplianceSecurityFilter") ||
+ equals("action", "Set-AdminAuditLogConfig") ||
+ equals("action", "Set-OrganizationConfig") ||
+ equals("action", "Remove-CompliancePolicy") ||
+ equals("action", "Disable-ComplianceRule") ||
+ equals("action", "Remove-ComplianceRule") ||
+ equals("action", "Remove-ComplianceTag")
+) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:34.522149', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.Workload","operator":"filter_term","value":"SecurityComplianceCenter"}],"or":null,"within":"now-2h","count":5}]', '["lastEvent.action","lastEvent.log.ObjectId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (798, 'Conditional Access Bypass Detection', 2, 2, 1, 'Defense Evasion', 'T1550 - Use Alternate Authentication Material', 'Detects attempts to bypass conditional access policies through various methods including legacy authentication, trusted location manipulation, or session token abuse. This rule identifies when users successfully authenticate despite conditional access policy failures or use legacy authentication methods that may bypass modern security controls.
+
+Next Steps:
+1. Verify the legitimacy of the authentication attempt with the user
+2. Review conditional access policy configuration and compliance
+3. Check if the authentication method used is approved for the user''s role
+4. Investigate the source IP address and device details
+5. Review recent policy changes that might have caused legitimate bypass
+6. Consider implementing stricter conditional access policies for high-risk users
+7. Monitor for additional suspicious activities from the same user or IP
+', '["https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview","https://attack.mitre.org/techniques/T1550/"]', '(oneOf("action", ["UserLoggedIn", "UserLoginFailed"]) &&
+ (oneOf("log.ConditionalAccessStatus", ["failure", "notApplied"]) && equals("actionResult", "Succeeded"))) &&
+exists("origin.user") &&
+exists("origin.ip")
+', '2026-02-09 16:58:34.657697', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (799, 'Attempts to Brute Force a Microsoft 365 User Account', 3, 3, 3, 'Credential Access', 'T1110 - Brute Force', 'Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts.', '["https://attack.mitre.org/techniques/T1110/","https://attack.mitre.org/tactics/TA0006/"]', 'oneOf("log.Workload", ["Exchange", "AzureActiveDirectory"]) && oneOf("action", ["UserLoginFailed", "PasswordLogonInitialAuthUsingPassword"]) && oneOf("actionResult", ["Failed", "False"]) && exists("origin.user")
+', '2026-02-09 16:58:34.798123', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-60s","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (801, 'O365 Excessive Single Sign-On Logon Errors', 2, 3, 2, 'Credential Access', 'T1110 - Brute Force', 'Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token.', '["https://attack.mitre.org/techniques/T1110/","https://attack.mitre.org/tactics/TA0006/"]', 'equals("log.Workload", "AzureActiveDirectory") && equals("log.LogonError", "SsoArtifactInvalidOrExpired")
+', '2026-02-09 16:58:35.082284', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (802, 'Microsoft 365 Exchange Malware Filter Policy Deletion', 3, 3, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert administrators that an internal user sent a message that containsed malware. This may indicate an account or machine compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection.', '["https://attack.mitre.org/techniques/T1562/","https://attack.mitre.org/tactics/TA0005/"]', 'equals("log.Workload", "Exchange") && equals("action", "Remove-MalwareFilterPolicy") && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:35.222348', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (803, 'Microsoft 365 Exchange Malware Filter Rule Modification', 3, 3, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Identifies when a malware filter rule has been deleted or disabled in Microsoft 365. An adversary or insider threat may want to modify a malware filter rule to evade detection.', '["https://attack.mitre.org/techniques/T1562/","https://attack.mitre.org/tactics/TA0005/"]', 'equals("log.Workload", "Exchange") && oneOf("action", ["Remove-MalwareFilterRule","Disable-MalwareFilterRule"]) && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:35.367665', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (804, 'Microsoft 365 Exchange Safe Attachment Rule Disabled', 3, 3, 2, 'Defense Evasion', 'T1562 - Impair Defenses', 'Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attachment rules can extend malware protections to include routing all messages and attachments without a known malware signature to a special hypervisor environment. An adversary or insider threat may disable a safe attachment rule to exfiltrate data or evade defenses.', '["https://attack.mitre.org/techniques/T1562/","https://attack.mitre.org/tactics/TA0005/"]', 'equals("log.Workload", "Exchange") && equals("action", "Disable-SafeAttachmentRule") && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:35.512792', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (805, 'Microsoft 365 Detection of a connection to a .onion domain', 3, 2, 2, 'Command and Control', 'T1090 - Proxy', 'Tor is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routing information. Tor utilizes Onion Routing, in which messages are encrypted with multiple layers of encryption; at each step in the proxy network, the topmost layer is decrypted and the contents forwarded on to the next node until it reaches its destination.', '["https://attack.mitre.org/software/S0183/","https://attack.mitre.org/software/"]', 'contains("log.siteUrl", ".onion")
+', '2026-02-09 16:58:35.657330', true, false, 'target', null, '[]', '["target.ip","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (806, 'Data Loss Prevention Policy Violation', 3, 2, 1, 'Data Loss Prevention', 'T1213 - Data from Information Repositories', 'Detects violations of Data Loss Prevention (DLP) policies including attempts to share, access, or exfiltrate sensitive information such as credit card numbers, social security numbers, or confidential business data.
+
+This rule triggers when Office 365 DLP policies detect unauthorized handling of sensitive data across Exchange, SharePoint, OneDrive, Teams, or Security Compliance Center workloads.
+
+**Next Steps:**
+1. **Immediate Response:** Review the specific DLP policy violation details and sensitive data types involved
+2. **User Investigation:** Verify if the user action was intentional and authorized, check user''s role and data access permissions
+3. **Data Assessment:** Determine what sensitive information was involved and potential exposure scope
+4. **Policy Review:** Evaluate if DLP policy settings are appropriate or need adjustment
+5. **Incident Documentation:** Record the violation details, investigation findings, and remediation actions taken
+6. **User Training:** If unintentional, provide additional data handling training to the user
+7. **System Monitoring:** Monitor for additional violations from the same user or similar patterns
+', '["https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp","https://attack.mitre.org/techniques/T1213/"]', '(
+ equals("action", "DLPRuleMatch") ||
+ equals("action", "DlpPolicyMatch") ||
+ equals("action", "DLPRuleUndo") ||
+ contains("log.PolicyDetails", "DLP") ||
+ contains("log.ExceptionInfo", "DLP")
+) &&
+(
+ equals("log.Workload", "Exchange") ||
+ equals("log.Workload", "SharePoint") ||
+ equals("log.Workload", "OneDrive") ||
+ equals("log.Workload", "Teams") ||
+ equals("log.Workload", "SecurityComplianceCenter")
+) &&
+!equals("actionResult", "Failed")
+', '2026-02-09 16:58:35.802686', true, false, 'origin', null, '[]', '["lastEvent.log.PolicyId","lastEvent.log.SensitiveInfoTypeData","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (856, 'Probable attempt to exploit vulnerabilities detected in Sophos Central', 3, 3, 3, 'Credential Access', 'T1212', 'An exploit is a small program designed to exploit a particular bug in an operating system or program for various purposes. Depending on the type of vulnerability, the exploit can have different purposes, such as gaining administrator permissions on the system or bypassing security measures in order to carry out a deeper infection.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1212/"]', 'oneOf("log.type", ["Event::Endpoint::HmpaPrivGuard", "Event::Endpoint::HmpaExploitPrevented"])', '2026-02-09 16:58:43.227036', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (807, 'eDiscovery Abuse Detection', 3, 2, 1, 'Data Exfiltration', 'T1074 - Data Staged', 'Detects potential abuse of eDiscovery features including excessive searches, exports, or unauthorized access to sensitive data through eDiscovery operations. This rule identifies users performing multiple eDiscovery actions within a short timeframe, which could indicate malicious data staging or exfiltration attempts.
+
+Next Steps:
+1. Review the user''s authorization and role assignments for eDiscovery operations
+2. Examine the scope and content of the searches performed
+3. Verify if the searches align with legitimate business requirements or ongoing legal matters
+4. Check for unusual patterns in search queries or export activities
+5. Investigate if sensitive data was accessed or exported without proper justification
+6. Review data classification and sensitivity of accessed content
+7. Correlate with other suspicious activities from the same user account
+8. Consider implementing additional monitoring for the user if activity appears unauthorized
+', '["https://learn.microsoft.com/en-us/purview/ediscovery-search-for-activities-in-the-audit-log","https://attack.mitre.org/techniques/T1074/"]', 'oneOf("action", ["SearchStarted", "SearchExported", "SearchCreated", "CaseAdded", "HoldCreated", "SearchExportDownloaded", "SearchPreviewed", "SearchResultsPurged"]) &&
+exists("origin.user") &&
+equals("actionResult", "Succeeded")
+', '2026-02-09 16:58:35.942242', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-1h","count":5}]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (808, 'Exchange Admin Configuration Changes', 3, 3, 2, 'Configuration Changes', 'T1098 - Account Manipulation', 'Detects changes to Exchange administrative configuration that could impact security settings, user permissions, or mail flow policies. This rule monitors for successful execution of critical Exchange administrative cmdlets that can affect organizational security posture.
+
+Next Steps:
+1. Review the specific administrative action performed and verify it was authorized
+2. Check if the user performing the action has appropriate privileges
+3. Examine the timing and frequency of administrative changes
+4. Validate configuration changes against change management policies
+5. Review any related audit logs for the time period around the change
+6. Confirm the source IP and location of the administrative session
+7. If unauthorized, immediately review affected configurations and revert if necessary
+', '["https://docs.microsoft.com/en-us/exchange/security-and-compliance/exchange-auditing-reports/view-administrator-audit-log","https://attack.mitre.org/techniques/T1098/"]', 'oneOf("action", ["Set-AdminAuditLogConfig", "Set-TransportRule", "Set-MalwareFilterPolicy", "Set-HostedContentFilterPolicy", "Set-DkimSigningConfig", "Set-OrganizationConfig", "Set-RoleGroup", "Add-RoleGroupMember", "Remove-RoleGroupMember", "New-ManagementRoleAssignment", "Remove-ManagementRoleAssignment"]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:36.072513', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-1h","count":10}]', '["lastEvent.action","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (809, 'Microsoft 365 Exchange Transport Rule Creation', 3, 2, 1, 'Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.
Identifies a transport rule creation in Microsoft 365. Exchange Online mail transport rules should be set to not forward email to domains outside of your organization as a best practice. An adversary may create transport rules to exfiltrate data.', '["https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules","https://attack.mitre.org/techniques/T1537/","https://attack.mitre.org/tactics/TA0010/"]', 'equals("log.Workload", "Exchange") && equals("action", "New-TransportRule") && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:36.221988', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (810, 'Microsoft 365 Exchange Transport Rule Modification', 3, 2, 1, 'Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.
Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses.', '["https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules","https://attack.mitre.org/techniques/T1537/","https://attack.mitre.org/tactics/TA0010/"]', 'equals("log.Workload", "Exchange") && oneOf("action", ["Remove-TransportRule","Disable-TransportRule"]) && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:36.458058', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (811, 'Suspicious External Sharing Activity', 3, 2, 1, 'Data Loss Prevention', 'T1567 - Exfiltration Over Web Service', 'Detects unauthorized or suspicious external sharing activities in SharePoint and OneDrive that could indicate data exfiltration attempts or policy violations when sharing sensitive content with external parties.
+
+Next Steps:
+1. Review the shared content and assess its sensitivity level
+2. Verify if the external sharing was authorized by data owners
+3. Check if the recipient has legitimate business need for access
+4. Validate against organizational data sharing policies
+5. Examine user''s recent activity for other suspicious sharing patterns
+6. Consider revoking access if sharing was unauthorized
+7. Update DLP policies if needed to prevent future violations
+8. Document findings and coordinate with data protection team
+', '["https://learn.microsoft.com/en-us/purview/audit-log-activities","https://attack.mitre.org/techniques/T1567/"]', '(equals("log.Workload", "SharePoint") || equals("log.Workload", "OneDrive")) &&
+(
+ equals("action", "SharingInvitationCreated") ||
+ equals("action", "AnonymousLinkCreated") ||
+ equals("action", "AnonymousLinkUsed") ||
+ equals("action", "SecureLinkCreated") ||
+ equals("action", "SharingSet") ||
+ equals("action", "CompanyLinkCreated") ||
+ equals("action", "AddedToSecureLink")
+) &&
+equals("actionResult", "Success") &&
+(
+ equals("log.TargetUserOrGroupType", "Guest") ||
+ contains("log.SiteUrl", "external") ||
+ contains("log.EventData", "AllowExternalSharing")
+)
+', '2026-02-09 16:58:36.636964', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"}],"or":null,"within":"now-1h","count":5}]', '["lastEvent.log.ObjectId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (812, 'Office 365 Forms and Sway Phishing Detection', 2, 2, 1, 'Initial Access', 'T1566 - Phishing', 'Detects suspicious usage of Microsoft Forms and Sway for phishing page creation. Attackers leverage these legitimate Microsoft services to host phishing pages that bypass email security controls and appear trustworthy to victims due to the microsoft.com domain.
+
+Next Steps:
+1. Review the Form or Sway content for phishing indicators (credential harvesting, fake login pages)
+2. Check the creator account for signs of compromise
+3. Review the Form''s collection settings for password or sensitive data collection
+4. Check if the Form or Sway was shared externally
+5. Review response submissions for harvested credentials
+6. If malicious, delete the Form/Sway and reset the creator''s credentials
+7. Implement DLP policies to detect credential harvesting forms
+8. Enable Microsoft Defender for Office 365 Forms protection
+', '["https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-policies-about","https://attack.mitre.org/techniques/T1566/"]', '(oneOf("action", ["FormCreated", "FormUpdated", "FormShared"]) ||
+ contains("action", "Sway")) &&
+equals("actionResult", "Success") &&
+(contains("log.Parameters", "password") ||
+ contains("log.Parameters", "credential") ||
+ contains("log.Parameters", "login") ||
+ contains("log.Parameters", "external"))
+', '2026-02-09 16:58:36.762359', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_match","value":"Form"}],"or":null,"within":"now-1h","count":3}]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (813, 'Abnormal Guest User Invitation Activity', 3, 2, 1, 'Identity and Access Management', 'Account Creation', 'Detects unusual spikes in guest user invitations which could indicate an attempt to establish persistence through external accounts or potential data exfiltration preparation by adding unauthorized external collaborators.
+
+Next Steps:
+1. Review the user account initiating the invitations for any signs of compromise
+2. Verify the legitimacy of the invited external users and their business justification
+3. Check if the inviting user has appropriate permissions for guest invitations
+4. Examine the invited users'' email domains for suspicious or unexpected organizations
+5. Review any subsequent activity by the invited guest users
+6. Validate that the invitation frequency aligns with normal business processes
+7. Consider implementing additional approval workflows for guest user invitations
+', '["https://learn.microsoft.com/en-us/purview/audit-log-activities","https://attack.mitre.org/techniques/T1136/"]', 'equals("log.Workload", "AzureActiveDirectory") &&
+(
+ equals("action", "Invite external user") ||
+ equals("action", "InviteGuest") ||
+ equals("action", "Add guest to group") ||
+ equals("action", "Guest user invite redeemed")
+) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:36.897486', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"Invite external user"}],"or":null,"within":"now-1h","count":10}]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (814, 'Information Barriers Policy Violation', 3, 2, 1, 'Privilege Escalation', 'Valid Accounts', 'Detects violations of information barrier policies designed to prevent conflicts of interest by restricting communications and collaborations between specific groups or individuals within the organization. Information barriers are critical security controls that prevent unauthorized information sharing between different business units or roles.
+
+Next Steps:
+1. Review the specific information barrier policy that was violated and the users involved
+2. Investigate whether the violation was intentional or accidental
+3. Check if there are patterns of repeated violations by the same user or group
+4. Review and update information barrier policies if necessary
+5. Provide additional training to users if violations appear to be due to lack of awareness
+6. Consider implementing additional technical controls to prevent future violations
+', '["https://learn.microsoft.com/en-us/purview/information-barriers","https://attack.mitre.org/techniques/T1078/"]', 'equals("action", "InformationBarrierPolicyViolation") || (equals("log.PolicyType", "InformationBarrier") && equals("actionResult", "Blocked")) || (equals("log.ViolationType", "InformationBarrier") && equals("action", "CommunicationBlocked"))
+', '2026-02-09 16:58:37.027385', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.PolicyType","operator":"filter_term","value":"InformationBarrier"}],"or":null,"within":"now-12h","count":3}]', '["lastEvent.log.TargetUser","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (815, 'Microsoft 365 Exchange Anti-Phish Policy Deletion', 2, 3, 2, 'Initial Access', 'T1566 - Phishing', 'Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containsing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source.
Identifies the deletion of an anti-phishing policy in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing polices increase this protection by refining settings to better detect and prevent attacks.', '["https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide","https://attack.mitre.org/techniques/T1566/","https://attack.mitre.org/tactics/TA0001/"]', 'equals("log.Workload", "Exchange") && equals("action", "Remove-AntiPhishPolicy") && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:37.187287', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (816, 'Microsoft 365 Exchange Safe Link Policy Disabled', 3, 2, 2, 'Initial Access', 'T1566 - Phishing', 'When it comes to protecting its users, Microsoft takes the threat of phishing seriously. Spoofing is a common technique that''s used by attackers. Spoofed messages appear to originate from someone or somewhere other than the actual source. This technique is often used in phishing campaigns that are designed to obtain user credentials. The anti-spoofing technology in EOP specifically examines forgery of the From header in the message body (used to display the message sender in email clients). When EOP has high confidence that the From header is forged, the message is identified as spoofed.
Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contains hyperlinks, even after they have been delivered to a user.', '["https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-safe-links?view=o365-worldwide","https://attack.mitre.org/techniques/T1566/"]', 'equals("log.Workload", "Exchange") && equals("action", "Disable-SafeLinksRule") && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:37.321893', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (817, 'Insider Risk Indicator Detection', 3, 3, 2, 'Collection', 'Data from Local System', 'Detects insider risk indicators such as unusual data access patterns, mass downloads, sensitive data exfiltration attempts, or policy violations that may indicate malicious insider activity or compromised accounts.
+
+Next Steps:
+1. Review the specific insider risk alert details and policy violated
+2. Investigate the user''s recent activity patterns and data access history
+3. Check if the user has legitimate business justification for the flagged activity
+4. Review the user''s role, permissions, and access to sensitive resources
+5. Correlate with HR records for any recent disciplinary actions or employment changes
+6. Examine network logs for any unusual data transfer patterns or external communications
+7. Consider implementing additional monitoring or access restrictions if suspicious activity is confirmed
+8. Escalate to security team and HR if malicious intent is suspected
+', '["https://learn.microsoft.com/en-us/purview/insider-risk-management","https://attack.mitre.org/techniques/T1005/"]', 'equals("action", "InsiderRiskAlert") || (contains("log.PolicyName", "InsiderRisk") && equals("actionResult", "PolicyViolation")) || (oneOf("log.RiskLevel", ["High", "Critical"]) && equals("log.AlertSource", "InsiderRiskManagement"))
+', '2026-02-09 16:58:37.457219', true, false, 'origin', null, '[]', '["lastEvent.log.PolicyName","lastEvent.log.RiskLevel","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (818, 'Microsoft 365 Exchange Anti-Phish Rule Modification', 2, 3, 2, 'Initial Access', 'T1566 - Phishing', 'Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containsing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source.
Identifies the modification of an anti-phishing rule in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing rules increase this protection by refining settings to better detect and prevent attacks.', '["https://attack.mitre.org/techniques/T1566/","https://attack.mitre.org/tactics/TA0001/"]', 'equals("log.Workload", "Exchange") && oneOf("action", ["Remove-AntiPhishRule","Disable-AntiPhishRule"]) && oneOf("actionResult", ["Success","PartiallySucceeded","True"])
+', '2026-02-09 16:58:37.607269', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (819, 'M365 Data Exfiltration to Unsanctioned Application', 3, 2, 1, 'Exfiltration', 'T1537 - Transfer Data to Cloud Account', 'Detects Microsoft Defender for Cloud Apps (CASB) alerts for data exfiltration to unsanctioned applications. This indicates sensitive organizational data is being transferred to unauthorized cloud services.
+
+Next Steps:
+1. Identify the unsanctioned application and the data being transferred
+2. Review the user''s recent activity for other data exfiltration indicators
+3. Check the volume and sensitivity of data transferred
+4. Block the unsanctioned application if not already blocked
+5. If unauthorized, investigate the user account for compromise
+6. Review DLP policies for coverage gaps
+7. Consider implementing session controls for risky applications
+', '["https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps","https://attack.mitre.org/techniques/T1537/"]', '(contains("action", "DlpRuleMatch") && contains("log.Parameters", "UnsanctionedApp")) ||
+(equals("log.Workload", "MicrosoftDefenderForCloudApps") && contains("log.Parameters", "exfiltration"))
+', '2026-02-09 16:58:37.747185', true, false, 'origin', null, '[]', '["lastEvent.log.Parameters","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (820, 'M365 New Federated Domain Added', 3, 3, 3, 'Persistence', 'T1556 - Modify Authentication Process', 'Detects when a new federated domain is added to Microsoft 365. Adding federated domains is a critical attack technique that enables Golden SAML attacks, allowing attackers to forge authentication tokens and maintain persistent backdoor access to the tenant.
+
+Next Steps:
+1. Immediately verify the federated domain addition was authorized
+2. Review the federation configuration and signing certificates
+3. Validate the identity provider endpoint URLs
+4. Check the admin account that made the change for compromise
+5. Review all authentications from the federated domain
+6. If unauthorized, remove the federated domain immediately
+7. Audit all changes to tenant federation settings
+', '["https://learn.microsoft.com/en-us/microsoft-365/enterprise/plan-for-third-party-ssl-certificates","https://attack.mitre.org/techniques/T1556/"]', 'oneOf("action", ["Set domain authentication", "Add unverified domain", "Verify domain"]) &&
+(contains("log.Parameters", "Federated") || contains("log.Parameters", "federation")) &&
+exists("origin.user")
+', '2026-02-09 16:58:37.882455', true, false, 'origin', null, '[]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (821, 'M365 Suspicious OAuth Application File Downloads', 3, 2, 1, 'Collection', 'T1530 - Data from Cloud Storage Object', 'Detects Microsoft Defender for Cloud Apps alerts for suspicious OAuth application file download activities. Malicious OAuth apps granted consent by phished users can mass-download files from SharePoint and OneDrive.
+
+Next Steps:
+1. Identify the OAuth application and its registered publisher
+2. Review the application''s consented permissions (especially Files.Read.All)
+3. Check which user consented to the application
+4. Review the volume and types of files downloaded
+5. If unauthorized, revoke the application consent and block the application
+6. Check for other users who consented to the same application
+7. Review the downloaded file contents for sensitivity
+', '["https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-anomaly-alerts","https://attack.mitre.org/techniques/T1530/"]', '(equals("log.Workload", "MicrosoftDefenderForCloudApps") && contains("log.Parameters", "Suspicious OAuth app file download")) ||
+(contains("action", "AppFileDownloaded") && contains("log.Parameters", "OAuth"))
+', '2026-02-09 16:58:38.017376', true, false, 'origin', null, '[]', '["lastEvent.log.Parameters","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (822, 'M365 Mailbox PST Export Detected', 3, 1, 1, 'Collection', 'T1114.002 - Email Collection: Remote Email Collection', 'Detects PST file exports from Microsoft 365 mailboxes. Bulk email export to PST format is a primary method of email exfiltration, often performed by compromised admin accounts or insider threats.
+
+Next Steps:
+1. Verify the PST export was authorized and part of a legitimate process
+2. Check the user performing the export for proper authorization
+3. Review which mailboxes were exported and their sensitivity
+4. Check for associated eDiscovery search operations
+5. If unauthorized, revoke the user''s eDiscovery permissions
+6. Review the export download logs for destination information
+7. Check for other mass data access by the same user
+', '["https://learn.microsoft.com/en-us/purview/ediscovery-export-search-results","https://attack.mitre.org/techniques/T1114/002/"]', 'oneOf("action", ["New-ComplianceSearchAction", "SearchExportDownloaded"]) &&
+contains("log.Parameters", "Export") &&
+exists("origin.user")
+', '2026-02-09 16:58:38.162529', true, false, 'origin', null, '[]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (823, 'Office 365 Mail Flow Rule Modified', 3, 3, 2, 'Defense Evasion', 'T1564.008 - Hide Artifacts: Email Hiding Rules', 'Detects modifications to mail flow rules (transport rules) in Office 365. Attackers may create or modify mail flow rules to redirect, delete, or hide emails, bypassing security controls or exfiltrating data. Mail flow rules can be used to automatically delete emails containing specific keywords, forward sensitive emails to external addresses, or modify email content.
+
+Next Steps:
+1. Review the specific mail flow rule that was modified, including its conditions and actions
+2. Verify if the change was authorized and performed by a legitimate administrator
+3. Check if the rule involves email forwarding to external domains or deletion of emails
+4. Examine recent email traffic to identify any emails that may have been affected by the rule
+5. Review mailbox audit logs for the affected user accounts
+6. Check for other administrative changes made by the same user around the same time
+7. If unauthorized, disable the malicious rule immediately and investigate the compromised account
+', '["https://admindroid.com/how-to-audit-transport-rule-changes-report-in-microsoft-365","https://attack.mitre.org/techniques/T1564/008/"]', 'oneOf("action", ["New-TransportRule", "Set-TransportRule", "Remove-TransportRule", "Enable-TransportRule", "Disable-TransportRule"]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:38.302310', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_match","value":"TransportRule"}],"or":null,"within":"now-1h","count":3}]', '["lastEvent.action","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (824, 'Suspicious Mail Forwarding Rule Creation', 3, 2, 1, 'Data Exfiltration', 'T1114.001 - Email Collection: Local Email Collection', 'Detects creation or modification of inbox rules that forward emails to external recipients, which could indicate data exfiltration attempts. This rule monitors for the creation of new inbox rules or modifications to existing rules that contain forwarding parameters.
+
+Next Steps:
+1. Review the specific forwarding parameters in the log.Parameters field to identify the destination email address
+2. Verify if the forwarding destination is a legitimate business email or an external/suspicious address
+3. Check if the user who created the rule has legitimate business justification for email forwarding
+4. Review recent authentication logs for the affected user account for signs of compromise
+5. Examine the timing of the rule creation - if created outside business hours or immediately after login, investigate further
+6. Check for other suspicious activities by the same user account around the same timeframe
+7. If malicious, disable the forwarding rule and reset user credentials
+', '["https://docs.microsoft.com/en-us/microsoft-365/compliance/auditing-troubleshooting-scenarios","https://attack.mitre.org/techniques/T1114/001/"]', 'oneOf("action", ["NewInboxRule", "Set-InboxRule", "UpdateInboxRules"]) &&
+equals("actionResult", "Success") &&
+(contains("log.Parameters", "ForwardTo") || contains("log.Parameters", "ForwardAsAttachmentTo") || contains("log.Parameters", "RedirectTo"))
+', '2026-02-09 16:58:38.437051', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (825, 'Office 365 Mailbox Delegation Abuse', 3, 2, 1, 'Persistence', 'T1098.002 - Account Manipulation: Additional Email Delegate Permissions', 'Detects addition of mailbox delegation permissions including FullAccess, SendAs, and SendOnBehalf. Attackers may add mailbox permissions to access sensitive emails, send phishing messages as the compromised user, or maintain persistent access to communications.
+
+Next Steps:
+1. Verify the mailbox delegation was authorized by the mailbox owner or administrator
+2. Review the specific permissions granted (FullAccess, SendAs, SendOnBehalf)
+3. Check who the delegate user is and their relationship to the mailbox owner
+4. Review recent authentication activity for both the admin and delegate accounts
+5. Examine the timing of the delegation for suspicious patterns
+6. If unauthorized, remove the delegation permissions immediately
+7. Review the mailbox for signs of unauthorized access or data theft
+8. Enable mailbox audit logging if not already enabled
+', '["https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-permissions-for-recipients","https://attack.mitre.org/techniques/T1098/002/"]', 'oneOf("action", ["Add-MailboxPermission", "Add-RecipientPermission", "Set-Mailbox"]) &&
+equals("actionResult", "Success") &&
+(contains("log.Parameters", "FullAccess") ||
+ contains("log.Parameters", "SendAs") ||
+ contains("log.Parameters", "SendOnBehalf"))
+', '2026-02-09 16:58:38.576764', true, false, 'origin', null, '[]', '["adversary.user","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (826, 'Office 365 Mailbox Export to PST', 3, 1, 1, 'Data Exfiltration', 'T1114.002 - Email Collection: Remote Email Collection', 'Detects creation of mailbox export requests which generate PST files containing email data. Attackers with compromised admin credentials may use New-MailboxExportRequest or eDiscovery export to bulk exfiltrate email data from target mailboxes.
+
+Next Steps:
+1. Verify the mailbox export was authorized for legitimate eDiscovery or compliance purposes
+2. Identify the target mailbox(es) being exported
+3. Review the administrator performing the export and confirm authorization
+4. Check the export destination and ensure it is within organizational control
+5. Review the content filters applied to the export request
+6. If unauthorized, cancel the export and revoke admin credentials
+7. Review the exported data for sensitive or regulated content
+8. Implement RBAC to restrict mailbox export permissions
+', '["https://learn.microsoft.com/en-us/exchange/policy-and-compliance/ediscovery/export-results-to-pst","https://attack.mitre.org/techniques/T1114/002/"]', 'oneOf("action", ["New-MailboxExportRequest", "New-ComplianceSearchAction", "SearchExportDownloaded"]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:38.722533', true, false, 'origin', null, '[]', '["lastEvent.action","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (827, 'Mass Email Deletion Detected', 2, 3, 2, 'Data Loss', 'T1114 - Email Collection', 'Detects when a user performs mass deletion of emails which could indicate data destruction, covering tracks, or malicious insider activity. Monitors for multiple HardDelete or SoftDelete operations within a short time window.
+
+Next Steps:
+1. Verify the legitimacy of the user performing the deletions
+2. Check if this aligns with any scheduled maintenance or cleanup activities
+3. Investigate the content and importance of deleted emails if possible
+4. Review user''s recent access patterns and behavior
+5. Check for any concurrent suspicious activities from the same user
+6. Validate if the user has appropriate permissions for bulk email operations
+7. Consider temporarily restricting the user''s access pending investigation
+', '["https://learn.microsoft.com/en-us/purview/audit-mailboxes","https://attack.mitre.org/techniques/T1114/"]', 'oneOf("action", ["HardDelete", "SoftDelete"]) && exists("origin.user") && exists("origin.ip")
+', '2026-02-09 16:58:38.877594', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"HardDelete"}],"or":[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"SoftDelete"}],"or":null,"within":"now-15m","count":100}],"within":"now-15m","count":100}]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (828, 'MFA Fatigue Push Spam Attack Detection', 3, 2, 1, 'Credential Access', 'T1621 - Multi-Factor Authentication Request Generation', 'Detects MFA fatigue attacks where an attacker repeatedly triggers MFA push notifications to overwhelm a user into accepting. Multiple failed MFA challenges followed by a successful authentication strongly indicates an MFA fatigue attack.
+
+Next Steps:
+1. Contact the user immediately to verify if they intentionally approved the MFA request
+2. Review the source IP addresses of the MFA challenges
+3. Check if the authentication was ultimately successful after the MFA spam
+4. Review the user''s account for signs of compromise post-authentication
+5. If MFA was approved under duress, immediately reset credentials and revoke sessions
+6. Switch the user to phishing-resistant MFA methods (FIDO2, certificate-based)
+7. Enable number matching for push notifications
+8. Implement risk-based Conditional Access policies
+', '["https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks","https://attack.mitre.org/techniques/T1621/"]', '(equals("action", "UserLoginFailed") || equals("action", "UserLoggedIn")) &&
+(contains("log.Parameters", "MFA") ||
+ contains("log.LogonError", "MfaDenied") ||
+ contains("log.LogonError", "MfaIncomplete") ||
+ equals("log.LogonError", "InvalidStrongAuthenticationMethod"))
+', '2026-02-09 16:58:39.017690', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.LogonError","operator":"filter_match","value":"Mfa"}],"or":null,"within":"now-15m","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (829, 'Multi-Geo Data Violations', 3, 2, 1, 'Data Loss', 'T1030 - Data Transfer Size Limits', 'Detects violations of multi-geo data residency policies including unauthorized data movements between regions, cross-geo access violations, or attempts to bypass geo-restrictions. This rule identifies activities such as site geo moves, cross-geo file operations, and data location parameter modifications that may indicate unauthorized data transfer or policy violations.
+
+Next Steps:
+1. Review the user''s authorization level for multi-geo operations
+2. Verify if the geo movement was approved through proper change management
+3. Check data classification and residency requirements for affected content
+4. Examine the source and destination locations for compliance violations
+5. Review audit logs for related suspicious activities by the same user
+6. Validate that the operation aligns with organizational data governance policies
+', '["https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-multi-geo","https://attack.mitre.org/techniques/T1030/"]', '(oneOf("action", ["SiteGeoMoveScheduled", "SiteGeoMoveCompleted", "SiteGeoMoveCancelled", "AllowedDataLocationAdded", "GeoQuotaAllocated", "MigrationJobCompleted"]) ||
+(equals("log.Workload", "OneDrive") && contains("log.ItemName", "cross-geo")) ||
+(exists("log.SourceFileName") && exists("log.DestinationFileName") && contains("log.SourceRelativeUrl", "geo") && contains("log.DestinationRelativeUrl", "geo")) ||
+(contains("log.Parameters", "DataLocation") || contains("log.Parameters", "PreferredDataLocation"))) &&
+exists("origin.user") &&
+equals("actionResult", "Succeeded") &&
+exists("origin.ip")
+', '2026-02-09 16:58:39.161883', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"SiteGeoMoveScheduled"}],"or":[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"AllowedDataLocationAdded"}],"or":null,"within":"now-24h","count":2}],"within":"now-24h","count":3}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (830, 'Office 365 Global Admin Role Assignment', 3, 3, 2, 'Privilege Escalation', 'T1098 - Account Manipulation', 'Detects assignment of high-privilege administrative roles in Office 365, particularly Global Administrator, Exchange Administrator, and SharePoint Administrator. These roles provide extensive control over the tenant and are high-value targets for persistence.
+
+Next Steps:
+1. Verify the role assignment was authorized through proper governance
+2. Review the specific role being assigned and the target user
+3. Check if the assigning administrator''s account shows signs of compromise
+4. Verify the role assignment follows the principle of least privilege
+5. Review the target user''s recent activities post-assignment
+6. If unauthorized, immediately remove the role assignment
+7. Implement Privileged Identity Management (PIM) for just-in-time access
+8. Enable alerts on all privileged role modifications
+', '["https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference","https://attack.mitre.org/techniques/T1098/"]', 'oneOf("action", ["Add member to role.", "Add eligible member to role in PIM requested (permanent)."]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:39.301520', true, false, 'origin', null, '[]', '["adversary.user","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (831, 'Office 365 Impossible Travel Login Detection', 3, 2, 1, 'Credential Access', 'T1078 - Valid Accounts', 'Detects Office 365 sign-ins from geographically impossible locations by correlating successful logins from different countries within a short time window. This pattern strongly indicates credential compromise and unauthorized account access.
+
+Next Steps:
+1. Review the login locations and IP addresses for the affected user
+2. Check if the user uses VPN services that could explain different geolocations
+3. Verify with the user whether both login sessions are legitimate
+4. Review the actions performed in each session for data access or configuration changes
+5. Check for inbox rule creation or mail forwarding changes
+6. If compromised, immediately reset user credentials and revoke all active sessions
+7. Enable MFA if not already configured
+8. Review the affected user''s mailbox for signs of data theft
+', '["https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack","https://attack.mitre.org/techniques/T1078/"]', 'equals("action", "UserLoggedIn") &&
+equals("actionResult", "Success") &&
+exists("origin.geolocation.countryCode")
+', '2026-02-09 16:58:39.427314', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"UserLoggedIn"},{"field":"origin.geolocation.countryCode","operator":"must_not_term","value":"{{origin.geolocation.countryCode}}"}],"or":null,"within":"now-30m","count":1}]', '["adversary.geolocation.countryCode","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (836, 'Power BI Suspicious Data Export', 3, 1, 1, 'Data Exfiltration', 'T1567 - Exfiltration Over Web Service', 'Detects bulk Power BI report exports and data downloads that may indicate data exfiltration. Attackers with access to Power BI may export reports and underlying datasets containing sensitive business data.
+
+Next Steps:
+1. Review the specific reports and datasets being exported
+2. Verify the user has legitimate business need for the exports
+3. Check the data sensitivity of the exported content
+4. Review the export destination and format
+5. Examine the volume and frequency of exports
+6. If unauthorized, disable the user''s Power BI access and investigate
+7. Implement Power BI data loss prevention policies
+8. Enable row-level security on sensitive datasets
+', '["https://learn.microsoft.com/en-us/power-bi/admin/service-admin-auditing","https://attack.mitre.org/techniques/T1567/"]', 'oneOf("action", ["ExportReport", "ExportDataflow", "DownloadReport", "ExportArtifact"]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:40.137225', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_match","value":"Export"}],"or":null,"within":"now-30m","count":5}]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (832, 'Office 365 OAuth Application Anomalous Activity', 3, 3, 2, 'Credential Access', 'T1528 - Steal Application Access Token', 'Detects anomalous OAuth application activities including suspicious consent patterns, high-privilege permission grants, or rapid consent events from a single user which may indicate compromised accounts or malicious OAuth apps. This rule identifies when users consent to OAuth applications with high-risk permissions such as Mail access, Files access, or User.ReadWrite permissions, followed by multiple consent events from the same IP address.
+
+Next Steps:
+- Review the OAuth application details and permissions granted
+- Verify if the user intentionally consented to the application
+- Check for any suspicious activities from the user account after consent
+- Investigate the OAuth application''s reputation and publisher
+- Consider revoking application permissions if deemed malicious
+- Review other users who may have consented to the same application
+- Implement conditional access policies to restrict high-risk OAuth consents
+', '["https://office365itpros.com/2023/12/15/oauth-apps-security/","https://attack.mitre.org/techniques/T1528/"]', 'equals("action", "Consent to application") && equals("actionResult", "Success") && (contains("log.Scope", "Mail.") || contains("log.Scope", "Files.") || contains("log.Scope", "User.ReadWrite") || contains("log.Scope", ".All"))
+', '2026-02-09 16:58:39.587722', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"},{"field":"action","operator":"filter_term","value":"Consent to application"}],"or":null,"within":"now-1h","count":5}]', '["lastEvent.log.appAccessContextClientAppId","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (833, 'OneDrive Mass File Access Detected', 3, 1, 2, 'Data Reconnaissance', 'T1530 - Data from Cloud Storage Object', 'Detects when a user accesses an abnormally high number of files in OneDrive within a short time period (200+ files in 30 minutes), which could indicate automated data collection, reconnaissance, or preparation for data exfiltration. This behavior is often associated with insider threats, compromised accounts, or malicious scripts designed to harvest sensitive data from cloud storage.
+
+Next Steps:
+1. Immediately verify the legitimacy of the user account and check for signs of compromise
+2. Review the specific files accessed to determine sensitivity and business impact
+3. Check for concurrent suspicious activities like bulk downloads or external sharing
+4. Examine authentication logs for unusual login patterns or locations
+5. Verify if the access pattern aligns with the user''s normal work responsibilities
+6. Consider temporarily restricting the user''s OneDrive access pending investigation
+7. Review OneDrive sharing permissions and external access configurations
+8. Check for any automated tools or scripts that might be accessing the files
+9. Correlate with other security events from the same user or IP address
+10. Document findings and escalate to incident response team if malicious activity is confirmed
+', '["https://o365reports.com/2024/01/30/audit-file-access-in-sharepoint-online-using-powershell/","https://attack.mitre.org/techniques/T1530/"]', 'oneOf("action", ["FileAccessed", "FileAccessedExtended", "FilePreviewed"]) && exists("origin.user") && equals("log.Workload", "OneDrive")
+', '2026-02-09 16:58:39.727441', true, false, 'origin', '["adversary.user","adversary.ip"]', '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"FileAccessed"},{"field":"log.Workload","operator":"filter_term","value":"OneDrive"}],"or":[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"FileAccessedExtended"},{"field":"log.Workload","operator":"filter_term","value":"OneDrive"}],"or":null,"within":"now-30m","count":67},{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"FilePreviewed"},{"field":"log.Workload","operator":"filter_term","value":"OneDrive"}],"or":null,"within":"now-30m","count":67}],"within":"now-30m","count":67}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (834, 'Microsoft 365 Possible Successful Password Guessing detected', 3, 2, 2, 'Credential Access', 'T1110.001 - Brute Force', 'Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target''s policies on password complexity or use policies that may lock accounts out after a number of failed attempts.', '["https://attack.mitre.org/tactics/TA0006","https://attack.mitre.org/techniques/T1110/001/"]', 'oneOf("log.Workload", ["Exchange","AzureActiveDirectory"]) && equals("action", "UserLoginFailed") && oneOf("actionResult", ["Failed","False"]) && exists("origin.user") && exists("log.clientIP")
+', '2026-02-09 16:58:39.867475', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"action","operator":"filter_term","value":"UserLoginFailed"},{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.clientIP","operator":"filter_term","value":"{{log.clientIP}}"}],"or":null,"within":"now-1m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (835, 'Suspicious Power Automate Flow Activity', 3, 3, 2, 'Process Automation Abuse', 'Automated Collection', 'Detects creation or modification of Power Automate flows that could be used for automated data exfiltration or unauthorized process automation. This rule identifies suspicious Power Automate activity including flow creation, modification, sharing, and connection management that may indicate malicious automation attempts.
+
+Next Steps:
+1. Investigate the user account performing the Power Automate actions - verify if this is legitimate business activity
+2. Review the specific flows created or modified - analyze their triggers, actions, and data access patterns
+3. Check if the flows are accessing sensitive data sources (SharePoint, OneDrive, databases, external APIs)
+4. Examine flow sharing patterns - verify if flows are being shared with unauthorized users or external accounts
+5. Review connection creation/deletion activities - check for connections to suspicious external services
+6. Correlate with other Office 365 audit logs to identify broader attack patterns
+7. If malicious, immediately disable the flows and revoke user permissions
+8. Consider implementing Power Platform DLP policies to prevent future abuse
+', '["https://docs.microsoft.com/en-us/power-platform/admin/audit-data-user-activity","https://attack.mitre.org/techniques/T1119/"]', 'oneOf("action", ["CreateFlow", "ShareFlow", "CreateConnection"]) &&
+equals("actionResult", "Success") &&
+equals("log.Workload", "PowerAutomate")
+', '2026-02-09 16:58:40.002168', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.Workload","operator":"filter_term","value":"PowerAutomate"}],"or":null,"within":"now-6h","count":10}]', '["lastEvent.action","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (853, 'Application Hijacking prevented in Sophos Central', 3, 3, 3, 'Persistence', 'T1574 - Hijack Execution Flow', 'Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.', '["https://attack.mitre.org/tactics/TA0003/","https://attack.mitre.org/techniques/T1574/"]', 'equals("log.type", "Event::Endpoint::HmpaApplicationHijacking")', '2026-02-09 16:58:42.801989', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (837, 'Power Apps Data Connector Suspicious Activity', 3, 2, 1, 'Data Exfiltration', 'T1530 - Data from Cloud Storage Object', 'Detects creation or modification of Power Apps data connectors that could lead to unauthorized data access or exfiltration from corporate data sources. This rule identifies suspicious Power Apps activities including app creation/modification, data connection changes, and data export/import operations that may indicate an attempt to access or exfiltrate sensitive organizational data.
+
+Next Steps:
+1. Review the specific Power Apps activity and determine if it was authorized
+2. Verify the user''s role and permissions for Power Apps and data connectors
+3. Examine the data sources being connected to and assess their sensitivity
+4. Check for any recent data exports or unusual data access patterns
+5. Review the user''s recent activity for other suspicious behavior
+6. Validate the legitimacy of any new apps or data connections created
+7. Consider implementing additional monitoring for the affected user account
+8. If unauthorized, immediately revoke access and investigate potential data compromise
+', '["https://docs.microsoft.com/en-us/power-platform/admin/audit-data-user-activity","https://attack.mitre.org/techniques/T1530/"]', 'oneOf("action", ["CreateDataConnection", "UpdateDataConnection", "ExportData", "ImportData"]) &&
+equals("actionResult", "Success") &&
+equals("log.Workload", "PowerApps")
+', '2026-02-09 16:58:40.287583', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"CreateDataConnection"}],"or":[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"UpdateDataConnection"}],"or":null,"within":"now-12h","count":2},{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"ExportData"}],"or":null,"within":"now-12h","count":3}],"within":"now-12h","count":2}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (838, 'Office 365 Safe Attachment Policy Violation', 3, 3, 2, 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 'Detects violations of Safe Attachment policies including malicious files blocked during detonation, policy modifications that reduce protection, or attempts to bypass attachment scanning that could lead to malware delivery. This rule identifies when Safe Attachment policies are modified, disabled, or when malicious attachments are detected and blocked by Office 365 security controls.
+
+Next Steps:
+1. Review the specific Safe Attachment policy change or violation that occurred
+2. Verify if the policy modification was authorized and legitimate
+3. Check if any malicious attachments were successfully blocked or if any bypassed controls
+4. Investigate the user account that performed the action for signs of compromise
+5. Review email logs for any related suspicious email activity
+6. Validate current Safe Attachment policy configurations are properly restrictive
+7. Consider implementing additional email security controls if gaps are identified
+', '["https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about","https://attack.mitre.org/techniques/T1566/001/"]', 'oneOf("action", ["Set-SafeAttachmentPolicy", "Remove-SafeAttachmentPolicy", "Disable-SafeAttachmentRule"]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:40.432455', true, false, 'origin', null, '[]', '["lastEvent.action","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (839, 'Safe Links Click Pattern Anomaly', 2, 3, 1, 'Defense Evasion', 'T1204.001 - User Execution: Malicious Link', 'Detects unusual patterns in Safe Links click behavior that may indicate phishing attempts or malicious URL access. This rule monitors for multiple clicks on suspicious URLs from the same user within a short timeframe, which could indicate either a persistent phishing campaign or user behavior that poses security risks.
+
+Next Steps:
+1. Review the user''s activity timeline to identify the source of the malicious links
+2. Check email security logs for the original messages containing the blocked URLs
+3. Verify if other users received similar phishing emails
+4. Assess whether the user''s account has been compromised
+5. Implement additional security awareness training for the affected user
+6. Consider blocking the malicious domains at the network level
+', '["https://learn.microsoft.com/en-us/defender-office-365/safe-links-about","https://attack.mitre.org/techniques/T1204/001/"]', 'equals("action", "ClickedSafeLink") && equals("actionResult", "Blocked") && exists("origin.user")
+', '2026-02-09 16:58:40.582125', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"ClickedSafeLink"}],"or":null,"within":"now-30m","count":5}]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (840, 'Service Principal Credential Addition', 3, 3, 1, 'Persistence', 'T1098.001 - Account Manipulation: Additional Cloud Credentials', 'Detects addition of credentials (secrets or certificates) to application registrations and service principals. Attackers may add new credentials to existing service principals to establish persistent backdoor access to the tenant without relying on user credentials.
+
+Next Steps:
+1. Identify the application or service principal receiving the new credential
+2. Verify the credential addition was authorized by the application owner
+3. Review the application''s API permissions and scope of access
+4. Check the credential type (secret, certificate) and its expiration
+5. Review the identity adding the credential for signs of compromise
+6. If unauthorized, remove the added credential and rotate existing ones
+7. Review Azure AD audit logs for actions performed using the new credential
+8. Implement Azure AD alerts for credential changes to critical applications
+', '["https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal","https://attack.mitre.org/techniques/T1098/001/"]', 'oneOf("action", ["Add service principal credentials.", "Update application - Certificates and secrets management"]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:40.722927', true, false, 'origin', null, '[]', '["lastEvent.log.Parameters","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (841, 'SharePoint Mass File Download Detected', 3, 1, 2, 'Data Exfiltration', 'T1213 - Data from Information Repositories', 'Detects when a user downloads an unusually large number of files from SharePoint or OneDrive within a short time period, which could indicate data exfiltration or insider threat activity. This rule triggers when a user downloads 100 or more files within 30 minutes.
+
+**Next Steps:**
+1. Review the user''s recent activity patterns and determine if the download volume is consistent with their role and responsibilities
+2. Check if the user has legitimate business justification for downloading large amounts of data
+3. Examine the types of files downloaded and their sensitivity levels
+4. Verify the user''s location and device used for the downloads
+5. Look for any concurrent suspicious activities such as unusual login times or access from new locations
+6. Contact the user''s manager to validate the business need for the file downloads
+7. Consider implementing additional monitoring or restrictions if the activity appears suspicious
+8. Review data loss prevention (DLP) policies and ensure they are properly configured
+', '["https://www.sharepointdiary.com/2020/10/how-to-track-document-downloads-using-audit-log-in-sharepoint-online.html","https://attack.mitre.org/techniques/T1213/"]', 'equals("action", "FileDownloaded") && exists("origin.user") && oneOf("log.Workload", ["SharePoint", "OneDrive"])
+', '2026-02-09 16:58:40.872231', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"action","operator":"filter_term","value":"FileDownloaded"}],"or":null,"within":"now-30m","count":100}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (842, 'SharePoint Permission Escalation Detection', 3, 2, 1, 'Privilege Escalation', 'T1098 - Account Manipulation', 'Detects escalation of SharePoint permissions including adding site collection administrators and granting site admin privileges to external users. These changes can provide unauthorized access to sensitive SharePoint data and configuration settings.
+
+Next Steps:
+1. Verify the permission change was authorized by a legitimate site owner
+2. Review the specific permissions granted and the target user
+3. Check if the target user is an external or guest account
+4. Review the affected site collection''s data sensitivity
+5. Examine recent activities by the newly privileged user
+6. If unauthorized, remove the elevated permissions immediately
+7. Review SharePoint audit logs for data access by the privileged account
+8. Implement SharePoint access governance policies
+', '["https://learn.microsoft.com/en-us/sharepoint/manage-site-collection-administrators","https://attack.mitre.org/techniques/T1098/"]', 'oneOf("action", ["SiteCollectionAdminAdded", "SiteAdmin"]) &&
+equals("actionResult", "Success")
+', '2026-02-09 16:58:41.002263', true, false, 'origin', null, '[]', '["adversary.user","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (843, 'Suspicious Email Forwarding Rule Created', 3, 2, 1, 'Persistence', 'T1114.003 - Email Collection: Email Forwarding Rule', 'Detects creation or modification of inbox rules that forward emails to external domains, which is a common technique used by attackers to exfiltrate emails and maintain persistence after compromising an account. Attackers often create these rules to automatically forward sensitive emails to external addresses under their control.
+
+Next Steps:
+1. Verify if the user creating the rule is legitimate and authorized
+2. Check the destination email address in the forwarding rule for external domains
+3. Review recent authentication logs for the affected user account
+4. Examine other administrative actions performed by this user recently
+5. Check for any other suspicious inbox rules created by the same user
+6. Validate if the forwarding address belongs to a legitimate business contact
+7. Consider temporarily disabling the forwarding rule pending investigation
+8. Review email logs to see what emails may have already been forwarded
+', '["https://redcanary.com/blog/threat-detection/email-forwarding-rules/","https://attack.mitre.org/techniques/T1114/003/"]', 'oneOf("action", ["New-InboxRule", "Set-InboxRule"]) && exists("origin.user") && (contains("log.Parameters", "ForwardTo") || contains("log.Parameters", "RedirectTo") || contains("log.Parameters", "ForwardAsAttachmentTo"))
+', '2026-02-09 16:58:41.136607', true, false, 'origin', null, '[]', '["adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (844, 'Suspicious Teams Message Export Activity', 3, 2, 1, 'Data Exfiltration', 'T1114 - Email Collection', 'Detects when Teams messages are exported or accessed in bulk through API calls, which could indicate an attempt to exfiltrate chat history and shared files from Microsoft Teams.
+
+Next Steps:
+1. Review the user''s recent Teams activity and authentication events
+2. Check if the export activity was authorized or part of legitimate business operations
+3. Examine the volume and scope of data accessed or exported
+4. Verify the user''s current permissions and access levels
+5. Look for any concurrent suspicious activities from the same user account
+6. Contact the user to confirm if they initiated these export operations
+7. Review any third-party applications that may have access to Teams data
+', '["https://learn.microsoft.com/en-us/purview/audit-teams-audit-log-events","https://attack.mitre.org/techniques/T1114/"]', 'oneOf("action", ["MessagesListed", "MessagesExported", "RecordingExported", "TranscriptsExported"]) && exists("origin.user") && equals("log.Workload", "MicrosoftTeams")
+', '2026-02-09 16:58:41.272231', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.Workload","operator":"filter_term","value":"MicrosoftTeams"}],"or":null,"within":"now-1h","count":20}]', '["lastEvent.log.appAccessContextClientAppId","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (845, 'Threat Intelligence Alert Pattern', 3, 3, 2, 'Initial Access', 'Phishing', 'Detects threat intelligence alerts from Office 365 security services indicating known malicious activities, threat actor patterns, or indicators of compromise matching threat intelligence feeds. These alerts are generated when Microsoft''s threat intelligence systems identify suspicious activities, malicious file attachments, URLs, or communication patterns associated with known threat actors.
+
+Next Steps:
+1. Immediately review the alert details and associated threat intelligence indicators
+2. Investigate the affected user account for any compromise indicators
+3. Check email activity and file access patterns for the affected user
+4. Verify if any malicious files were opened or downloaded
+5. Review authentication logs for unusual sign-in patterns
+6. Examine network connections and data transfer activities
+7. Check for lateral movement attempts within the organization
+8. Implement containment measures if compromise is confirmed
+9. Update security policies and user training based on attack vectors
+10. Report findings to incident response team and document lessons learned
+', '["https://learn.microsoft.com/en-us/microsoft-365/security/defender/threat-analytics","https://attack.mitre.org/techniques/T1566/"]', 'equals("action", "ThreatIntelligenceAlertTriggered") || (equals("log.AlertType", "ThreatIntelligence") && !equals("actionResult", "Success"))
+', '2026-02-09 16:58:41.417169', true, false, 'origin', null, '[]', '["adversary.user","target.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (846, 'Microsoft Teams External User Phishing Detection', 2, 2, 1, 'Initial Access', 'T1566 - Phishing', 'Detects suspicious external user interactions in Microsoft Teams including external users sending messages with links, file sharing from external users, and mass external user additions. Teams is increasingly used as a phishing vector to bypass email security controls.
+
+Next Steps:
+1. Review the external user''s identity and their organization
+2. Check the content of messages for phishing links or social engineering
+3. Verify if external access is necessary for the affected teams and channels
+4. Review any files shared by the external user for malicious content
+5. Check if any users clicked on links or downloaded shared files
+6. If malicious, remove the external user and block their domain
+7. Implement Teams external access policies to restrict communication
+8. Enable Safe Links and Safe Attachments for Teams
+', '["https://learn.microsoft.com/en-us/microsoftteams/communicate-with-users-from-other-organizations","https://attack.mitre.org/techniques/T1566/"]', '(equals("action", "MemberAdded") || equals("action", "ChatCreated") || equals("action", "MessageSent")) &&
+equals("actionResult", "Success") &&
+contains("log.Parameters", "#EXT#")
+', '2026-02-09 16:58:41.562518', true, false, 'origin', null, '[{"indexPattern":"v11-log-o365-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.Parameters","operator":"filter_match","value":"#EXT#"}],"or":null,"within":"now-1h","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (854, 'Credential Theft Attemp detected in Sophos Central', 3, 3, 3, 'Credential Access', 'T1003 - OS Credential Dumping', 'The theft of access credentials to different pages or apps occurs due to the use of insecure passwords, which are used in different accounts. This data is often exposed as a result of leaks that arise from the exploitation of vulnerabilities in different platforms.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1003/"]', 'contains("log.type", "Event::Endpoint::HmpaCred")', '2026-02-09 16:58:42.937211', true, false, 'target', null, '[]', '["target.host","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (847, 'Sophos Central Behavioral Analysis Alert', 3, 3, 2, 'Suspicious Behavior', 'T1055 - Process Injection', 'Detects suspicious behavior patterns identified by Sophos behavioral analysis engine, including process injection attempts, privilege escalation, and other anomalous activities that indicate potential compromise.
+
+Next Steps:
+1. Review the specific behavioral detection details in the Sophos Central console
+2. Examine the affected endpoint for signs of compromise
+3. Check process execution history and parent-child relationships
+4. Investigate network connections from the affected endpoint
+5. Review file system changes and registry modifications
+6. Consider isolating the endpoint if malicious activity is confirmed
+7. Update endpoint security policies based on findings
+', '["https://developer.sophos.com/siem-api-schemas","https://attack.mitre.org/techniques/T1055/"]', 'oneOf("log.type", ["Event::Endpoint::Threat::BehavioralDetection", "Event::Endpoint::BehaviorDetected"]) ||
+(oneOf("log.detectionMethod", ["Behavioral", "HIPS"]) && oneOf("log.severity", ["medium", "high", "critical"])) ||
+(contains("log.name", "Behavioral") && oneOf("log.severity", ["high", "critical"]))
+', '2026-02-09 16:58:41.706992', true, false, 'origin', null, '[{"indexPattern":"v11-log-sophos-central-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":3}]', '["lastEvent.log.processPath","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (848, 'Endpoint Threat Detection', 3, 3, 2, 'Malware Detection', 'T1055 - Process Injection', 'Detects threats identified on endpoints by Sophos Central, including malware, PUAs (Potentially Unwanted Applications), and suspicious behavior. This rule triggers when Sophos Central identifies threats such as process injection, malware execution, or other malicious activities on managed endpoints.
+
+Next Steps:
+1. Immediately isolate the affected endpoint from the network to prevent lateral movement
+2. Review the threat details including threat name, file path, and detection method
+3. Examine the endpoint''s recent activity logs for signs of compromise
+4. Check if the threat was successfully quarantined or requires manual intervention
+5. Verify if other endpoints in the environment show similar threat indicators
+6. Review user activity on the affected endpoint around the time of detection
+7. Perform forensic analysis of the affected files and processes if needed
+8. Update security policies and endpoint configurations if gaps are identified
+9. Conduct threat hunting across the environment for similar indicators of compromise
+', '["https://developer.sophos.com/docs/endpoint-v1/1/routes/events/get","https://attack.mitre.org/techniques/T1055/"]', 'oneOf("log.type", ["Event::Endpoint::Threat::Detected", "Event::Endpoint::Threat::HIPSDetected", "Event::Endpoint::Threat::PuaDetected"]) ||
+(oneOf("log.severity", ["high", "critical"]) && equals("log.category", "threat") && exists("log.threatName"))
+', '2026-02-09 16:58:41.847184', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (849, 'Sophos Central Exploit Prevention Triggered', 3, 3, 2, 'Exploit Attempt', 'T1203 - Exploitation for Client Execution', 'Detects when Sophos exploit prevention is triggered, indicating attempted exploitation of vulnerable applications. This includes shellcode protection, CTF protocol exploitation attempts, and process hijacking attempts.
+
+Next Steps:
+1. Immediately isolate the affected endpoint to prevent lateral movement
+2. Review the exploit details including target application and attack vector
+3. Check for additional suspicious activity on the affected host within the past 24 hours
+4. Verify if the targeted application is up to date with security patches
+5. Examine network connections from the affected host for C2 communication
+6. Review user activity and authentication logs for the affected endpoint
+7. Consider running additional endpoint scans for indicators of compromise
+8. Update security policies if the exploit targeted a previously unknown vulnerability
+', '["https://developer.sophos.com/siem-api-schemas","https://attack.mitre.org/techniques/T1203/"]', 'oneOf("log.type", ["Event::Endpoint::Threat::ExploitPrevented", "Event::Endpoint::Exploit::Prevented"]) ||
+(equals("log.name", "Exploit prevented") && oneOf("log.severity", ["high", "critical"]))
+', '2026-02-09 16:58:41.977249', true, false, 'origin', null, '[{"indexPattern":"v11-log-sophos-central-*","with":[{"field":"log.endpointId","operator":"filter_term","value":"{{log.endpointId}}"}],"or":null,"within":"now-30m","count":2}]', '["lastEvent.log.name","adversary.host"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (850, 'Managed Threat Response Critical Alert', 3, 3, 3, 'Threat Detection', 'T1562 - Impair Defenses', 'Detects critical alerts from Sophos Managed Threat Response (MTR) service indicating active threats that require immediate investigation and response, including advanced persistent threats and sophisticated attack techniques.
+
+Next Steps:
+1. Review the MTR alert details in Sophos Central console
+2. Examine the affected endpoint for signs of compromise
+3. Check for lateral movement indicators on the network
+4. Verify if the threat has been successfully contained
+5. Update security policies based on threat intelligence from the alert
+6. Document the incident and response actions taken
+', '["https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/ThreatAnalysisCenter/index.html","https://attack.mitre.org/tactics/TA0005/"]', 'oneOf("log.type", ["mtr_alert", "threat_detection"]) &&
+oneOf("log.severity", ["critical", "high"])
+', '2026-02-09 16:58:42.117132', true, false, 'origin', null, '[{"indexPattern":"v11-log-sophos-central-*","with":[{"field":"log.endpointId","operator":"filter_term","value":"{{log.endpointId}}"},{"field":"log.severity","operator":"filter_term","value":"critical"}],"or":null,"within":"now-1h","count":3}]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (851, 'Sophos Central Ransomware Detection', 3, 3, 3, 'Ransomware Activity', 'T1486 - Data Encrypted for Impact', 'Detects ransomware activity including CryptoGuard alerts, master boot record attacks, and file system encryption attempts. This is a critical security event requiring immediate response.
+
+Next Steps:
+1. Immediately isolate the affected endpoint from the network
+2. Identify the user account and processes involved in the ransomware activity
+3. Check for lateral movement to other systems using the same user credentials
+4. Verify backup integrity and availability for potential restoration
+5. Analyze file system changes and encrypted file patterns
+6. Review network connections for command and control communications
+7. Search for ransomware notes or payment demands on the system
+8. Coordinate with incident response team for containment and recovery
+9. Monitor for similar patterns on other endpoints in the environment
+10. Document all findings for forensic analysis and threat intelligence
+', '["https://developer.sophos.com/siem-api-schemas","https://attack.mitre.org/techniques/T1486/"]', 'oneOf("log.type", ["Event::Endpoint::Threat::RansomwareDetected", "Event::Endpoint::CryptoGuard::FileEncryption"]) ||
+(equals("log.name", "CryptoGuard") && equals("log.action", "blocked")) ||
+(equals("log.name", "Ransomware detected") && equals("log.severity", "critical")) ||
+(equals("log.type", "Event::Endpoint::Threat::Detected") && equals("log.threatType", "Ransomware"))
+', '2026-02-09 16:58:42.256681', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (855, 'Potentially compromised or blocked device detected in Sophos Central', 3, 3, 3, 'Resource Development', 'T1584', 'Adversaries may compromise third-party infrastructure that can be used during targeting', '["https://attack.mitre.org/techniques/T1584/"]', 'oneOf("log.type", [''Event::Endpoint::Device::Blocked'', ''Event::UAV::PotentiallyCompromisedDevice''])', '2026-02-09 16:58:43.082661', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (852, 'Server Protection Alerts', 3, 3, 2, 'Server Security', 'T1505 - Server Software Component', 'Detects critical security alerts on servers protected by Sophos Central, including unauthorized access attempts, service tampering, and malware targeting server infrastructure. This rule monitors for high-severity threats specifically targeting server endpoints.
+
+Next Steps:
+1. Immediately isolate the affected server from the network if threat is confirmed active
+2. Review the specific threat details in Sophos Central console to understand the attack vector
+3. Check server logs for unauthorized access attempts or privilege escalation activities
+4. Verify integrity of critical server services and configurations
+5. Scan for additional indicators of compromise on the server and connected systems
+6. Review recent server changes, updates, or new software installations
+7. Check for lateral movement attempts from the compromised server
+8. Implement additional monitoring for the affected server endpoint
+9. Update security policies and access controls based on findings
+10. Document the incident and update security procedures if necessary
+', '["https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/Servers/index.html","https://attack.mitre.org/techniques/T1505/"]', 'oneOf("log.type", ["Event::Server::Threat::Detected", "Event::Server::Protection::Disabled", "Event::Server::Exploit::Prevented"]) ||
+(equals("log.endpointType", "server") && oneOf("log.severity", ["high", "critical"]) && exists("log.threatName"))
+', '2026-02-09 16:58:42.702862', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (857, 'Malware detected in Sophos Central', 3, 3, 3, 'Execution', 'T1204 - User Execution', 'A computer virus is a piece of malicious code that is prepended or appended to existing files on your computer. Viruses are named after biological viruses because they use similar techniques to spread from one place to another. Virus is often misused to refer to any threat. This usage is gradually being replaced with a more accurate term, malware (malicious software). Computer viruses primarly attack executable files and documents. In short, this is how a computer virus works: after running the infected file, the malicious code is called and executed prior to the execution of the original application. A virus can infect any files that the current user has write permissions for. Computer viruses can range in purpose and severity. Some of them are extremely dangerous because of their ability to delete files purposely from the hard drive. On the other hand, some viruses do not cause any damage they only serve to annoy the user and demonstrate the technical skills of their authors.', '["https://www.mcafee.com/en-us/antivirus/malware.html"]', 'regexMatch("log.type", "^Event::Endpoint::(CoreDetection|CoreRemoteDetection|CoreHmpaClean|CoreClean)$|Event::Endpoint::(HmpaMalware|CoreHmpaCleanFailed|CoreCleanFailed)|Event::SpamOrVirus::Alert|Event::Endpoint::Threat::(HIPS|Dismissed|CleanedUp)|Event::OutboundMalwareProtection::BlockedSender")', '2026-02-09 16:58:43.377420', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (858, 'Man in the Middle Attack detected in Sophos Central', 3, 3, 3, 'Credential Access', 'T1557 - Adversary-in-the-Middle', 'Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle technique to support follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1557/"]', 'contains("log.type", "Event::Smc::MitmAttackEvent")', '2026-02-09 16:58:43.532034', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (859, 'Possible Botnet detected in Sophos Central', 3, 3, 3, 'Impact', 'T1071 - Application Layer Protocol', 'A bot, or a web robot is an automated malware program that scans blocks of network addresses and infects vulnerable computers. This allow hackers to take control of many computers at the same time and turn them into bots (also known as a zombie). Hackers typically use bots to infect large numbers of computers, which form a network or a botnet. Once the botnet is in your computer, it can be used in distributed denial of service (DDoS) attacks, proxy and also can be used to perform automated tasks over the Internet, without you knowing it (for example sending spam, viruses or stealing personal and private information such as bank credentials or credit card numbers).', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1565/"]', 'equals("log.type", "Event::Firewall::FirewallAdvancedThreatProtection")', '2026-02-09 16:58:43.686491', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (860, 'Possible Brute Force Attack detected in Sophos Central', 3, 3, 3, 'Credential Access', 'T1110 - Brute Force', 'Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1110/"]', 'equals("log.type", "Event::ZTNA::ZTNAAuthenticationFailure")', '2026-02-09 16:58:43.851632', true, false, 'origin', null, '[{"indexPattern":"v11-log-sophos-central-*","with":[{"field":"log.type","operator":"filter_term","value":"Event::ZTNA::ZTNAAuthenticationFailure"},{"field":"log.ip","operator":"filter_term","value":"{{log.ip}}"}],"or":null,"within":"now-5m","count":10}]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (861, 'Potential Password Spraying Attack detected in Sophos Central', 1, 2, 2, 'Credential Access', 'T1110 - Brute Force', 'Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.', '["https://attack.mitre.org/tactics/TA0006/","https://attack.mitre.org/techniques/T1110/"]', 'equals("log.type", "Event::ZTNA::ZTNAAuthenticationFailure")', '2026-02-09 16:58:44.007299', true, false, 'origin', null, '[{"indexPattern":"v11-log-sophos-central-*","with":[{"field":"log.type","operator":"filter_term","value":"Event::ZTNA::ZTNAAuthenticationFailure"},{"field":"log.ip","operator":"filter_term","value":"{{log.ip}}"}],"or":null,"within":"now-1m","count":10}]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (862, 'Possible Ransomware Attack detected in Sophos Central', 3, 3, 2, 'Impact', 'T1486 - Data Encrypted for Impact', 'Ransomware, is a type of malware that prevents users from accessing their system or personal files and requires payment of a ransom in order to gain access to them again. Identifies ransomware attempts', '["https://attack.mitre.org/tactics/TA0040/","https://attack.mitre.org/techniques/T1565/"]', 'regexMatch("log.type", "Event::Endpoint::(HmpaCryptoGuardSMBOrigin|HmpaCryptoGuardSMB)|^Event::Endpoint::HmpaCryptoGuard$")', '2026-02-09 16:58:44.172646', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (863, 'Real Time Protection disabled in Sophos Central', 2, 2, 1, 'Defense Evasion', 'T1562 - Impair Defenses', 'Real-time protection has been disabled, which can help malware and attacks go undetected', '["https://www.makeuseof.com/real-time-protection/"]', 'equals("log.type", "Event::Endpoint::SavDisabled")', '2026-02-09 16:58:44.327132', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (871, 'Probable Sophos ip spoofing attack', 3, 3, 3, 'Impact', 'T1499 - Endpoint Denial of Service', 'IP spoofing is the creation of Internet Protocol (IP) packets which have a modified source address in order to either hide the identity of the sender, to impersonate another computer system, or both. It is a technique often used by bad actors to invoke DDoS attacks against a target device or the surrounding infrastructure.', '["https://support.sophos.com/support/s/article/KB-000035616?language=en_US","https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/DoSBypassRuleManage.html","https://attack.mitre.org/tactics/TA0040","https://attack.mitre.org/techniques/T1499/","https://www.cloudflare.com/learning/ddos/glossary/ip-spoofing/"]', 'equals("log.component", "IP spoof")
+', '2026-02-09 16:58:45.927282', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (864, 'Unknown Threat detected in Sophos Central', 3, 3, 2, 'Execution', 'T1204 - User Execution', 'A computer virus is a piece of malicious code that is prepended or appended to existing files on your computer. Viruses are named after biological viruses because they use similar techniques to spread from one place to another. Virus is often misused to refer to any threat. This usage is gradually being replaced with a more accurate term, malware (malicious software). Computer viruses primarly attack executable files and documents. In short, this is how a computer virus works: after running the infected file, the malicious code is called and executed prior to the execution of the original application. A virus can infect any files that the current user has write permissions for. Computer viruses can range in purpose and severity. Some of them are extremely dangerous because of their ability to delete files purposely from the hard drive. On the other hand, some viruses do not cause any damage they only serve to annoy the user and demonstrate the technical skills of their authors.', '["https://www.mcafee.com/en-us/antivirus/malware.html"]', 'regexMatch("log.type", "Event::Endpoint::(CoreIps|HomeThreatRemnants|HmpaBehaviourPrevented|HmpaThreat|HmpaSafeBrowsing|CoreAmsi|CoreOutbreak)|Event::Endpoint::Threat::(CleanupFailed::|Ips|CommandAndControl)")', '2026-02-09 16:58:44.487064', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (865, 'Sophos Central Tamper Protection Alert', 2, 3, 2, 'Defense Evasion', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'Detects when tamper protection is triggered, indicating an attempt to disable or modify Sophos security components. This could indicate malware or an attacker attempting to bypass security controls.
+
+Next Steps:
+1. Immediately investigate the affected endpoint to determine the source of the tamper protection trigger
+2. Check if the endpoint shows signs of malware infection or unauthorized software installation
+3. Review recent user activity and process execution on the affected system
+4. Verify the integrity of Sophos security components and ensure they are functioning properly
+5. Scan the endpoint for threats and malware using full system scans
+6. If malicious activity is confirmed, isolate the endpoint and perform incident response procedures
+7. Review security policies and user permissions to prevent future tamper attempts
+8. Consider implementing additional endpoint monitoring for systems with tamper protection alerts
+', '["https://developer.sophos.com/siem-api-schemas","https://attack.mitre.org/techniques/T1562/001/"]', 'equals("log.type", "Event::Endpoint::Threat::TamperProtection") ||
+(equals("log.name", "Tamper protection") && equals("log.severity", "high")) ||
+(equals("log.type", "Event::Endpoint::TamperProtection") && equals("log.action", "blocked"))
+', '2026-02-09 16:58:44.647015', true, false, 'origin', null, '[]', '["adversary.host","adversary.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (866, 'Sophos XG Advanced Threat Protection Alert', 3, 3, 2, 'Malware', 'T1204 - User Execution', 'Detects when Sophos XG Firewall''s Advanced Threat Protection (ATP) identifies malicious activity, including sandboxing results, malware detection, and zero-day threats. This rule triggers on ATP events indicating threat detection, malware identification, or virus findings.
+
+Next Steps:
+1. Immediately isolate the affected host from the network
+2. Review the ATP threat details and sandbox analysis results
+3. Check for any file transfers or downloads from the source IP
+4. Scan the internal network for indicators of compromise
+5. Update threat intelligence feeds and firewall signatures
+6. Review user activity from the affected source
+7. Consider reimaging the affected system if malware is confirmed
+', '["https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/AdvancedProtection/index.html","https://attack.mitre.org/techniques/T1204/"]', 'equals("log.type", "ATP") && equals("log.component", "Threat Protection") &&
+(oneOf("log.subType", ["Malware", "Threat"]) || exists("log.virus"))
+', '2026-02-09 16:58:44.807367', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sophos-xg-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-30m","count":2}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (867, 'Probable Sophos denial of service (DoS) attack', 3, 3, 3, 'Impact', 'T1499 - Endpoint Denial of Service', 'A Denial of Service (DoS) attack is an attempt to make a machine or network resource unavailable to the intended users. One common method of attack involves saturating the target machine with external communications requests so that it cannot respond to legitimate traffic or the machine responds so slowly that it is essentially useless.', '["https://support.sophos.com/support/s/article/KB-000035754?language=en_US","https://docs.sophos.com/nsg/sophos-firewall/18.5/PDF/SF%20syslog%20guide%2018.5.pdf","https://attack.mitre.org/tactics/TA0040","https://attack.mitre.org/techniques/T1499/"]', 'equalsIgnoreCase("log.component", "dos attacks") && equalsIgnoreCase("log.subType", "dos")
+', '2026-02-09 16:58:44.967319', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (868, 'Probable malware detected by sophos firewall', 3, 3, 3, 'Execution', 'T1204 - User Execution', 'The Sophos firewall has detected a suspicious event and made some actions according to his configuration', '["https://www.mcafee.com/en-us/antivirus/malware.html","https://www.fortinet.com/resources/cyberglossary/computer-virus"]', 'regexMatch("log.subType", "(?i)^(virus|pua)$")
+', '2026-02-09 16:58:45.127029', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (869, 'Sophos detected high priority alerts', 3, 3, 3, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'The Sophos firewall device has detected a high priority event. For the alert purpose, high priority is when log priority is: Emergency, Critical or Alert, and not part of the list of risked applications. Please see the logs attached to this alert for additional details.', '["https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/concepts/LogIDStructure.html","https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/LogMessages.html"]', 'oneOf("log.priority", ["Emergency", "Critical", "Alert"]) &&
+!regexMatch("log.application", "(Torrent|Proxy|EXE File Download|eMule P2P|Ares P2P|Avast Antivirus|NetFlix|McAfee Antivirus|AVG Antivirus|ISAKMP VPN|WeTransfer Base|Xbox LIVE|OSC_AMU)") &&
+!regexMatch("log.applicationName", "(Torrent|Proxy|EXE File Download|eMule P2P|Ares P2P|Avast Antivirus|NetFlix|McAfee Antivirus|AVG Antivirus|ISAKMP VPN|WeTransfer Base|Xbox LIVE|OSC_AMU)")
+', '2026-02-09 16:58:45.287251', true, false, 'origin', null, '[]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (870, 'Probable Sophos initial access vulnerability', 2, 2, 1, 'Initial Access', 'T1078.001 - Valid Accounts', 'Sophos firewall has detected the Guest account activation', '["https://attack.mitre.org/tactics/TA0001/","https://attack.mitre.org/techniques/T1078/001/"]', 'equals("log.Id", "17925")
+', '2026-02-09 16:58:45.767336', true, false, 'origin', null, '[]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (872, 'Probable password guessing in Sophos Administrator account', 3, 3, 2, 'Credential Access', 'T1110.001 - Brute Force', 'Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target''s policies on password complexity or use policies that may lock accounts out after a number of failed attempts.', '["https://support.sophos.com/support/s/article/KB-000034986?language=en_US","https://attack.mitre.org/tactics/TA0006","https://attack.mitre.org/techniques/T1110/001/"]', 'equals("log.Id", "17913")
+', '2026-02-09 16:58:46.087527', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sophos-xg-*","with":[{"field":"log.Id","operator":"filter_term","value":"17913"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (873, 'Sophos XG IPS Alert Detection', 3, 3, 2, 'Intrusion Detection', 'T1190 - Exploit Public-Facing Application', 'Detects IPS alert triggers on Sophos XG Firewall indicating active exploitation attempts, vulnerability scanning, or known attack signatures targeting protected hosts.
+
+Next Steps:
+1. Review the IPS signature details and severity level
+2. Investigate the source IP for additional malicious activity
+3. Check if the attack was blocked or only logged
+4. Verify the target system is patched against the detected vulnerability
+5. Scan the target for signs of compromise if the attack may have succeeded
+6. Update IPS signatures and security policies
+', '["https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/IPS/index.html","https://attack.mitre.org/techniques/T1190/"]', 'equals("log.type", "IPS") &&
+(oneOf("log.severity", ["Critical", "High"]) ||
+ contains("log.priority", ["1", "2"])) &&
+exists("origin.ip") &&
+exists("target.ip")
+', '2026-02-09 16:58:46.247310', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sophos-xg-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (874, 'Sophos XG VPN Authentication Failures', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', 'Detects multiple VPN authentication failures on Sophos XG Firewall, indicating potential brute force attacks against SSL VPN or IPsec VPN services.
+
+Next Steps:
+1. Investigate the source IP and check geographic location
+2. Verify the targeted user account exists and is active
+3. Check for successful VPN connections from the same IP
+4. Consider blocking the source IP
+5. Enable MFA for VPN access
+6. Review VPN portal exposure settings
+', '["https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/index.html","https://attack.mitre.org/techniques/T1110/"]', '(equals("log.component", "SSL VPN") || equals("log.component", "IPSec")) &&
+equals("log.type", "Event") &&
+(contains("log.message", ["authentication failed", "login failed", "invalid credentials", "auth failure"]) ||
+ contains("log.subType", "Authentication")) &&
+exists("origin.ip")
+', '2026-02-09 16:58:46.421877', true, false, 'origin', null, '[{"indexPattern":"v11-log-firewall-sophos-xg-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (875, 'High level Suricata alert', 3, 3, 3, 'Initial Access', 'T1190 - Exploit Public-Facing Application', 'Suricata has detected a high severity alert. This indicates potential malicious activity targeting the network infrastructure, such as exploitation attempts, malware communication, or suspicious network behavior.', '["https://suricata.readthedocs.io/en/latest/"]', 'equals("log.eventType", "alert") && equals("severity", "high")', '2026-02-09 16:58:46.607661', true, false, 'origin', null, '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{origin.ip}}"}],"or":null,"within":"now-15m","count":3}]', '["adversary.ip","target.ip"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (876, 'Medium level Suricata alert', 2, 2, 2, 'Discovery', 'T1046 - Network Service Discovery', 'Suricata has detected a medium severity alert that may indicate reconnaissance or scanning attempts. This could include port scanning, protocol anomalies, or suspicious network patterns that warrant investigation but may not represent an immediate threat.', '["https://suricata.readthedocs.io/en/latest/"]', 'equals("log.eventType", "alert") && equals("severity", "medium")', '2026-02-09 16:58:46.767474', true, false, 'target', '["target.ip","target.ip"]', '[{"indexPattern":"v11-log-suricata-*","with":[{"field":"target.ip","operator":"filter_term","value":"{{target.ip}}"}],"or":null,"within":"now-15m","count":5}]', null);
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (877, 'Cross-Source Lateral Movement Detection', 3, 2, 1, 'Lateral Movement', 'T1021 - Remote Services', 'Detects patterns of authentication events across multiple log sources that indicate lateral movement. Monitors for remote service access patterns including RDP, SSH, SMB, and WMI connections followed by execution indicators.
+
+Next Steps:
+1. Map the authentication chain across systems
+2. Identify the initial point of compromise
+3. Verify each hop was from authorized activity
+4. Check for credential reuse across systems
+5. Investigate the final destination for post-exploitation activity
+6. Implement network segmentation to limit lateral movement paths
+', '["https://attack.mitre.org/techniques/T1021/"]', 'exists("origin.ip") &&
+exists("origin.user") &&
+(
+ (exists("log.message") && (
+ (contains("log.message", "remote") && contains("log.message", "login")) ||
+ (contains("log.message", "authenticated") && contains("log.message", "from")) ||
+ (contains("log.message", "session") && contains("log.message", "opened") && contains("log.message", "remote")) ||
+ contains("log.message", "lateral movement") ||
+ (contains("log.message", "RDP") && contains("log.message", "connection")) ||
+ (contains("log.message", "SMB") && contains("log.message", "authenticated")) ||
+ (contains("log.message", "WMI") && contains("log.message", "connection"))
+ )) ||
+ (exists("action") && (
+ equals("action", "remote_login") ||
+ equals("action", "network_logon") ||
+ equals("action", "rdp_connection")
+ ))
+)
+', '2026-02-09 16:58:46.922307', true, false, 'origin', null, '[{"indexPattern":"v11-log-generic-*","with":[{"field":"origin.user","operator":"filter_term","value":"{{origin.user}}"},{"field":"log.message","operator":"filter_match","value":"remote login OR authenticated OR session opened"}],"or":null,"within":"now-30m","count":5}]', '["adversary.ip","adversary.user"]');
+insert into public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) values (878, 'Process Hollowing Detection', 3, 3, 2, 'Defense Evasion, Privilege Escalation', 'T1055.012 - Process Injection: Process Hollowing', 'Detects process hollowing attempts where malware creates a new process in suspended state, unmaps its memory, and replaces it with malicious code. This advanced technique is used to evade detection by hiding malicious code within legitimate processes.
+
+Next Steps:
+1. Immediately isolate the affected system to prevent lateral movement
+2. Identify the parent process that initiated the hollowing attempt
+3. Check for persistence mechanisms on the affected host
+4. Review process creation events around the same timeframe
+5. Collect memory dumps for forensic analysis
+6. Search for similar patterns across other endpoints
+7. Update endpoint protection policies to block the identified threat
+', '["https://attack.mitre.org/techniques/T1055/012/","https://www.kaspersky.com/enterprise-security/wiki-section/products/behavior-based-protection"]', '(equals("log.signatureID", "3") || equals("log.cs1", "DETECT")) &&
+(contains("log.message", ["hollow", "RunPE", "suspend", "NtUnmapViewOfSection", "ZwUnmapViewOfSection"]) ||
+ contains("log.cs4", ["hollow", "RunPE", "replace"]) ||
+ contains("log.cefMsg", ["hollow", "suspended", "unmap"])) &&
+greaterOrEqual("log.cefDeviceSeverity", 3)
+', '2026-02-09 17:03:25.772701', true, false, 'origin', null, '[]', '["lastEvent.log.cs5","adversary.host"]');
diff --git a/backend/src/main/resources/config/liquibase/data/20260209/utm_group_rules_data_type.sql b/backend/src/main/resources/config/liquibase/data/20260209/utm_group_rules_data_type.sql
new file mode 100644
index 000000000..8cabb00fc
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/data/20260209/utm_group_rules_data_type.sql
@@ -0,0 +1,887 @@
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (1, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (2, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (3, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (4, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (5, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (6, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (7, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (8, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (9, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (10, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (11, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (12, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (13, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (14, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (15, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (16, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (17, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (18, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (19, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (20, 38, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (21, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (22, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (23, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (24, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (25, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (26, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (27, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (28, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (29, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (30, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (31, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (32, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (33, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (34, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (35, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (36, 37, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (37, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (38, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (39, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (40, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (41, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (42, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (43, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (44, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (45, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (46, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (47, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (48, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (49, 27, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (50, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (51, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (52, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (53, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (54, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (55, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (56, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (57, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (58, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (59, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (60, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (61, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (62, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (63, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (64, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (65, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (66, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (67, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (68, 28, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (69, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (70, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (71, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (72, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (73, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (74, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (75, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (76, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (77, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (78, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (79, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (80, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (81, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (82, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (83, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (84, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (85, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (86, 29, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (87, 6, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (88, 6, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (89, 35, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (90, 35, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (91, 6, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (92, 35, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (93, 13, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (94, 13, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (95, 13, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (96, 13, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (97, 13, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (98, 5, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (99, 5, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (100, 5, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (101, 5, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (102, 5, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (103, 5, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (104, 5, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (105, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (106, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (107, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (108, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (109, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (110, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (111, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (112, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (113, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (114, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (115, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (116, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (117, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (118, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (119, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (120, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (121, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (122, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (123, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (124, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (125, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (126, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (127, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (128, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (129, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (130, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (131, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (132, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (133, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (134, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (135, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (136, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (137, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (138, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (139, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (140, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (141, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (142, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (143, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (144, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (145, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (146, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (147, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (148, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (149, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (150, 3, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (151, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (152, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (153, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (154, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (155, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (156, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (157, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (158, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (159, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (160, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (161, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (162, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (163, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (164, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (165, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (166, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (167, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (168, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (169, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (170, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (171, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (172, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (173, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (174, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (175, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (176, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (177, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (178, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (179, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (180, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (181, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (182, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (183, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (184, 12, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (185, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (186, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (187, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (188, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (189, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (190, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (191, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (192, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (193, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (194, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (195, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (196, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (197, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (198, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (199, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (200, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (201, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (202, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (203, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (204, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (205, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (206, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (207, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (208, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (209, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (210, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (211, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (212, 2, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (213, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (214, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (215, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (216, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (217, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (218, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (219, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (220, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (221, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (222, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (223, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (224, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (224, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (224, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (225, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (225, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (225, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (226, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (226, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (226, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (227, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (228, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (228, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (228, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (229, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (230, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (230, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (230, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (231, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (232, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (232, 25, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (232, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (233, 23, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (234, 23, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (235, 23, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (236, 23, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (237, 23, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (238, 23, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (239, 39, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (240, 39, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (241, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (242, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (243, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (244, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (245, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (246, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (247, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (248, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (249, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (250, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (251, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (252, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (253, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (254, 8, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (255, 21, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (256, 21, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (257, 21, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (258, 21, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (259, 21, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (260, 20, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (261, 20, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (262, 20, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (263, 20, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (264, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (265, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (266, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (267, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (268, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (269, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (270, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (271, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (272, 19, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (273, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (274, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (275, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (276, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (277, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (278, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (279, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (280, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (281, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (282, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (283, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (284, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (285, 18, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (286, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (287, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (288, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (289, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (290, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (291, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (292, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (293, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (294, 17, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (295, 16, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (296, 16, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (297, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (298, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (299, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (300, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (301, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (302, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (303, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (304, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (305, 15, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (306, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (307, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (308, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (309, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (310, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (311, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (312, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (313, 14, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (314, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (315, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (316, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (317, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (318, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (319, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (320, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (321, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (322, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (323, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (324, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (325, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (326, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (327, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (328, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (329, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (330, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (331, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (332, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (333, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (334, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (335, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (336, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (337, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (338, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (339, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (340, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (341, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (342, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (343, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (344, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (345, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (346, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (347, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (348, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (349, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (350, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (351, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (352, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (353, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (354, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (355, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (356, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (357, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (358, 22, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (359, 22, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (360, 22, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (361, 40, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (421, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (362, 40, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (363, 40, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (364, 40, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (365, 41, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (366, 41, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (367, 10, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (368, 10, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (369, 10, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (370, 10, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (371, 10, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (372, 10, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (373, 10, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (374, 46, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (375, 46, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (376, 46, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (377, 46, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (378, 46, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (379, 46, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (380, 46, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (381, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (382, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (383, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (384, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (385, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (386, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (387, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (388, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (389, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (390, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (391, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (392, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (393, 31, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (394, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (395, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (396, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (397, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (398, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (399, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (400, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (401, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (402, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (403, 47, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (404, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (405, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (406, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (407, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (408, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (409, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (410, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (411, 48, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (412, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (413, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (414, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (415, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (416, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (417, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (418, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (419, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (420, 42, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (422, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (423, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (424, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (425, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (426, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (427, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (428, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (429, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (430, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (431, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (432, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (433, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (434, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (435, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (436, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (437, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (438, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (439, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (440, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (441, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (442, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (443, 26, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (444, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (445, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (446, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (447, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (448, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (449, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (450, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (451, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (452, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (453, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (454, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (455, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (456, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (457, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (458, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (459, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (460, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (461, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (462, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (463, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (464, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (465, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (466, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (467, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (468, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (469, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (470, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (471, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (472, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (473, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (474, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (475, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (476, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (477, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (478, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (479, 32, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (480, 33, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (481, 33, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (482, 33, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (483, 33, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (484, 33, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (485, 33, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (486, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (487, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (488, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (489, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (490, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (491, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (492, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (493, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (494, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (495, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (496, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (497, 45, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (498, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (499, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (500, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (501, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (502, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (503, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (504, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (505, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (506, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (507, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (508, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (509, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (510, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (511, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (512, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (513, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (514, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (515, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (516, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (517, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (518, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (519, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (520, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (521, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (522, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (523, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (524, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (525, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (526, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (527, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (528, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (529, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (530, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (531, 34, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (532, 34, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (533, 34, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (534, 34, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (535, 34, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (536, 34, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (537, 34, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (538, 44, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (539, 44, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (540, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (541, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (542, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (543, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (544, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (545, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (546, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (547, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (548, 44, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (549, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (550, 36, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (551, 43, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (552, 43, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (553, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (554, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (555, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (556, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (557, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (558, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (559, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (560, 43, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (561, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (562, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (563, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (564, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (565, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (566, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (567, 11, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (623, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (624, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (625, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (626, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (627, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (628, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (629, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (630, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (631, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (632, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (633, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (634, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (635, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (636, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (637, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (638, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (639, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (640, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (641, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (642, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (568, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (569, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (570, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (571, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (572, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (573, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (574, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (575, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (576, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (577, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (578, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (579, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (580, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (581, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (582, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (583, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (584, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (585, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (586, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (587, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (588, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (589, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (590, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (591, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (592, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (593, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (594, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (595, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (596, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (597, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (598, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (599, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (600, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (601, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (602, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (603, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (604, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (605, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (606, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (607, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (608, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (609, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (610, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (611, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (612, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (613, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (614, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (615, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (616, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (617, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (618, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (619, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (620, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (621, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (622, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (643, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (644, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (645, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (646, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (647, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (648, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (649, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (650, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (651, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (652, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (653, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (654, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (655, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (656, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (657, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (658, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (659, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (660, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (661, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (662, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (663, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (664, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (666, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (667, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (668, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (669, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (670, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (671, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (672, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (673, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (674, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (675, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (676, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (677, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (678, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (679, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (680, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (681, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (682, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (683, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (684, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (685, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (686, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (687, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (688, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (689, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (690, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (691, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (692, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (693, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (694, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (695, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (696, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (697, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (698, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (699, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (700, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (701, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (702, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (703, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (704, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (705, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (707, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (708, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (709, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (710, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (711, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (712, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (713, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (714, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (715, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (716, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (717, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (718, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (719, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (720, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (721, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (722, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (723, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (724, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (725, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (726, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (727, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (728, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (729, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (730, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (731, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (732, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (733, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (734, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (735, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (736, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (737, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (738, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (739, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (740, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (741, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (742, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (743, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (744, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (745, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (746, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (747, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (748, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (749, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (750, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (751, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (752, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (753, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (754, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (755, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (756, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (757, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (758, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (759, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (760, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (761, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (762, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (763, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (764, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (765, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (766, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (767, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (768, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (769, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (770, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (771, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (772, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (773, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (774, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (775, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (777, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (778, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (779, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (780, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (781, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (782, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (783, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (784, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (785, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (786, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (787, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (788, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (789, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (790, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (791, 1, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (792, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (793, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (794, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (795, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (796, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (797, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (798, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (799, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (800, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (801, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (802, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (803, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (804, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (805, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (806, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (807, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (808, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (809, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (810, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (811, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (812, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (813, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (814, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (815, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (816, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (817, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (818, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (819, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (820, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (821, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (822, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (823, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (824, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (825, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (826, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (827, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (828, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (829, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (830, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (831, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (832, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (833, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (834, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (835, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (836, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (837, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (838, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (839, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (840, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (841, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (842, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (843, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (844, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (845, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (846, 4, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (847, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (848, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (849, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (850, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (851, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (852, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (853, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (854, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (855, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (856, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (857, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (858, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (859, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (860, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (861, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (862, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (863, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (864, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (865, 30, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (866, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (867, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (868, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (869, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (870, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (871, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (872, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (873, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (874, 7, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (875, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (876, 49, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (877, 9, null);
+insert into public.utm_group_rules_data_type (rule_id, data_type_id, last_update) values (878, 28, null);
diff --git a/backend/src/main/resources/config/liquibase/master.xml b/backend/src/main/resources/config/liquibase/master.xml
index 71b5ddba4..a1ba2df2f 100644
--- a/backend/src/main/resources/config/liquibase/master.xml
+++ b/backend/src/main/resources/config/liquibase/master.xml
@@ -327,6 +327,90 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/filters/antivirus/bitdefender_gz.yml b/filters/antivirus/bitdefender_gz.yml
index d53d1b110..e8605dc75 100644
--- a/filters/antivirus/bitdefender_gz.yml
+++ b/filters/antivirus/bitdefender_gz.yml
@@ -1,4 +1,4 @@
-# Bitdefender GravityZone filter, version 3.0.1
+# Bitdefender GravityZone filter, version 3.0.2
# Based on https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
# and the previous version of the same filter
@@ -101,6 +101,14 @@ pipeline:
pattern: '{{.greedy}}'
source: raw
+ - grok:
+ patterns:
+ - fieldName: log.cefVersion
+ pattern: 'CEF\:{{.integer}}'
+ - fieldName: log.restData
+ pattern: '{{.greedy}}'
+ source: raw
+
# Using grok to parse components of the cef_message
- grok:
patterns:
@@ -116,7 +124,7 @@ pipeline:
pattern: '{{.data}}\|'
- fieldName: log.severity
pattern: '{{.data}}\|'
- - fieldName: log.irrelevant
+ - fieldName: log.restData
pattern: '{{.greedy}}'
source: log.restData
@@ -201,7 +209,7 @@ pipeline:
- log.productVersion
- log.signatureID
- log.eventType
- - log.severityLabel
+ - log.severity
- trim:
function: prefix
@@ -246,6 +254,7 @@ pipeline:
fields:
- log.0trash
- log.1trash
+ - log.2trash
- log.restData
- log.irrelevant
- log.spt
@@ -253,4 +262,6 @@ pipeline:
- log.sproc
- log.filePath
- log.dvc
- - log.request
\ No newline at end of file
+ - log.request
+ - log.dvcToParse
+ - log.cefVersion
\ No newline at end of file
diff --git a/filters/antivirus/checkpoint.conf b/filters/antivirus/checkpoint.conf
deleted file mode 100644
index 85bb7f135..000000000
--- a/filters/antivirus/checkpoint.conf
+++ /dev/null
@@ -1,139 +0,0 @@
-filter {
- # CheckPoint filter version 2.0.0
-
- split {
- field => "message"
- terminator => ""
- }
-
- if ![dataType] {
- #First, define the entry point
- if [message] and ([message]=~/ CheckPoint \d+ - \[(.+)\]/){
-
- #......................................................................#
- #Generating dataType and dataSource field required by CurrelationRulesEngine
- if (![dataSource]){
- mutate {
- add_field => { "dataSource" => "%{host}" }
- }
- }
-
- mutate {
- add_field => { "dataType" => "antivirus-checkpoint" }
- }
-
- #......................................................................#
- #Using grok to parse header of the message
- grok {
- match => {
- "message" => "(%{INT:not_defined})?(\s)?(<%{NUMBER:priority}>)?(%{INT:syslog_version})? %{DATA:syslog_time} %{DATA:syslog_host} %{DATA:syslog_app} %{INT:pid} - \[%{GREEDYDATA:json_msg}; \]"
- }
- }
-
- #......................................................................#
- #Checking that the json_msg field exists
- if ([json_msg]){
-
- #Checking json_msg field
- if [json_msg]=~/\w+:\"[A-Za-z0-9.:,;_=@&\/\{\}\[\]\s\\\-]+\"/{
- mutate {
- gsub => ["json_msg", ':"(.*?)"', ':""\1""']
- }
- }
- #Converting to a valid json structure
- mutate {
- gsub => ["json_msg", '"" ""', '""X0X""']
- gsub => ["json_msg", '(.+)""', '{"\1"}']
- gsub => ["json_msg", ':"<', ':""<']
- gsub => ["json_msg", '""; ', '","']
- gsub => ["json_msg", ':""', '":"']
- gsub => ["json_msg", '\[', ';']
- gsub => ["json_msg", '\\]', '']
- }
- #Parsing json structure
- json {
- source => "json_msg"
- target => "[json_fields]"
- }
- }
-
- #......................................................................#
- #Adding all fields to json tree structure
- mutate {
- rename => { "syslog_app" => "[json_fields][syslog_app]" }
- rename => { "syslog_time" => "[json_fields][syslog_time]" }
- rename => { "pid" => "[json_fields][pid]" }
- rename => { "syslog_host" => "[json_fields][syslog_host]" }
- rename => { "priority" => "[json_fields][priority]" }
- }
-
- #......................................................................#
- #Removing fields with empty values
- if [json_fields] {
- ruby {
- code => '
- event.get("[json_fields]").each do |k, v|
- if (v != "X0X")
- event.set("[logx][checkpoint][#{k}]",v)
- end
- end
- '
- }
- }
-
- if [logx][checkpoint][src]{
- mutate {
- rename => { "[logx][checkpoint][src]" => "[logx][checkpoint][src_ip]"}
- }
- }
- if [logx][checkpoint][__policy_id_tag]{
-
- #Converting to a valid kv structure
- mutate {
- gsub => ["[logx][checkpoint][__policy_id_tag]", ';', ' ']
- }
-
- #......................................................................#
- #Using the kv filter with default config, usefull in key-value logs
- kv {
- source => "[logx][checkpoint][__policy_id_tag]"
- allow_duplicate_values => false
- target => "[logx][checkpoint][policy_id_tag]"
- }
-
- #......................................................................#
- #Remove fields that have issues with kv filter (spaces or = in value)
- mutate {
- remove_field => ["[logx][checkpoint][policy_id_tag][mgmt]","[logx][checkpoint][policy_id_tag][policy_name]"]
- }
- #......................................................................#
- #Using grok to parse kv issued fields
- grok {
- match => {"[logx][checkpoint][__policy_id_tag]" => [
- "mgmt=%{DATA:[logx][checkpoint][policy_id_tag][mgmt]} %{WORD}=",
- "mgmt=%{GREEDYDATA:[logx][checkpoint][policy_id_tag][mgmt]}"
- ]
- }
- }
- grok {
- match => {"[logx][checkpoint][__policy_id_tag]" => [
- "policy_name=%{DATA:[logx][checkpoint][policy_id_tag][policy_name]} %{WORD}=",
- "policy_name=%{GREEDYDATA:[logx][checkpoint][policy_id_tag][policy_name]}"
- ]
- }
- }
-
- mutate {
- remove_field => ["[logx][checkpoint][__policy_id_tag]"]
- }
- }
-
- #......................................................................#
- #Finally, remove unnecessary fields
- mutate {
- remove_field => ["@version","timestamp","path","type","syslog_version",
- "not_defined","msg_all","irrelevant", "json_msg", "json_fields"]
- }
- }
- }
-}
\ No newline at end of file
diff --git a/filters/antivirus/checkpoint.yml b/filters/antivirus/checkpoint.yml
new file mode 100644
index 000000000..f6a5c1a4a
--- /dev/null
+++ b/filters/antivirus/checkpoint.yml
@@ -0,0 +1,49 @@
+pipeline:
+ - dataTypes:
+ - antivirus-checkpoint
+ steps:
+ # 1. Parse header to extract the payload inside brackets
+ - grok:
+ source: raw
+ patterns:
+ - fieldName: log.header
+ pattern: '{{.data}} - \['
+ - fieldName: log.payload
+ pattern: '{{.data}}'
+ - fieldName: log.footer
+ pattern: '; \]'
+
+ # 2. Parse the payload as Key-Value pairs
+ - kv:
+ source: log.payload
+ fieldSplit: " "
+ valueSplit: ":"
+
+ # 3. Clean up quotes from values (since we don't have trim_value in kv)
+ # We would need a trim step for every field, but since we don't know all dynamic fields,
+ # we assume the KV parser handles basic quotes or we accept them.
+ # However, Logstash config suggests fields might be quoted like field:"value".
+ # The CEL-based KV step usually handles standard formats.
+
+ # 4. Standard Reference Mapping
+ - rename:
+ from: [log.src]
+ to: origin.ip
+ - rename:
+ from: [log.dst]
+ to: target.ip
+ - rename:
+ from: [log.s_port]
+ to: origin.port
+ - rename:
+ from: [log.service]
+ to: target.port
+
+ # 5. Type Casting
+ - cast:
+ fields: [origin.port, target.port]
+ to: int
+
+ # 6. Clean up
+ - delete:
+ fields: [log.header, log.footer]
diff --git a/filters/antivirus/esmc-eset.yml b/filters/antivirus/esmc-eset.yml
index 8a6b12f1a..24734dc95 100644
--- a/filters/antivirus/esmc-eset.yml
+++ b/filters/antivirus/esmc-eset.yml
@@ -1,4 +1,4 @@
-# ESET filter version 3.0.2
+# ESET filter version 3.0.3
# Based in docs
#
# Documentations
@@ -90,21 +90,21 @@ pipeline:
params:
key: severity
value: 'low'
- where: safe("log.severity", "") in ["INFO", "Info"]
+ where: oneOf("log.severity", ["INFO", "Info"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.severity", "") in ["WARNING", "Warning"]
+ where: oneOf("log.severity", ["WARNING", "Warning"])
- add:
function: 'string'
params:
key: severity
value: 'high'
- where: safe("log.severity", "") in ["ERROR", "Error"]
+ where: oneOf("log.severity", ["ERROR", "Error"])
# Adding geolocation to origin.ip
- dynamic:
diff --git a/filters/azure/azure-eventhub.yml b/filters/azure/azure-eventhub.yml
index e1fac0c32..1ffaf26f7 100644
--- a/filters/azure/azure-eventhub.yml
+++ b/filters/azure/azure-eventhub.yml
@@ -1,4 +1,4 @@
-# Azure Envent-Hub filter, version 2.0.3
+# Azure Envent-Hub filter, version 2.0.4
#
# Documentations
# 1- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
@@ -611,19 +611,19 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.level", "") in ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"]
+ where: oneOf("log.level", ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.level", "") in ["WARN", "Warning"]
+ where: oneOf("log.level", ["WARN", "Warning"])
- add:
function: 'string'
params:
key: severity
value: 'low'
- where: safe("log.level", "") in ["Information", "Informational", "INFO", "DEBUG", "TRACE"]
+ where: oneOf("log.level", ["Information", "Informational", "INFO", "DEBUG", "TRACE"])
# .......................................................................#
# Add geolocation to remote.ip
@@ -643,37 +643,37 @@ pipeline:
params:
key: action
value: 'get'
- where: safe("log.propertiesRequestMethod", "") == "GET"
+ where: equals("log.propertiesRequestMethod", "GET")
- add:
function: 'string'
params:
key: action
value: 'post'
- where: safe("log.propertiesRequestMethod", "") == "POST"
+ where: equals("log.propertiesRequestMethod", "POST")
- add:
function: 'string'
params:
key: action
value: 'put'
- where: safe("log.propertiesRequestMethod", "") == "PUT"
+ where: equals("log.propertiesRequestMethod", "PUT")
- add:
function: 'string'
params:
key: action
value: 'delete'
- where: safe("log.propertiesRequestMethod", "") == "DELETE"
+ where: equals("log.propertiesRequestMethod", "DELETE")
- add:
function: 'string'
params:
key: action
value: 'patch'
- where: safe("log.propertiesRequestMethod", "") == "PATCH"
+ where: equals("log.propertiesRequestMethod", "PATCH")
- add:
function: 'string'
params:
key: action
value: 'request'
- where: safe("log.propertiesRequestMethod", "") == "REQUEST"
+ where: equals("log.propertiesRequestMethod", "REQUEST")
# .......................................................................#
# Removing log.propertiesRequestMethod if action was set
@@ -716,4 +716,4 @@ pipeline:
params:
key: actionResult
value: 'accepted'
- where: safe("statusCode", 0.0) >= double(200) && safe("statusCode", 0.0) <= double(299) || (safe("statusCode", 0.0) >= double(300) && safe("statusCode", 0.0) <= double(399) && safe("origin.bytesReceived", 0.0) > double(0))
\ No newline at end of file
+ where: (greaterOrEqual("statusCode", 200) && lessOrEqual("statusCode", 299)) || (greaterOrEqual("statusCode", 300) && lessOrEqual("statusCode", 399) && greaterThan("origin.bytesReceived", 0))
\ No newline at end of file
diff --git a/filters/cisco/asa.yml b/filters/cisco/asa.yml
index 7d0827de6..1b0f54d0e 100644
--- a/filters/cisco/asa.yml
+++ b/filters/cisco/asa.yml
@@ -1,4 +1,4 @@
-# CISCO ASA filter, version 3.0.2
+# CISCO ASA filter, version 3.0.3
# Based on examples provided and https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html
# Filter Input requirements -> Syslog
#
@@ -314,14 +314,14 @@ pipeline:
params:
key: actionResult
value: 'accepted'
- where: safe("actionResult", "") && (safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0) == double(106103)) && (safe("actionResult", "") == "Permitted" || safe("actionResult", "") == "permitted")
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("actionResult", "Permitted")
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("actionResult", "") && (safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0) == double(106103)) && (safe("actionResult", "") != "Permitted" && safe("actionResult", "") != "permitted")
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && !equalsIgnoreCase("actionResult", "Permitted")
#......................................................................#
# ASA-4-109017
- grok:
@@ -5723,12 +5723,12 @@ pipeline:
from:
- log.tmpIp
to: origin.ip
- where: log.messageId==733101 && action.contains("attacking")
+ where: log.messageId==733101 && contains("action", "attacking")
- rename:
from:
- log.tmpIp
to: target.ip
- where: log.messageId==733101 && action.contains("targeted")
+ where: log.messageId==733101 && contains("action", "targeted")
# Adding action result
- add:
function: 'string'
@@ -5754,13 +5754,13 @@ pipeline:
params:
key: action
value: 'Threat-detection add host to shun list'
- where: (safe("log.messageId", 0.0)==double(733102) || safe("log.messageId", 0.0)==double(733103)) && safe("log.msg", "").contains("add")
+ where: (equals("log.messageId", 733102) || equals("log.messageId", 733103)) && contains("log.msg", "add")
- add:
function: 'string'
params:
key: action
value: 'Threat-detection removes host to shun list'
- where: (safe("log.messageId", 0.0)==double(733102) || safe("log.messageId", 0.0)==double(733103)) && safe("log.msg", "").contains("removes")
+ where: (equals("log.messageId", 733102) || equals("log.messageId", 733103)) && contains("log.msg", "removes")
#......................................................................#
# Decoding severity
- add:
@@ -5768,7 +5768,7 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.severity", "") in ["1", "2", "3"]
+ where: oneOf("log.severity", ["1", "2", "3"])
- add:
function: 'string'
params:
@@ -5780,7 +5780,7 @@ pipeline:
params:
key: severity
value: 'low'
- where: safe("log.severity", "") in ["5", "6", "7"]
+ where: oneOf("log.severity", ["5", "6", "7"])
#......................................................................#
# Adding common geolocation
- dynamic:
diff --git a/filters/cisco/cs_switch.yml b/filters/cisco/cs_switch.yml
index 9b9496fd0..52ef6b6c1 100644
--- a/filters/cisco/cs_switch.yml
+++ b/filters/cisco/cs_switch.yml
@@ -1,4 +1,4 @@
-# CISCO Switch filter, version 3.0.1
+# CISCO Switch filter, version 3.0.2
# Based on https://www.cisco.com/c/en/us/support/ios-nx-os-software/index.html
# and https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/17_xe/syslogs/17-15-x/b-system-message-guide-17-15-x.html
# Support CISCO IOS from 15 SY to IOS XE v17
@@ -52,7 +52,7 @@ pipeline:
- fieldName: log.ciscoMsg
pattern: '{{.greedy}}'
source: log.msg
- where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
+ where: '(!contains("log.msg", "-MSG:SLOT")) && (!contains("log.msg", "-MSG: SLOT"))'
# Extracting subfacility if present
- grok:
patterns:
@@ -61,7 +61,7 @@ pipeline:
- fieldName: log.severity
pattern: '{{.integer}}'
source: log.severity
- where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
+ where: '(!contains("log.msg", "-MSG:SLOT")) && (!contains("log.msg", "-MSG: SLOT"))'
# --------------------------
# Variant -> %CARD-SEVERITY-MSG:SLOT %FACILITY-SEVERITY-MNEMONIC: Message-text
- grok:
@@ -79,14 +79,14 @@ pipeline:
- fieldName: log.ciscoMsg
pattern: '{{.greedy}}'
source: log.msg
- where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
- trim:
function: prefix
substring: '%'
fields:
- log.tmpFacilityMnemonic
- where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
# %FACILITY-SEVERITY-MNEMONIC
- grok:
patterns:
@@ -97,7 +97,7 @@ pipeline:
- fieldName: log.facilityMnemonic
pattern: '{{.data}}\:'
source: log.tmpFacilityMnemonic
- where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
# Extracting subfacility if present
- grok:
patterns:
@@ -106,7 +106,7 @@ pipeline:
- fieldName: log.severity
pattern: '{{.integer}}'
source: log.severity
- where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
+ where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
# Cleaning common fields
- trim:
@@ -139,7 +139,7 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.severity", "") in ["0", "1", "2", "3"]
+ where: oneOf("log.severity", ["0", "1", "2", "3"])
- add:
function: 'string'
params:
@@ -151,7 +151,7 @@ pipeline:
params:
key: severity
value: 'low'
- where: safe("log.severity", "") in ["5", "6", "7"]
+ where: oneOf("log.severity", ["5", "6", "7"])
#......................................................................#
# Removing unused fields
- delete:
diff --git a/filters/cisco/firepower.yml b/filters/cisco/firepower.yml
index e6c5f9c9d..2c37bf00e 100644
--- a/filters/cisco/firepower.yml
+++ b/filters/cisco/firepower.yml
@@ -1,4 +1,4 @@
-# CISCO Firepower filter, version 3.0.2
+# CISCO Firepower filter, version 3.0.3
# Based on examples provided and https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide.html
# Filter Input requirements -> Syslog
#
@@ -97,7 +97,7 @@ pipeline:
- fieldName: log.srcInterface
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106001)
+ where: equals("log.messageId", 106001)
- trim:
function: prefix
@@ -105,7 +105,7 @@ pipeline:
fields:
- origin.port
- target.port
- where: safe("log.messageId", 0.0) == double(106001)
+ where: equals("log.messageId", 106001)
#......................................................................#
# FTD-2-106017
- grok:
@@ -123,13 +123,13 @@ pipeline:
- fieldName: target.ip
pattern: '({{.ipv4}}|{{.ipv6}})'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106017)
+ where: equals("log.messageId", 106017)
- trim:
function: suffix
substring: 'from'
fields:
- action
- where: safe("log.messageId", 0.0) == double(106017)
+ where: equals("log.messageId", 106017)
#......................................................................#
# FTD-1-106021
- grok:
@@ -149,19 +149,19 @@ pipeline:
- fieldName: log.srcInterface
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106021)
+ where: equals("log.messageId", 106021)
- trim:
function: suffix
substring: 'from'
fields:
- action
- where: safe("log.messageId", 0.0) == double(106021)
+ where: equals("log.messageId", 106021)
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(106021)
+ where: equals("log.messageId", 106021)
#......................................................................#
# FTD-2-106101
- grok:
@@ -171,7 +171,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106101)
+ where: equals("log.messageId", 106101)
- grok:
patterns:
- fieldName: log.irrelevant
@@ -181,7 +181,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(106101)
+ where: equals("log.messageId", 106101)
# Parsing the limit number
- grok:
patterns:
@@ -192,13 +192,13 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.rest
- where: safe("log.messageId", 0.0) == double(106101)
+ where: equals("log.messageId", 106101)
# Field conversions
- cast:
fields:
- log.numFlows
to: int
- where: safe("log.messageId", 0.0) == double(106101)
+ where: equals("log.messageId", 106101)
#......................................................................#
# FTD-6-106102,FTD-4-106103
# First variant
@@ -235,7 +235,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0)==double(106103)
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
# Second variant
- grok:
patterns:
@@ -272,54 +272,54 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0)==106103
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
- trim:
function: suffix
substring: '/'
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0)==106103
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
- trim:
function: prefix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0)==106103
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
- trim:
function: suffix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0)==106103
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
- trim:
function: prefix
substring: '('
fields:
- origin.port
- target.port
- where: safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0)==106103
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
- trim:
function: suffix
substring: ')'
fields:
- origin.port
- target.port
- where: safe("log.messageId", 0.0) == double(106102) || safe("log.messageId", 0.0)==106103
+ where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("actionResult", "") && (safe("log.messageId", 0.0)==106102 || safe("log.messageId", 0.0)==106103) && (safe("actionResult", "") == "Permitted" || safe("actionResult", "") == "permitted")
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("actionResult", "Permitted")
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("actionResult", "") && (safe("log.messageId", 0.0)==106102 || safe("log.messageId", 0.0)==106103) && (safe("actionResult", "") != "Permitted" && safe("actionResult", "") != "permitted")
+ where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && !equalsIgnoreCase("actionResult", "Permitted")
#......................................................................#
# FTD-6-109101
- grok:
@@ -339,7 +339,7 @@ pipeline:
- fieldName: log.auditSessionId
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(109101)
+ where: equals("log.messageId", 109101)
# Action result
- grok:
patterns:
@@ -350,19 +350,19 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(109101)
+ where: equals("log.messageId", 109101)
- trim:
function: suffix
substring: ','
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(109101)
+ where: equals("log.messageId", 109101)
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(109101)
+ where: equals("log.messageId", 109101)
#......................................................................#
# FTD-4-109102
- grok:
@@ -378,7 +378,7 @@ pipeline:
- fieldName: log.auditSessionId
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(109102)
+ where: equals("log.messageId", 109102)
# Action result
- grok:
patterns:
@@ -387,13 +387,13 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(109102)
+ where: equals("log.messageId", 109102)
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(109102)
+ where: equals("log.messageId", 109102)
#......................................................................#
# FTD-3-109103
- grok:
@@ -413,7 +413,7 @@ pipeline:
- fieldName: log.auditSessionId
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(109103)
+ where: equals("log.messageId", 109103)
# Action result
- grok:
patterns:
@@ -422,19 +422,19 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(109103)
+ where: equals("log.messageId", 109103)
- trim:
function: suffix
substring: ','
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(109103)
+ where: equals("log.messageId", 109103)
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(109103)
+ where: equals("log.messageId", 109103)
#......................................................................#
# FTD-109201 to 109213
- grok:
@@ -456,21 +456,21 @@ pipeline:
- fieldName: action
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0)>=109201 && log.messageId<=109213
+ where: greaterOrEqual("log.messageId", 109201) && log.messageId<=109213
- trim:
function: suffix
substring: ','
fields:
- log.session
- origin.user
- where: lsafe("log.messageId", 0.0)>=109201 && log.messageId<=109213
+ where: lgreaterOrEqual("log.messageId", 109201) && log.messageId<=109213
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0)>=109201 && log.messageId<=109213
+ where: greaterOrEqual("log.messageId", 109201) && log.messageId<=109213
#......................................................................#
# FTD-6-113004
- grok:
@@ -488,7 +488,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113004)
+ where: equals("log.messageId", 113004)
# Action result
- grok:
patterns:
@@ -497,25 +497,25 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(113004)
+ where: equals("log.messageId", 113004)
- trim:
function: suffix
substring: ':'
fields:
- target.ip
- where: safe("log.messageId", 0.0) == double(113004)
+ where: equals("log.messageId", 113004)
- trim:
function: suffix
substring: ','
fields:
- target.ip
- where: safe("log.messageId", 0.0) == double(113004)
+ where: equals("log.messageId", 113004)
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(113004)
+ where: equals("log.messageId", 113004)
#......................................................................#
# FTD-6-113005
- grok:
@@ -539,7 +539,7 @@ pipeline:
- fieldName: origin.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113005)
+ where: equals("log.messageId", 113005)
# Action result
- grok:
patterns:
@@ -548,7 +548,7 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(113005)
+ where: equals("log.messageId", 113005)
- trim:
function: suffix
substring: ':'
@@ -556,13 +556,13 @@ pipeline:
- log.reason
- target.ip
- origin.user
- where: safe("log.messageId", 0.0) == double(113005)
+ where: equals("log.messageId", 113005)
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(113005)
+ where: equals("log.messageId", 113005)
#......................................................................#
# FTD-6-113008
- grok:
@@ -574,14 +574,14 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113008)
+ where: equals("log.messageId", 113008)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(113008)
+ where: equals("log.messageId", 113008)
#......................................................................#
# FTD-6-113009
# First variant
@@ -596,19 +596,19 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113009)
+ where: equals("log.messageId", 113009)
- trim:
function: prefix
substring: '('
fields:
- log.policy
- where: safe("log.messageId", 0.0) == double(113009)
+ where: equals("log.messageId", 113009)
- trim:
function: suffix
substring: ')'
fields:
- log.policy
- where: safe("log.messageId", 0.0) == double(113009)
+ where: equals("log.messageId", 113009)
# Second variant
- grok:
patterns:
@@ -621,20 +621,20 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113009)
+ where: equals("log.messageId", 113009)
- trim:
function: suffix
substring: 'for'
fields:
- log.policy
- where: safe("log.messageId", 0.0) == double(113009)
+ where: equals("log.messageId", 113009)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(113009)
+ where: equals("log.messageId", 113009)
#......................................................................#
# FTD-6-113010
- grok:
@@ -646,13 +646,13 @@ pipeline:
- fieldName: origin.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113010)
+ where: equals("log.messageId", 113010)
- trim:
function: suffix
substring: 'from server'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(113010)
+ where: equals("log.messageId", 113010)
#......................................................................#
# FTD-6-113011
# First variant
@@ -667,19 +667,19 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113011)
+ where: equals("log.messageId", 113011)
- trim:
function: prefix
substring: '('
fields:
- log.policy
- where: safe("log.messageId", 0.0) == double(113011)
+ where: equals("log.messageId", 113011)
- trim:
function: suffix
substring: ')'
fields:
- log.policy
- where: safe("log.messageId", 0.0) == double(113011)
+ where: equals("log.messageId", 113011)
# Second variant
- grok:
patterns:
@@ -692,13 +692,13 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113011)
+ where: equals("log.messageId", 113011)
- trim:
function: suffix
substring: 'for'
fields:
- log.policy
- where: safe("log.messageId", 0.0) == double(113011)
+ where: equals("log.messageId", 113011)
#......................................................................#
# FTD-6-113012
- grok:
@@ -710,7 +710,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113012)
+ where: equals("log.messageId", 113012)
# Action result
- grok:
patterns:
@@ -719,13 +719,13 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(113012)
+ where: equals("log.messageId", 113012)
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(113012)
+ where: equals("log.messageId", 113012)
#......................................................................#
# FTD-6-113013
- grok:
@@ -741,13 +741,13 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113013)
+ where: equals("log.messageId", 113013)
- trim:
function: suffix
substring: ':'
fields:
- log.reason
- where: safe("log.messageId", 0.0) == double(113013)
+ where: equals("log.messageId", 113013)
#......................................................................#
# FTD-6-113014
- grok:
@@ -763,7 +763,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113014)
+ where: equals("log.messageId", 113014)
#......................................................................#
# FTD-6-113015, 113017
- grok:
@@ -783,14 +783,14 @@ pipeline:
- fieldName: target.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113015) || log.messageId==113017
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
- trim:
function: suffix
substring: ':'
fields:
- log.reason
- origin.user
- where: safe("log.messageId", 0.0) == double(113015) || log.messageId==113017
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
# Action result
- grok:
patterns:
@@ -799,13 +799,13 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(113015) || log.messageId==113017
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(113015) || log.messageId==113017
+ where: equals("log.messageId", 113015) || equals("log.messageId", 113017)
#......................................................................#
# FTD-6-113016
- grok:
@@ -829,7 +829,7 @@ pipeline:
- fieldName: origin.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113016)
+ where: equals("log.messageId", 113016)
- trim:
function: suffix
substring: ':'
@@ -837,7 +837,7 @@ pipeline:
- log.reason
- target.ip
- origin.user
- where: safe("log.messageId", 0.0) == double(113016)
+ where: equals("log.messageId", 113016)
# Action result
- grok:
patterns:
@@ -846,13 +846,13 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(113016)
+ where: equals("log.messageId", 113016)
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(113016)
+ where: equals("log.messageId", 113016)
#......................................................................#
# FTD-4-113019
- grok:
@@ -892,7 +892,7 @@ pipeline:
- fieldName: log.reason
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113019)
+ where: equals("log.messageId", 113019)
- trim:
function: suffix
substring: ','
@@ -904,20 +904,20 @@ pipeline:
- log.duration
- origin.bytesSent
- origin.bytesReceived
- where: safe("log.messageId", 0.0) == double(113019)
+ where: equals("log.messageId", 113019)
- cast:
fields:
- origin.bytesSent
- origin.bytesReceived
to: int
- where: safe("log.messageId", 0.0) == double(113019)
+ where: equals("log.messageId", 113019)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(113019)
+ where: equals("log.messageId", 113019)
#......................................................................#
# FTD-113031,113032,113033
# Common fields
@@ -934,19 +934,19 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113031) || log.messageId==113032 || log.messageId==113033
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
- trim:
function: suffix
substring: 'User'
fields:
- origin.group
- where: safe("log.messageId", 0.0) == double(113031) || log.messageId==113032 || log.messageId==113033
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
- trim:
function: suffix
substring: 'IP'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(113031) || log.messageId==113032 || log.messageId==113033
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
# Specific fields
- grok:
patterns:
@@ -957,7 +957,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.rest
- where: safe("log.messageId", 0.0) == double(113031) || log.messageId==113032 || log.messageId==113033
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
- grok:
patterns:
- fieldName: action
@@ -965,20 +965,20 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.rest
- where: safe("log.messageId", 0.0) == double(113031) || log.messageId==113032 || log.messageId==113033
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
- trim:
function: suffix
substring: 'is'
fields:
- log.filter
- where: safe("log.messageId", 0.0) == double(113031) || log.messageId==113032 || log.messageId==113033
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(113031) || log.messageId==113032 || log.messageId==113033
+ where: equals("log.messageId", 113031) || log.messageId==113032 || log.messageId==113033
#......................................................................#
# FTD-113034,113035,113036,113038,113039
- grok:
@@ -994,20 +994,20 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
# Cleaning fields
- trim:
function: suffix
substring: 'User'
fields:
- origin.group
- where: safe("log.messageId", 0.0) == double(113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
- trim:
function: suffix
substring: 'IP'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
- trim:
function: prefix
substring: '<'
@@ -1015,7 +1015,7 @@ pipeline:
- origin.group
- origin.user
- origin.ip
- where: safe("log.messageId", 0.0) == double(113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
- trim:
function: suffix
substring: '>'
@@ -1023,21 +1023,21 @@ pipeline:
- origin.group
- origin.user
- origin.ip
- where: safe("log.messageId", 0.0) == double(113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
+ where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(113039)
+ where: equals("log.messageId", 113039)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(113035) || log.messageId==113038
+ where: equals("log.messageId", 113035) || log.messageId==113038
#......................................................................#
# FTD-4-113042
- grok:
@@ -1069,33 +1069,33 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(113042)
+ where: equals("log.messageId", 113042)
- trim:
function: suffix
substring: 'from'
fields:
- action
- where: safe("log.messageId", 0.0) == double(113042)
+ where: equals("log.messageId", 113042)
- trim:
function: suffix
substring: ':'
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(113042)
+ where: equals("log.messageId", 113042)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(113042)
+ where: equals("log.messageId", 113042)
- trim:
function: suffix
substring: 'at'
fields:
- log.remoteUser
- where: safe("log.messageId", 0.0) == double(113042)
+ where: equals("log.messageId", 113042)
#......................................................................#
# FTD-2-201003
- grok:
@@ -1129,26 +1129,26 @@ pipeline:
- fieldName: log.dstInterface
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(201003)
+ where: equals("log.messageId", 201003)
- trim:
function: prefix
substring: '('
fields:
- log.globalIp
- where: safe("log.messageId", 0.0) == double(201003)
+ where: equals("log.messageId", 201003)
- trim:
function: suffix
substring: ')'
fields:
- log.globalIp
- where: safe("log.messageId", 0.0) == double(201003)
+ where: equals("log.messageId", 201003)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(201003)
+ where: equals("log.messageId", 201003)
#......................................................................#
# FTD-4-209003
- grok:
@@ -1174,7 +1174,7 @@ pipeline:
- fieldName: log.id
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(209003)
+ where: equals("log.messageId", 209003)
- trim:
function: suffix
substring: ','
@@ -1182,19 +1182,19 @@ pipeline:
- origin.ip
- target.ip
- protocol
- where: safe("log.messageId", 0.0) == double(209003)
+ where: equals("log.messageId", 209003)
- cast:
fields:
- log.limit
to: int
- where: safe("log.messageId", 0.0) == double(209003)
+ where: equals("log.messageId", 209003)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(209003)
+ where: equals("log.messageId", 209003)
#......................................................................#
# FTD-3-316001
- grok:
@@ -1208,7 +1208,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(316001)
+ where: equals("log.messageId", 316001)
# Action result
- grok:
patterns:
@@ -1217,14 +1217,14 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(316001)
+ where: equals("log.messageId", 316001)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(316001)
+ where: equals("log.messageId", 316001)
#......................................................................#
# FTD-3-316002
- grok:
@@ -1252,26 +1252,26 @@ pipeline:
- fieldName: target.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(316002)
+ where: equals("log.messageId", 316002)
- trim:
function: suffix
substring: ','
fields:
- protocol
- where: safe("log.messageId", 0.0) == double(316002)
+ where: equals("log.messageId", 316002)
- cast:
fields:
- log.inIfNum
- log.outIfNum
to: int
- where: safe("log.messageId", 0.0) == double(316002)
+ where: equals("log.messageId", 316002)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(316002)
+ where: equals("log.messageId", 316002)
#......................................................................#
# FTD-6-302003,302004
# First variant
@@ -1292,7 +1292,7 @@ pipeline:
- fieldName: log.tmpFromip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
# Second variant
- grok:
patterns:
@@ -1309,7 +1309,7 @@ pipeline:
- fieldName: log.tmpFromip
pattern: '({{.ipv4}}|{{.ipv6}})((\s)?/(\s)?{{.integer}}|(\s)?/)?'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
# Parsing from/to ip and port
- grok:
patterns:
@@ -1318,13 +1318,13 @@ pipeline:
- fieldName: target.port
pattern: '{{.greedy}}'
source: log.tmpToip
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
- grok:
patterns:
- fieldName: target.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.tmpToip
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
- grok:
patterns:
- fieldName: origin.ip
@@ -1332,33 +1332,33 @@ pipeline:
- fieldName: origin.port
pattern: '{{.greedy}}'
source: log.tmpFromip
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
- grok:
patterns:
- fieldName: origin.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.tmpFromip
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
- trim:
function: prefix
substring: '/'
fields:
- origin.port
- target.port
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
# Removing temp fields
- delete:
fields:
- log.tmpFromip
- log.tmpToip
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302003) || log.messageId==302004
+ where: equals("log.messageId", 302003) || log.messageId==302004
#......................................................................#
# FTD-6-302012
- grok:
@@ -1376,20 +1376,20 @@ pipeline:
- fieldName: target.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302012)
+ where: equals("log.messageId", 302012)
- trim:
function: prefix
substring: '/'
fields:
- origin.port
- where: safe("log.messageId", 0.0) == double(302012)
+ where: equals("log.messageId", 302012)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302012)
+ where: equals("log.messageId", 302012)
#......................................................................#
# FTD-6-302013
- grok:
@@ -1431,7 +1431,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
# Parsing direction field
- grok:
patterns:
@@ -1442,7 +1442,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpDirection
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
# Parsing firewall user from
- grok:
patterns:
@@ -1453,7 +1453,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
# Parsing firewall user to, and AAA name of the user if exists
- grok:
patterns:
@@ -1468,7 +1468,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
- grok:
patterns:
@@ -1479,7 +1479,7 @@ pipeline:
- fieldName: log.firewallUserTo
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
- trim:
function: suffix
@@ -1488,13 +1488,13 @@ pipeline:
- log.firewallUserFrom
- log.firewallUserTo
- origin.user
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
# Removing tmp fields
- delete:
fields:
- log.tmpDirection
- log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
# Cleaning fields
- trim:
@@ -1503,7 +1503,7 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
- trim:
function: suffix
substring: '/'
@@ -1512,20 +1512,20 @@ pipeline:
- target.ip
- log.mappedIpFrom
- log.mappedIpTo
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
- trim:
function: suffix
substring: 'for'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302013)
+ where: equals("log.messageId", 302013)
#......................................................................#
# FTD-6-302014
- grok:
@@ -1563,7 +1563,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
# Parsing firewall user from
- grok:
patterns:
@@ -1574,7 +1574,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
# Parsing firewall user to
- grok:
patterns:
@@ -1585,7 +1585,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
# Parsing AAA user if exists
- grok:
patterns:
@@ -1594,7 +1594,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
- trim:
function: suffix
@@ -1603,13 +1603,13 @@ pipeline:
- log.firewallUserFrom
- log.firewallUserTo
- origin.user
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
# Removing tmp fields
- delete:
fields:
- log.tmpFwUserFrom
- log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
# Cleaning fields
- trim:
@@ -1618,27 +1618,27 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
- trim:
function: suffix
substring: 'for'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302014)
+ where: equals("log.messageId", 302014)
#......................................................................#
# FTD-6-302015
- grok:
@@ -1682,7 +1682,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
# Parsing direction field
- grok:
patterns:
@@ -1691,7 +1691,7 @@ pipeline:
- fieldName: log.direction
pattern: '{{.greedy}}'
source: log.tmpDirection
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
# Parsing firewall user from
- grok:
patterns:
@@ -1702,7 +1702,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
# Parsing firewall user to, and AAA name of the user if exists
- grok:
patterns:
@@ -1717,7 +1717,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
- grok:
patterns:
@@ -1728,7 +1728,7 @@ pipeline:
- fieldName: log.firewallUserTo
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
- trim:
function: suffix
@@ -1737,13 +1737,13 @@ pipeline:
- log.firewallUserFrom
- log.firewallUserTo
- origin.user
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
# Removing tmp fields
- delete:
fields:
- log.tmpDirection
- log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
# Cleaning fields
- trim:
@@ -1752,7 +1752,7 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
- trim:
function: suffix
substring: '/'
@@ -1761,20 +1761,20 @@ pipeline:
- target.ip
- log.mappedIpFrom
- log.mappedIpTo
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
- trim:
function: suffix
substring: 'for'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302015)
+ where: equals("log.messageId", 302015)
#......................................................................#
# FTD-6-302016
- grok:
@@ -1808,7 +1808,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
# Parsing firewall user from
- grok:
patterns:
@@ -1819,7 +1819,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
# Parsing firewall user to
- grok:
patterns:
@@ -1830,7 +1830,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
# Parsing firewall user to, and AAA name of the user if exists
- grok:
patterns:
@@ -1839,7 +1839,7 @@ pipeline:
- fieldName: origin.bytesSent
pattern: '{{.integer}}'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
- grok:
patterns:
@@ -1852,7 +1852,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
- trim:
function: suffix
@@ -1861,13 +1861,13 @@ pipeline:
- log.firewallUserFrom
- log.firewallUserTo
- origin.user
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
# Removing tmp fields
- delete:
fields:
- log.tmpFwUserFrom
- log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
# Cleaning fields
- trim:
@@ -1876,27 +1876,27 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
- trim:
function: suffix
substring: 'for'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302016)
+ where: equals("log.messageId", 302016)
#......................................................................#
# FTD-6-302017
- grok:
@@ -1932,7 +1932,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
# Parsing firewall user from
- grok:
patterns:
@@ -1943,7 +1943,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
# Parsing translatedCid and, firewall user to and AAA user if present
- grok:
patterns:
@@ -1952,13 +1952,13 @@ pipeline:
- fieldName: log.tmpUserInfo
pattern: '{{.greedy}}'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
- grok:
patterns:
- fieldName: log.translatedCid
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
# FW user and AAA user
- grok:
patterns:
@@ -1967,13 +1967,13 @@ pipeline:
- fieldName: target.user
pattern: '\({{.data}}\)'
source: log.tmpUserInfo
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
- grok:
patterns:
- fieldName: log.tmpFwUserTo
pattern: '\({{.data}}\)'
source: log.tmpUserInfo
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
# Parsing firewall user to
- grok:
patterns:
@@ -1984,7 +1984,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
- trim:
function: suffix
substring: ')'
@@ -1993,14 +1993,14 @@ pipeline:
- log.firewallUserTo
- target.user
- log.translatedCid
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
- trim:
function: suffix
substring: '('
fields:
- log.realCid
- target.user
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
# Removing tmp fields
- delete:
fields:
@@ -2008,7 +2008,7 @@ pipeline:
- log.tmpFwUserFrom
- log.tmpFwUserTo
- log.tmpUserInfo
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
# Cleaning fields
- trim:
function: suffix
@@ -2016,27 +2016,27 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
- trim:
function: suffix
substring: '/'
fields:
- target.ip
- log.translatedIpTo
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
- trim:
function: suffix
substring: 'from'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302017)
+ where: equals("log.messageId", 302017)
#......................................................................#
# FTD-6-302018
- grok:
@@ -2074,7 +2074,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
# Parsing firewall user from
- grok:
patterns:
@@ -2085,7 +2085,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
# Parsing firewall user to
- grok:
patterns:
@@ -2096,7 +2096,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
# Parsing firewall user to, and AAA name of the user if exists
- grok:
patterns:
@@ -2105,7 +2105,7 @@ pipeline:
- fieldName: origin.bytesSent
pattern: '{{.integer}}'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
- grok:
patterns:
@@ -2118,7 +2118,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.data}}\)'
source: log.rest
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
- trim:
function: suffix
@@ -2128,47 +2128,47 @@ pipeline:
- log.firewallUserTo
- origin.user
- log.translatedCid
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
# Removing tmp fields
- delete:
fields:
- log.tmpFwUserFrom
- log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
# Cleaning fields
- trim:
function: suffix
substring: '('
fields:
- log.realCid
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
- trim:
function: suffix
substring: ':'
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
- trim:
function: suffix
substring: '/'
fields:
- target.ip
- log.translatedIpTo
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
- trim:
function: suffix
substring: 'from'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302018)
+ where: equals("log.messageId", 302018)
#......................................................................#
# FTD-6-302020, 302021
# 302020
@@ -2193,7 +2193,7 @@ pipeline:
- fieldName: log.icmpCode
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302020)
+ where: equals("log.messageId", 302020)
# 302021
- grok:
patterns:
@@ -2214,7 +2214,7 @@ pipeline:
- fieldName: log.icmpCode
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302021)
+ where: equals("log.messageId", 302021)
# Common parsing for 302020 and 302021
# For parsing faddr and fwuser from (Begin with ip/port), or icmpSeqNum
- grok:
@@ -2226,7 +2226,7 @@ pipeline:
- fieldName: log.tmpFwUserFrom
pattern: '{{.greedy}}'
source: log.tmpFaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
- grok:
patterns:
- fieldName: origin.ip
@@ -2234,7 +2234,7 @@ pipeline:
- fieldName: log.tmpFwUserFrom
pattern: '{{.greedy}}'
source: log.tmpFaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# icmpSeqNum variants
- grok:
patterns:
@@ -2245,7 +2245,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: 'gaddr'
source: log.tmpFaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
- grok:
patterns:
- fieldName: log.icmpSeqNum
@@ -2253,14 +2253,14 @@ pipeline:
- fieldName: log.tmpFwUserFrom
pattern: 'gaddr'
source: log.tmpFaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Cleaning icmpSeqNum
- trim:
function: suffix
substring: 'gaddr'
fields:
- log.icmpSeqNum
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Continue with firewall user from
- grok:
patterns:
@@ -2271,7 +2271,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# For parsing gaddr and global fwuser (Begin with ip/port), or icmpType
- grok:
patterns:
@@ -2282,7 +2282,7 @@ pipeline:
- fieldName: log.tmpFwUserGlobal
pattern: '{{.greedy}}'
source: log.tmpGaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
- grok:
patterns:
- fieldName: log.globalIp
@@ -2290,7 +2290,7 @@ pipeline:
- fieldName: log.tmpFwUserGlobal
pattern: '{{.greedy}}'
source: log.tmpGaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# icmpType variants
- grok:
patterns:
@@ -2301,7 +2301,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: 'laddr'
source: log.tmpGaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
- grok:
patterns:
- fieldName: log.icmpType
@@ -2309,20 +2309,20 @@ pipeline:
- fieldName: log.tmpFwUserGlobal
pattern: 'laddr'
source: log.tmpGaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Cleaning icmpType
- trim:
function: suffix
substring: 'laddr'
fields:
- log.icmpType
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
- trim:
function: suffix
substring: 'code'
fields:
- log.icmpType
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Continue with global firewall
- grok:
patterns:
@@ -2333,7 +2333,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserGlobal
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# For parsing laddr and fwuser to (Begin with ip/port)
- grok:
patterns:
@@ -2344,7 +2344,7 @@ pipeline:
- fieldName: log.tmpFwUserTo
pattern: '{{.greedy}}'
source: log.tmpLaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
- grok:
patterns:
- fieldName: target.ip
@@ -2352,7 +2352,7 @@ pipeline:
- fieldName: log.tmpFwUserTo
pattern: '{{.greedy}}'
source: log.tmpLaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Continue with firewall user to
- grok:
patterns:
@@ -2363,7 +2363,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserTo
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Cleaning fields
- trim:
function: suffix
@@ -2371,7 +2371,7 @@ pipeline:
fields:
- target.ip
- origin.ip
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
- trim:
function: suffix
substring: ')'
@@ -2379,7 +2379,7 @@ pipeline:
- log.firewallUserFrom
- log.firewallUserTo
- log.globalFirewallUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Removing tmp fields
- delete:
fields:
@@ -2389,14 +2389,14 @@ pipeline:
- log.tmpFaddrAndFwUser
- log.tmpGaddrAndFwUser
- log.tmpLaddrAndFwUser
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302020) || log.messageId==302021
+ where: equals("log.messageId", 302020) || log.messageId==302021
#......................................................................#
# FTD-6-302022, 302024, 302026
- grok:
@@ -2428,7 +2428,7 @@ pipeline:
- fieldName: log.tmpMappedIpPortTo
pattern: '\({{.data}}\)'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
# Parsing mapped ip,port from tmp fields
# With port
- grok:
@@ -2442,7 +2442,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '\)'
source: log.tmpMappedIpPortFrom
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
# Without port
- grok:
patterns:
@@ -2453,7 +2453,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '\)'
source: log.tmpMappedIpPortFrom
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
# Parsing mapped ip,port to, from tmp fields
# With port
- grok:
@@ -2467,7 +2467,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '\)'
source: log.tmpMappedIpPortTo
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
# Without port
- grok:
patterns:
@@ -2478,21 +2478,21 @@ pipeline:
- fieldName: log.irrelevant
pattern: '\)'
source: log.tmpMappedIpPortTo
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
# Cleaning fields
- trim:
function: suffix
substring: 'stub'
fields:
- log.role
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
- trim:
function: suffix
substring: ':'
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
- trim:
function: suffix
substring: '/'
@@ -2501,20 +2501,20 @@ pipeline:
- target.ip
- log.mappedIpFrom
- log.mappedIpTo
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
# Removing tmp fields
- delete:
fields:
- log.tmpMappedIpPortFrom
- log.tmpMappedIpPortTo
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302022) || log.messageId==302024 || log.messageId==302026
+ where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
#......................................................................#
# FTD-6-302023, 302025, 302027
- grok:
@@ -2550,7 +2550,7 @@ pipeline:
- fieldName: log.reason
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302023) || log.messageId==302025 || log.messageId==302027
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
# Cleaning fields
- trim:
function: suffix
@@ -2558,21 +2558,21 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302023) || log.messageId==302025 || log.messageId==302027
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(302023) || log.messageId==302025 || log.messageId==302027
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302023) || log.messageId==302025 || log.messageId==302027
+ where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
#......................................................................#
# FTD-302033,302034
- grok:
@@ -2592,7 +2592,7 @@ pipeline:
- fieldName: log.tmpIpPortTo
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302033) || log.messageId==302034
+ where: equals("log.messageId", 302033) || log.messageId==302034
# Parsing optional ports from y to
- grok:
patterns:
@@ -2601,7 +2601,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpPortFrom
- where: safe("log.messageId", 0.0) == double(302033) || log.messageId==302034
+ where: equals("log.messageId", 302033) || log.messageId==302034
- grok:
patterns:
- fieldName: target.ip
@@ -2609,13 +2609,13 @@ pipeline:
- fieldName: target.port
pattern: '{{.greedy}}'
source: log.tmpIpPortTo
- where: safe("log.messageId", 0.0) == double(302033) || log.messageId==302034
+ where: equals("log.messageId", 302033) || log.messageId==302034
- grok:
patterns:
- fieldName: target.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})(\s)?'
source: log.tmpIpPortTo
- where: safe("log.messageId", 0.0) == double(302033) || log.messageId==302034
+ where: equals("log.messageId", 302033) || log.messageId==302034
# Cleaning fields
- trim:
function: suffix
@@ -2623,33 +2623,33 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302033) || log.messageId==302034
+ where: equals("log.messageId", 302033) || log.messageId==302034
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(302033) || log.messageId==302034
+ where: equals("log.messageId", 302033) || log.messageId==302034
# Remove tmp fields
- delete:
fields:
- log.tmpPortFrom
- log.tmpIpPortTo
- where: safe("log.messageId", 0.0) == double(302033) || log.messageId==302034
+ where: equals("log.messageId", 302033) || log.messageId==302034
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302033)
+ where: equals("log.messageId", 302033)
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(302034)
+ where: equals("log.messageId", 302034)
#......................................................................#
# FTD-6-302303
- grok:
@@ -2689,7 +2689,7 @@ pipeline:
- fieldName: log.rest
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302303)
+ where: equals("log.messageId", 302303)
# Protocol
- grok:
patterns:
@@ -2700,7 +2700,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(302303)
+ where: equals("log.messageId", 302303)
# Cleaning fields
- trim:
function: suffix
@@ -2708,7 +2708,7 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302303)
+ where: equals("log.messageId", 302303)
- trim:
function: suffix
substring: '/'
@@ -2717,20 +2717,20 @@ pipeline:
- target.ip
- log.mappedIpFrom
- log.mappedIpTo
- where: safe("log.messageId", 0.0) == double(302303)
+ where: equals("log.messageId", 302303)
- trim:
function: suffix
substring: 'from'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302303)
+ where: equals("log.messageId", 302303)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302303)
+ where: equals("log.messageId", 302303)
#......................................................................#
# FTD-6-302304
- grok:
@@ -2764,7 +2764,7 @@ pipeline:
- fieldName: log.reason
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(302304)
+ where: equals("log.messageId", 302304)
# Protocol
- grok:
patterns:
@@ -2775,7 +2775,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(302304)
+ where: equals("log.messageId", 302304)
# Cleaning fields
- trim:
function: suffix
@@ -2783,27 +2783,27 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(302304)
+ where: equals("log.messageId", 302304)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(302304)
+ where: equals("log.messageId", 302304)
- trim:
function: suffix
substring: 'from'
fields:
- log.connectionId
- where: safe("log.messageId", 0.0) == double(302304)
+ where: equals("log.messageId", 302304)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(302304)
+ where: equals("log.messageId", 302304)
#......................................................................#
# FTD-6-305009
- grok:
@@ -2823,7 +2823,7 @@ pipeline:
- fieldName: log.mappedIpTo
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(305009)
+ where: equals("log.messageId", 305009)
# Parsing srcInterface
# With ACL
- grok:
@@ -2835,14 +2835,14 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpAclSrcInterface
- where: safe("log.messageId", 0.0) == double(305009)
+ where: equals("log.messageId", 305009)
# Without ACL
- grok:
patterns:
- fieldName: log.srcInterface
pattern: '{{.data}}:'
source: log.tmpAclSrcInterface
- where: safe("log.messageId", 0.0) == double(305009)
+ where: equals("log.messageId", 305009)
# Parsing firewall user from
- grok:
patterns:
@@ -2853,7 +2853,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(305009)
+ where: equals("log.messageId", 305009)
# Removing tmp fields
- delete:
fields:
@@ -2866,20 +2866,20 @@ pipeline:
fields:
- log.firewallUserFrom
- log.accessList
- where: safe("log.messageId", 0.0) == double(305009)
+ where: equals("log.messageId", 305009)
- trim:
function: suffix
substring: '('
fields:
- log.srcInterface
- where: safe("log.messageId", 0.0) == double(305009)
+ where: equals("log.messageId", 305009)
- trim:
function: suffix
substring: ':'
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(305009)
+ where: equals("log.messageId", 305009)
#......................................................................#
# FTD-6-305010
- grok:
@@ -2903,7 +2903,7 @@ pipeline:
- fieldName: log.duration
pattern: '{{.time}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(305010)
+ where: equals("log.messageId", 305010)
# Parsing firewall user from
- grok:
patterns:
@@ -2914,7 +2914,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(305010)
+ where: equals("log.messageId", 305010)
# Removing tmp fields
- delete:
fields:
@@ -2925,14 +2925,14 @@ pipeline:
substring: ')'
fields:
- log.firewallUserFrom
- where: safe("log.messageId", 0.0) == double(305010)
+ where: equals("log.messageId", 305010)
- trim:
function: suffix
substring: ':'
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(305010)
+ where: equals("log.messageId", 305010)
#......................................................................#
# FTD-6-305011
- grok:
@@ -2956,7 +2956,7 @@ pipeline:
- fieldName: target.port
pattern: '{{.integer}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(305011)
+ where: equals("log.messageId", 305011)
# Parsing firewall user from
- grok:
patterns:
@@ -2967,7 +2967,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(305011)
+ where: equals("log.messageId", 305011)
# Parsing protocol
- grok:
patterns:
@@ -2978,19 +2978,19 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(305011)
+ where: equals("log.messageId", 305011)
- trim:
function: suffix
substring: ')'
fields:
- log.firewallUserFrom
- where: safe("log.messageId", 0.0) == double(305011)
+ where: equals("log.messageId", 305011)
# Removing tmp fields
- delete:
fields:
- log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(305011)
+ where: equals("log.messageId", 305011)
# Cleaning fields
- trim:
@@ -2999,14 +2999,14 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(305011)
+ where: equals("log.messageId", 305011)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(305011)
+ where: equals("log.messageId", 305011)
#......................................................................#
# FTD-6-305012
- grok:
@@ -3034,7 +3034,7 @@ pipeline:
- fieldName: log.duration
pattern: '{{.time}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
# Parsing firewall user from
- grok:
patterns:
@@ -3045,7 +3045,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpFwUserFrom
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
# Parsing protocol
- grok:
patterns:
@@ -3056,7 +3056,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
# Parsing srcInterface
# With ACL
- grok:
@@ -3068,14 +3068,14 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.tmpAclSrcInterface
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
# Without ACL
- grok:
patterns:
- fieldName: log.srcInterface
pattern: '{{.data}}:'
source: log.tmpAclSrcInterface
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
# Parsing srcInterface from himself to avoid parsing issues
- grok:
patterns:
@@ -3084,7 +3084,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.srcInterface
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
- trim:
function: suffix
@@ -3092,13 +3092,13 @@ pipeline:
fields:
- log.firewallUserFrom
- log.accessList
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
# Removing tmp fields
- delete:
fields:
- log.tmpFwUserFrom
- log.tmpAclSrcInterface
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
# Cleaning fields
- trim:
@@ -3107,20 +3107,20 @@ pipeline:
fields:
- log.srcInterface
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
- trim:
function: suffix
substring: '('
fields:
- log.srcInterface
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(305012)
+ where: equals("log.messageId", 305012)
#......................................................................#
# FTD-3-322001
- grok:
@@ -3136,7 +3136,7 @@ pipeline:
- fieldName: log.srcInterface
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(322001)
+ where: equals("log.messageId", 322001)
# Action result
- grok:
patterns:
@@ -3145,20 +3145,20 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(322001)
+ where: equals("log.messageId", 322001)
# Cleaning fields
- trim:
function: suffix
substring: ','
fields:
- log.localMac
- where: safe("log.messageId", 0.0) == double(322001)
+ where: equals("log.messageId", 322001)
- trim:
function: suffix
substring: 'on'
fields:
- log.reason
- where: safe("log.messageId", 0.0) == double(322001)
+ where: equals("log.messageId", 322001)
#......................................................................#
# FTD-3-322002
- grok:
@@ -3192,7 +3192,7 @@ pipeline:
- fieldName: log.boudSrcMac
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(322002)
+ where: equals("log.messageId", 322002)
# Protocol
- grok:
patterns:
@@ -3201,26 +3201,26 @@ pipeline:
- fieldName: log.irrelevant
pattern: 'inspection check'
source: action
- where: safe("log.messageId", 0.0) == double(322002)
+ where: equals("log.messageId", 322002)
# Cleaning fields
- trim:
function: suffix
substring: 'on'
fields:
- origin.mac
- where: safe("log.messageId", 0.0) == double(322002)
+ where: equals("log.messageId", 322002)
- trim:
function: suffix
substring: 'for'
fields:
- log.fakeSrcMac
- where: safe("log.messageId", 0.0) == double(322002)
+ where: equals("log.messageId", 322002)
- trim:
function: suffix
substring: '.'
fields:
- log.srcInterface
- where: safe("log.messageId", 0.0) == double(322002)
+ where: equals("log.messageId", 322002)
#......................................................................#
# FTD-3-322003
- grok:
@@ -3252,7 +3252,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(322003)
+ where: equals("log.messageId", 322003)
# Protocol
- grok:
patterns:
@@ -3261,26 +3261,26 @@ pipeline:
- fieldName: log.irrelevant
pattern: 'inspection check'
source: action
- where: safe("log.messageId", 0.0) == double(322003)
+ where: equals("log.messageId", 322003)
# Cleaning fields
- trim:
function: suffix
substring: 'on'
fields:
- origin.mac
- where: safe("log.messageId", 0.0) == double(322003)
+ where: equals("log.messageId", 322003)
- trim:
function: suffix
substring: 'for'
fields:
- log.fakeSrcMac
- where: safe("log.messageId", 0.0) == double(322003)
+ where: equals("log.messageId", 322003)
- trim:
function: suffix
substring: '.'
fields:
- log.srcInterface
- where: safe("log.messageId", 0.0) == double(322003)
+ where: equals("log.messageId", 322003)
#......................................................................#
# FTD-4-402114
- grok:
@@ -3308,7 +3308,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(402114)
+ where: equals("log.messageId", 402114)
# Protocol
- grok:
patterns:
@@ -3319,27 +3319,27 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(402114)
+ where: equals("log.messageId", 402114)
# Cleaning fields
- trim:
function: suffix
substring: ','
fields:
- log.spi
- where: safe("log.messageId", 0.0) == double(402114)
+ where: equals("log.messageId", 402114)
- trim:
function: suffix
substring: ')'
fields:
- log.seqNum
- where: safe("log.messageId", 0.0) == double(402114)
+ where: equals("log.messageId", 402114)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(402114)
+ where: equals("log.messageId", 402114)
#......................................................................#
# FTD-4-402115
- grok:
@@ -3367,14 +3367,14 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(402115)
+ where: equals("log.messageId", 402115)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(402115)
+ where: equals("log.messageId", 402115)
#......................................................................#
# FTD-4-402116
- grok:
@@ -3436,7 +3436,7 @@ pipeline:
- fieldName: log.remoteProxyPort
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
# Protocol
- grok:
patterns:
@@ -3447,21 +3447,21 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
# Cleaning fields
- trim:
function: suffix
substring: ','
fields:
- log.spi
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
- trim:
function: suffix
substring: ')'
fields:
- log.seqNum
- origin.user
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
- trim:
function: suffix
substring: '/'
@@ -3473,27 +3473,27 @@ pipeline:
- log.remoteProxyIpMask
- log.remoteProxyPort
- log.remoteProxyProto
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
- trim:
function: suffix
substring: ')'
fields:
- log.seqNum
- origin.user
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
- trim:
function: suffix
substring: 'and'
fields:
- log.localProxyPort
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(402116)
+ where: equals("log.messageId", 402116)
#......................................................................#
# FTD-4-402117
- grok:
@@ -3511,7 +3511,7 @@ pipeline:
- fieldName: target.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(402117)
+ where: equals("log.messageId", 402117)
# Protocol
- grok:
patterns:
@@ -3522,14 +3522,14 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(402117)
+ where: equals("log.messageId", 402117)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(402117)
+ where: equals("log.messageId", 402117)
#......................................................................#
# FTD-4-402118
- grok:
@@ -3567,7 +3567,7 @@ pipeline:
- fieldName: log.fragmentOffset
pattern: '{{.integer}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(402118)
+ where: equals("log.messageId", 402118)
# Protocol
- grok:
patterns:
@@ -3578,7 +3578,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(402118)
+ where: equals("log.messageId", 402118)
# Cleaning fields
- trim:
function: suffix
@@ -3586,20 +3586,20 @@ pipeline:
fields:
- log.seqNum
- origin.user
- where: safe("log.messageId", 0.0) == double(402118)
+ where: equals("log.messageId", 402118)
- trim:
function: suffix
substring: ','
fields:
- log.spi
- where: safe("log.messageId", 0.0) == double(402118)
+ where: equals("log.messageId", 402118)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(402118)
+ where: equals("log.messageId", 402118)
#......................................................................#
# FTD-4-402119, 402120
- grok:
@@ -3631,7 +3631,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(402119) || log.messageId==402120
+ where: equals("log.messageId", 402119) || log.messageId==402120
# Protocol
- grok:
patterns:
@@ -3642,7 +3642,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(402119) || log.messageId==402120
+ where: equals("log.messageId", 402119) || log.messageId==402120
# Cleaning fields
- trim:
function: suffix
@@ -3650,20 +3650,20 @@ pipeline:
fields:
- log.seqNum
- origin.user
- where: safe("log.messageId", 0.0) == double(402119) || log.messageId==402120
+ where: equals("log.messageId", 402119) || log.messageId==402120
- trim:
function: suffix
substring: ','
fields:
- log.spi
- where: safe("log.messageId", 0.0) == double(402119) || log.messageId==402120
+ where: equals("log.messageId", 402119) || log.messageId==402120
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(402119) || log.messageId==402120
+ where: equals("log.messageId", 402119) || log.messageId==402120
#......................................................................#
# FTD-5-402128
- grok:
@@ -3683,7 +3683,7 @@ pipeline:
- fieldName: log.memoryLimit
pattern: '{{.integer}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(402128)
+ where: equals("log.messageId", 402128)
#......................................................................#
# FTD-4-405001
- grok:
@@ -3707,14 +3707,14 @@ pipeline:
- fieldName: target.mac
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(405001)
+ where: equals("log.messageId", 405001)
# Adding protocol
- add:
function: 'string'
params:
key: protocol
value: 'ARP'
- where: safe("log.messageId", 0.0) == double(405001)
+ where: equals("log.messageId", 405001)
# Cleaning fields
- trim:
function: suffix
@@ -3722,19 +3722,19 @@ pipeline:
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(405001)
+ where: equals("log.messageId", 405001)
- trim:
function: suffix
substring: 'on'
fields:
- origin.mac
- where: safe("log.messageId", 0.0) == double(405001)
+ where: equals("log.messageId", 405001)
- trim:
function: suffix
substring: 'with'
fields:
- log.srcInterface
- where: safe("log.messageId", 0.0) == double(405001)
+ where: equals("log.messageId", 405001)
#......................................................................#
# FTD-4-405002
- grok:
@@ -3750,20 +3750,20 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(405002)
+ where: equals("log.messageId", 405002)
# Cleaning fields
- trim:
function: suffix
substring: 'for'
fields:
- origin.mac
- where: safe("log.messageId", 0.0) == double(405002)
+ where: equals("log.messageId", 405002)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- where: safe("log.messageId", 0.0) == double(405002)
+ where: equals("log.messageId", 405002)
#......................................................................#
# FTD-4-406001
- grok:
@@ -3783,27 +3783,27 @@ pipeline:
- fieldName: log.srcInterface
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(406001)
+ where: equals("log.messageId", 406001)
# Adding protocol
- add:
function: 'string'
params:
key: protocol
value: 'FTP'
- where: safe("log.messageId", 0.0) == double(406001)
+ where: equals("log.messageId", 406001)
# Cleaning fields
- trim:
function: suffix
substring: ':'
fields:
- action
- where: safe("log.messageId", 0.0) == double(406001)
+ where: equals("log.messageId", 406001)
- trim:
function: suffix
substring: '/'
fields:
- origin.ip
- where: safe("log.messageId", 0.0) == double(406001)
+ where: equals("log.messageId", 406001)
#......................................................................#
# FTD-4-406002
- grok:
@@ -3827,21 +3827,21 @@ pipeline:
- fieldName: log.srcInterface
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(406002)
+ where: equals("log.messageId", 406002)
# Adding protocol
- add:
function: 'string'
params:
key: protocol
value: 'FTP'
- where: safe("log.messageId", 0.0) == double(406002)
+ where: equals("log.messageId", 406002)
# Cleaning fields
- trim:
function: suffix
substring: ':'
fields:
- action
- where: safe("log.messageId", 0.0) == double(406002)
+ where: equals("log.messageId", 406002)
#......................................................................#
# FTD-4-407002
- grok:
@@ -3871,7 +3871,7 @@ pipeline:
- fieldName: log.srcInterface
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(407002)
+ where: equals("log.messageId", 407002)
# Connection number and connection limit
- grok:
patterns:
@@ -3886,7 +3886,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(407002)
+ where: equals("log.messageId", 407002)
# Cleaning fields
- trim:
function: suffix
@@ -3894,7 +3894,7 @@ pipeline:
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(407002)
+ where: equals("log.messageId", 407002)
#......................................................................#
# FTD-6-605004
- grok:
@@ -3920,7 +3920,7 @@ pipeline:
- fieldName: origin.user
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
# Action result
- grok:
patterns:
@@ -3929,13 +3929,13 @@ pipeline:
- fieldName: log.ciscoResult
pattern: '{{.word}}'
source: action
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
# Cleaning fields
- trim:
function: suffix
@@ -3943,31 +3943,31 @@ pipeline:
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
- trim:
function: suffix
substring: 'for'
fields:
- log.service
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
- trim:
function: suffix
substring: ':'
fields:
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
- trim:
function: prefix
substring: '"'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
- trim:
function: suffix
substring: '"'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(605004)
+ where: equals("log.messageId", 605004)
#......................................................................#
# FTD-2-106018
- grok:
@@ -3995,28 +3995,28 @@ pipeline:
- fieldName: target.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106018)
+ where: equals("log.messageId", 106018)
# Adding protocol
- add:
function: 'string'
params:
key: protocol
value: 'ICMP'
- where: safe("log.messageId", 0.0) == double(106018)
+ where: equals("log.messageId", 106018)
# Cleaning fields
- trim:
function: suffix
substring: 'src'
fields:
- log.accessList
- where: safe("log.messageId", 0.0) == double(106018)
+ where: equals("log.messageId", 106018)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(106018)
+ where: equals("log.messageId", 106018)
#......................................................................#
# FTD-2-106020
- grok:
@@ -4040,21 +4040,21 @@ pipeline:
- fieldName: target.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(106020)
+ where: equals("log.messageId", 106020)
# Adding log.ciscoResult
- add:
function: 'string'
params:
key: log.ciscoResult
value: 'Denied'
- where: safe("log.messageId", 0.0) == double(106020)
+ where: equals("log.messageId", 106020)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(106020)
+ where: equals("log.messageId", 106020)
#......................................................................#
# FTD-6-611301
- grok:
@@ -4068,14 +4068,14 @@ pipeline:
- fieldName: log.mappedIp
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611301)
+ where: equals("log.messageId", 611301)
# Adding protocol
- add:
function: 'string'
params:
key: protocol
value: 'NAT'
- where: safe("log.messageId", 0.0) == double(611301)
+ where: equals("log.messageId", 611301)
#......................................................................#
# FTD-6-611303
- grok:
@@ -4099,14 +4099,14 @@ pipeline:
- fieldName: log.netmaskTo
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611303)
+ where: equals("log.messageId", 611303)
# Adding protocol
- add:
function: 'string'
params:
key: protocol
value: 'NAT'
- where: safe("log.messageId", 0.0) == double(611303)
+ where: equals("log.messageId", 611303)
# Cleaning fields
- trim:
function: suffix
@@ -4114,7 +4114,7 @@ pipeline:
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(611303)
+ where: equals("log.messageId", 611303)
#......................................................................#
# FTD-6-611304
- grok:
@@ -4134,14 +4134,14 @@ pipeline:
- fieldName: log.netmaskTo
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611304)
+ where: equals("log.messageId", 611304)
# Adding protocol
- add:
function: 'string'
params:
key: protocol
value: 'NAT'
- where: safe("log.messageId", 0.0) == double(611304)
+ where: equals("log.messageId", 611304)
# Cleaning fields
- trim:
function: suffix
@@ -4149,7 +4149,7 @@ pipeline:
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(611304)
+ where: equals("log.messageId", 611304)
#......................................................................#
# FTD-6-611307
- grok:
@@ -4159,21 +4159,21 @@ pipeline:
- fieldName: target.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611307)
+ where: equals("log.messageId", 611307)
# Adding action and log.ciscoResult
- add:
function: 'string'
params:
key: action
value: 'The VPN client is connected to the specified headend'
- where: safe("log.messageId", 0.0) == double(611307)
+ where: equals("log.messageId", 611307)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(611307)
+ where: equals("log.messageId", 611307)
#......................................................................#
# FTD-6-611309
- grok:
@@ -4187,14 +4187,14 @@ pipeline:
- fieldName: origin.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611309)
+ where: equals("log.messageId", 611309)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(611309)
+ where: equals("log.messageId", 611309)
#......................................................................#
# FTD-6-611310,611311
- grok:
@@ -4210,20 +4210,20 @@ pipeline:
- fieldName: target.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611310) || log.messageId==611311
+ where: equals("log.messageId", 611310) || log.messageId==611311
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(611310)
+ where: equals("log.messageId", 611310)
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(611311)
+ where: equals("log.messageId", 611311)
#......................................................................#
# FTD-6-611314
- grok:
@@ -4237,21 +4237,21 @@ pipeline:
- fieldName: target.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611314)
+ where: equals("log.messageId", 611314)
# Adding action
- add:
function: 'string'
params:
key: action
value: 'Load Balancing Cluster redirected the Secure Firewall'
- where: safe("log.messageId", 0.0) == double(611314)
+ where: equals("log.messageId", 611314)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(611314)
+ where: equals("log.messageId", 611314)
#......................................................................#
# FTD-6-611315
- grok:
@@ -4261,21 +4261,21 @@ pipeline:
- fieldName: origin.ip
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611315)
+ where: equals("log.messageId", 611315)
# Adding action
- add:
function: 'string'
params:
key: action
value: 'Disconnecting from Load Balancing Cluster'
- where: safe("log.messageId", 0.0) == double(611315)
+ where: equals("log.messageId", 611315)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(611315)
+ where: equals("log.messageId", 611315)
#......................................................................#
# FTD-6-611318
- grok:
@@ -4297,7 +4297,7 @@ pipeline:
- fieldName: log.timeOut
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611318)
+ where: equals("log.messageId", 611318)
#......................................................................#
# FTD-3-710003
- grok:
@@ -4319,7 +4319,7 @@ pipeline:
- fieldName: target.port
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(710003)
+ where: equals("log.messageId", 710003)
# Protocol and log.ciscoResult
- grok:
patterns:
@@ -4332,7 +4332,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(710003)
+ where: equals("log.messageId", 710003)
# Cleaning fields
- trim:
function: suffix
@@ -4340,20 +4340,20 @@ pipeline:
fields:
- origin.ip
- target.ip
- where: safe("log.messageId", 0.0) == double(710003)
+ where: equals("log.messageId", 710003)
- trim:
function: suffix
substring: ':'
fields:
- log.dstInterface
- where: safe("log.messageId", 0.0) == double(710003)
+ where: equals("log.messageId", 710003)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(710003)
+ where: equals("log.messageId", 710003)
#......................................................................#
# FTD-5-713252,713253
- grok:
@@ -4375,7 +4375,7 @@ pipeline:
- fieldName: action
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(713252) || safe("log.messageId", 0.0)==double(713253)
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
# Cleaning fields
- trim:
function: suffix
@@ -4384,32 +4384,32 @@ pipeline:
- origin.group
- origin.user
- origin.ip
- where: safe("log.messageId", 0.0) == double(713252) || safe("log.messageId", 0.0)==double(713253)
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
- trim:
function: prefix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(713252) || safe("log.messageId", 0.0)==double(713253)
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
- trim:
function: suffix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(713252) || safe("log.messageId", 0.0)==double(713253)
+ where: equals("log.messageId", 713252) || equals("log.messageId", 713253)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(713252)
+ where: equals("log.messageId", 713252)
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(713253)
+ where: equals("log.messageId", 713253)
#......................................................................#
# FTD-6-716001,716002,716003
- grok:
@@ -4425,20 +4425,20 @@ pipeline:
- fieldName: action
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002 || log.messageId==716003
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
# Cleaning fields
- trim:
function: suffix
substring: 'User'
fields:
- origin.group
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002 || log.messageId==716003
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
- trim:
function: suffix
substring: 'IP'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002 || log.messageId==716003
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
- trim:
function: prefix
substring: '<'
@@ -4446,7 +4446,7 @@ pipeline:
- origin.group
- origin.user
- origin.ip
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002 || log.messageId==716003
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
- trim:
function: suffix
substring: '>'
@@ -4454,26 +4454,26 @@ pipeline:
- origin.group
- origin.user
- origin.ip
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002 || log.messageId==716003
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
- trim:
function: prefix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002 || log.messageId==716003
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
- trim:
function: suffix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002 || log.messageId==716003
+ where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(716001) || log.messageId==716002
+ where: equals("log.messageId", 716001) || log.messageId==716002
#......................................................................#
# FTD-6-716004,716005,716006,716007,716009
- grok:
@@ -4487,53 +4487,53 @@ pipeline:
- fieldName: action
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
# Cleaning fields
- trim:
function: suffix
substring: 'User'
fields:
- origin.group
- where: safe("log.messageId", 0.0) == double(716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
- trim:
function: prefix
substring: '<'
fields:
- origin.group
- origin.user
- where: safe("log.messageId", 0.0) == double(716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
- trim:
function: suffix
substring: '>'
fields:
- origin.group
- origin.user
- where: safe("log.messageId", 0.0) == double(716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
- trim:
function: prefix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
- trim:
function: suffix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
+ where: equals("log.messageId", 716004) || log.messageId==716005 || log.messageId==716006 || log.messageId==716007 || log.messageId==716009
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(716004) || log.messageId==716007 || log.messageId==716009
+ where: equals("log.messageId", 716004) || log.messageId==716007 || log.messageId==716009
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(716006)
+ where: equals("log.messageId", 716006)
#......................................................................#
# FTD-6-716038
- grok:
@@ -4551,27 +4551,27 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
# Cleaning fields
- trim:
function: suffix
substring: 'User'
fields:
- origin.group
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
- trim:
function: suffix
substring: 'IP'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
- trim:
function: prefix
substring: '<'
@@ -4579,7 +4579,7 @@ pipeline:
- origin.group
- origin.user
- origin.ip
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
- trim:
function: suffix
substring: '>'
@@ -4587,25 +4587,25 @@ pipeline:
- origin.group
- origin.user
- origin.ip
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
- trim:
function: prefix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
- trim:
function: suffix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
- trim:
function: suffix
substring: ','
fields:
- action
- where: safe("log.messageId", 0.0) == double(716038)
+ where: equals("log.messageId", 716038)
#......................................................................#
# FTD-6-716039
- grok:
@@ -4623,14 +4623,14 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(716039)
+ where: equals("log.messageId", 716039)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(716039)
+ where: equals("log.messageId", 716039)
# Cleaning fields
- trim:
function: suffix
@@ -4638,13 +4638,13 @@ pipeline:
fields:
- action
- origin.user
- where: safe("log.messageId", 0.0) == double(716039)
+ where: equals("log.messageId", 716039)
- trim:
function: suffix
substring: 'user'
fields:
- origin.group
- where: safe("log.messageId", 0.0) == double(716039)
+ where: equals("log.messageId", 716039)
#......................................................................#
# FTD-6-719017,719019,719020,719021,719022,719023
- grok:
@@ -4656,7 +4656,7 @@ pipeline:
- fieldName: action
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(719017) || (log.messageId>=719019 && log.messageId<=719023)
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
# Adding log.ciscoResult and modifying some actions
# Adding action result
- add:
@@ -4664,44 +4664,44 @@ pipeline:
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(719019) || log.messageId==719023
+ where: equals("log.messageId", 719019) || log.messageId==719023
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(719020) || log.messageId==719022
+ where: equals("log.messageId", 719020) || log.messageId==719022
- add:
function: 'string'
params:
key: action
value: 'WebVPN user is not checked against ACL'
- where: safe("log.messageId", 0.0) == double(719021)
+ where: equals("log.messageId", 719021)
- add:
function: 'string'
params:
key: action
value: 'WebVPN user has been authenticated'
- where: safe("log.messageId", 0.0) == double(719022)
+ where: equals("log.messageId", 719022)
- add:
function: 'string'
params:
key: action
value: 'WebVPN user has not been authenticated'
- where: safe("log.messageId", 0.0) == double(719023)
+ where: equals("log.messageId", 719023)
# Cleaning fields
- trim:
function: prefix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(719017) || (log.messageId>=719019 && log.messageId<=719023)
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
- trim:
function: suffix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(719017) || (log.messageId>=719019 && log.messageId<=719023)
+ where: equals("log.messageId", 719017) || (log.messageId>=719019 && log.messageId<=719023)
#......................................................................#
# FTD-6-719018
- grok:
@@ -4717,20 +4717,20 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(719018)
+ where: equals("log.messageId", 719018)
# Cleaning fields
- trim:
function: suffix
substring: ''''
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(719018)
+ where: equals("log.messageId", 719018)
- trim:
function: suffix
substring: 'not'
fields:
- log.accessList
- where: safe("log.messageId", 0.0) == double(719018)
+ where: equals("log.messageId", 719018)
#......................................................................#
# FTD-6-719024
- grok:
@@ -4750,27 +4750,27 @@ pipeline:
- fieldName: origin.ip
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(719024)
+ where: equals("log.messageId", 719024)
# Cleaning fields
- trim:
function: suffix
substring: 'user'
fields:
- log.sessionPointer
- where: safe("log.messageId", 0.0) == double(719024)
+ where: equals("log.messageId", 719024)
- trim:
function: suffix
substring: 'addr'
fields:
- origin.user
- where: safe("log.messageId", 0.0) == double(719024)
+ where: equals("log.messageId", 719024)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.messageId", 0.0) == double(719024)
+ where: equals("log.messageId", 719024)
#......................................................................#
# FTD-7-609002
- grok:
@@ -4788,21 +4788,21 @@ pipeline:
- fieldName: log.duration
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(609002)
+ where: equals("log.messageId", 609002)
# Cleaning fields
- trim:
function: suffix
substring: '/'
fields:
- log.zoneName
- where: safe("log.messageId", 0.0) == double(609002)
+ where: equals("log.messageId", 609002)
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(609002)
+ where: equals("log.messageId", 609002)
#......................................................................#
# FTD-6-611305
- grok:
@@ -4828,7 +4828,7 @@ pipeline:
- fieldName: log.secondaryWins
pattern: '({{.ipv4}}|{{.ipv6}}|{{.hostname}})'
source: log.msg
- where: safe("log.messageId", 0.0) == double(611305)
+ where: equals("log.messageId", 611305)
#......................................................................#
# FTD-4-733100
- grok:
@@ -4856,7 +4856,7 @@ pipeline:
- fieldName: log.cumulativeTotalCount
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(733100)
+ where: equals("log.messageId", 733100)
# Cleaning cumulative total count
- grok:
patterns:
@@ -4865,7 +4865,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.cumulativeTotalCount
- where: safe("log.messageId", 0.0) == double(733100)
+ where: equals("log.messageId", 733100)
# Parsing drop source object
- grok:
patterns:
@@ -4874,26 +4874,26 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(733100)
+ where: equals("log.messageId", 733100)
# Cleaning fields
- trim:
function: suffix
substring: 'drop'
fields:
- log.dropSourceObject
- where: safe("log.messageId", 0.0) == double(733100)
+ where: equals("log.messageId", 733100)
- trim:
function: suffix
substring: ']'
fields:
- log.dropSourceObject
- where: safe("log.messageId", 0.0) == double(733100)
+ where: equals("log.messageId", 733100)
- trim:
function: prefix
substring: '['
fields:
- log.dropSourceObject
- where: safe("log.messageId", 0.0) == double(733100)
+ where: equals("log.messageId", 733100)
#......................................................................#
# FTD-4-733101
- grok:
@@ -4921,7 +4921,7 @@ pipeline:
- fieldName: log.cumulativeTotalCount
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(733101)
+ where: equals("log.messageId", 733101)
# Cleaning cumulative total count
- grok:
patterns:
@@ -4930,7 +4930,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.cumulativeTotalCount
- where: safe("log.messageId", 0.0) == double(733101)
+ where: equals("log.messageId", 733101)
# Parsing drop source object
- grok:
patterns:
@@ -4941,25 +4941,25 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: action
- where: safe("log.messageId", 0.0) == double(733101)
+ where: equals("log.messageId", 733101)
# Renaming from or to ip, according to -> if (targeted|attacking)
- rename:
from:
- log.tmpIp
to: origin.ip
- where: safe("log.messageId", 0.0) == double(733101) && action.contains("attacking")
+ where: equals("log.messageId", 733101) && contains("action", "attacking")
- rename:
from:
- log.tmpIp
to: target.ip
- where: safe("log.messageId", 0.0) == double(733101) && action.contains("targeted")
+ where: equals("log.messageId", 733101) && contains("action", "targeted")
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.messageId", 0.0) == double(733101)
+ where: equals("log.messageId", 733101)
#......................................................................#
# FTD-4-733102, 733103
- grok:
@@ -4971,20 +4971,20 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.messageId", 0.0) == double(733102) || log.messageId==733103
+ where: equals("log.messageId", 733102) || log.messageId==733103
# Adding action
- add:
function: 'string'
params:
key: action
value: 'Threat-detection add host to shun list'
- where: (safe("log.messageId", 0.0)==733102 || log.messageId==733103) && log.msg.contains("add")
+ where: (equals("log.messageId", 733102) || log.messageId==733103) && contains("log.msg", "add")
- add:
function: 'string'
params:
key: action
value: 'Threat-detection removes host to shun list'
- where: (safe("log.messageId", 0.0)==733102 || log.messageId==733103) && log.msg.contains("removes")
+ where: (equals("log.messageId", 733102) || log.messageId==733103) && contains("log.msg", "removes")
#......................................................................#
# Decoding severity
- add:
diff --git a/filters/cisco/meraki.yml b/filters/cisco/meraki.yml
index d019b25a4..f0f6032ca 100644
--- a/filters/cisco/meraki.yml
+++ b/filters/cisco/meraki.yml
@@ -1,4 +1,4 @@
-# CISCO Meraki filter, version 3.0.2
+# CISCO Meraki filter, version 3.0.3
# Based on https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples
# https://documentation.cysiv.com/articles/#!data-source-onboarding-device-configuration-reference/cisco-meraki-reference-information-and-cim-mapping
#
@@ -30,17 +30,17 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: raw
- # Adding control safe("log.controlFlag", "") field (Used to know if the message don't contains the header INT.INT mx_type mx_group)
+ # Adding control log.controlFlag field (Used to know if the message don't contains the header INT.INT mx_type mx_group)
- add:
function: 'string'
params:
- key: safe("log.controlFlag", "")
+ key: log.controlFlag
value: 'Init'
# Begin message parsing
# First extract the generic message, then parse it
- grok:
patterns:
- - fieldName: safe("log.controlFlag", "")
+ - fieldName: log.controlFlag
pattern: '{{.data}}(\s)(events|flows|urls|ids-alerts|security_event)'
- fieldName: log.genericEvent
pattern: '{{.greedy}}'
@@ -61,8 +61,8 @@ pipeline:
pattern: '{{.data}}\s'
- fieldName: log.merakiGroup
pattern: '{{.greedy}}'
- source: safe("log.controlFlag", "")
- where: safe("log.controlFlag", "") != "Init"
+ source: log.controlFlag
+ where: '!equals("log.controlFlag", "Init")'
- grok:
patterns:
- fieldName: log.msgEventTime
@@ -71,8 +71,8 @@ pipeline:
pattern: '{{.data}}\s'
- fieldName: log.merakiGroup
pattern: '{{.greedy}}'
- source: safe("log.controlFlag", "")
- where: safe("log.controlFlag", "") != "Init"
+ source: log.controlFlag
+ where: '!equals("log.controlFlag", "Init")'
# ........................................
# event vpn connectivity change
- grok:
@@ -100,21 +100,21 @@ pipeline:
- fieldName: log.connectivity
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "") != "Init"
+ where: '!equals("log.controlFlag", "Init")'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.connectivity", "") == "true"
+ where: equals("log.connectivity", "true")
# ........................................
# event uplink connectivity change
- rename:
from:
- log.genericEvent
to: action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").contains("failover to")
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "failover to")'
# ........................................
# event uplink connectivity change
# Event: urls, HTTP GET requests in MR Access Points
@@ -122,7 +122,7 @@ pipeline:
from:
- log.genericEvent
to: action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").contains("Cellular connection")
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "Cellular connection")'
- grok:
patterns:
- fieldName: action
@@ -158,7 +158,7 @@ pipeline:
- fieldName: target.url
pattern: '{{.greedy}}'
source: action
- where: safe("log.controlFlag", "")!="Init" && safe("action", "").contains("Cellular connection")
+ where: '!equals("log.controlFlag", "Init") && contains("action", "Cellular connection")'
- grok:
patterns:
- fieldName: action
@@ -166,14 +166,14 @@ pipeline:
- fieldName: log.connectionState
pattern: '(up|Up|down|Down)'
source: action
- where: safe("log.controlFlag", "")!="Init" && safe("action", "").contains("Cellular connection")
+ where: '!equals("log.controlFlag", "Init") && contains("action", "Cellular connection")'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.connectionState", "") == "up" || safe("log.connectionState", "") == "Up"
+ where: equalsIgnoreCase("log.connectionState", "up")
# ........................................
# Event: event, dhcp no offers
- grok:
@@ -187,13 +187,13 @@ pipeline:
- fieldName: origin.ip
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").contains("dhcp no offers")
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp no offers")'
- trim:
function: suffix
substring: 'for mac'
fields:
- action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").contains("dhcp no offers")
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp no offers")'
# ........................................
# Event: event, dhcp lease
- grok:
@@ -227,20 +227,20 @@ pipeline:
- fieldName: log.dns1
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").contains("dhcp lease")
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp lease")'
- trim:
function: suffix
substring: 'of ip'
fields:
- action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").contains("dhcp lease")
+ where: '!equals("log.controlFlag", "Init") && contains("log.genericEvent", "dhcp lease")'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.genericEvent", "").contains("dhcp lease")
+ where: contains("log.genericEvent", "dhcp lease")
# ........................................
# Event: event, HTTP GET requests in Meraki MX Security Appliance
- grok:
@@ -268,14 +268,14 @@ pipeline:
- fieldName: target.url
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("src") && log.merakiGroup=="urls"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="urls"'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("src") && log.merakiGroup=="urls"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="urls"'
# ........................................
# Event: flows, IP session initiated in Meraki MX Security Appliance
# First variant
@@ -310,7 +310,7 @@ pipeline:
- fieldName: log.pattern
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("src") && log.merakiGroup=="flows"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"'
# Second variant
- grok:
patterns:
@@ -339,20 +339,20 @@ pipeline:
- fieldName: log.pattern
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("src") && log.merakiGroup=="flows"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows"'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("src") && log.merakiGroup=="flows" && (log.pattern.startsWith("0") || log.pattern.startsWith("allow") || log.pattern.startsWith("Allow"))
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "0") || startsWith("log.pattern", "allow") || startsWith("log.pattern", "Allow"))'
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("src") && log.merakiGroup=="flows" && (log.pattern.startsWith("deny") || log.pattern.startsWith("Deny"))
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "deny") || startsWith("log.pattern", "Deny"))'
# ........................................
# Event: ids-alerts, ids signature matched in Meraki MX Security Appliance
- grok:
@@ -384,13 +384,13 @@ pipeline:
- fieldName: origin.port
pattern: '{{.integer}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("signature") && log.merakiGroup=="ids-alerts"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "signature") && log.merakiGroup=="ids-alerts"'
- trim:
function: suffix
substring: 'priority'
fields:
- log.signature
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("signature") && log.merakiGroup=="ids-alerts"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "signature") && log.merakiGroup=="ids-alerts"'
# ........................................
# Event: event IPsec-SA request queued due to no phase 1 found, phase2 negotiation failed, initiate new phase 1 negotiation,
# ISAKMP-SA established, initiate new phase 2 negotiation, IPsec-SA established, ISAKMP-SA established, and ISAKMP-SA deleted
@@ -416,7 +416,7 @@ pipeline:
- fieldName: log.spi
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
# Second variant
- grok:
patterns:
@@ -427,7 +427,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
# Third variant
- grok:
patterns:
@@ -446,7 +446,7 @@ pipeline:
- fieldName: target.port
pattern: '\[(\s)?{{.integer}}(\s)?\]'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
# Fourth variant
- grok:
patterns:
@@ -463,7 +463,7 @@ pipeline:
- fieldName: target.port
pattern: '\[(\s)?{{.integer}}(\s)?\]'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
# Fifth variant
- grok:
patterns:
@@ -484,28 +484,28 @@ pipeline:
- fieldName: log.spi
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
- trim:
function: prefix
substring: '['
fields:
- origin.port
- target.port
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
- trim:
function: suffix
substring: ']'
fields:
- origin.port
- target.port
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events"'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Site") && log.merakiGroup=="events" && (safe("log.genericEvent", "").contains("queued due to no phase 1") || safe("log.genericEvent", "").contains("queued due to no phase1") || || safe("log.genericEvent", "").contains("established"))
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Site") && log.merakiGroup=="events" && (contains("log.genericEvent", "queued due to no phase 1") || contains("log.genericEvent", "queued due to no phase1") || || contains("log.genericEvent", "established"))'
# ........................................
# Event: event spanning-tree guard state change in Meraki MS Switches
- grok:
@@ -527,26 +527,26 @@ pipeline:
- fieldName: actionResult
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Port") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
- trim:
function: suffix
substring: 'BPDU'
fields:
- protocol
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Port") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
- trim:
function: suffix
substring: 'so'
fields:
- origin.mac
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Port") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events"'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Port") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("blocked")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Port") && log.merakiGroup=="events" && contains("log.genericEvent", "blocked")'
# ........................................
# Event: event blocked DHCP server response in Meraki MS Switches
- grok:
@@ -564,19 +564,19 @@ pipeline:
- fieldName: log.vlan
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Blocked") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
- trim:
function: suffix
substring: 'server'
fields:
- protocol
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Blocked") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
- trim:
function: suffix
substring: 'on'
fields:
- origin.mac
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("Blocked") && log.merakiGroup=="events"
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "Blocked") && log.merakiGroup=="events"'
# ........................................
# Event: event 802.1X (all events) in Meraki MS Switches
- grok:
@@ -594,27 +594,27 @@ pipeline:
- fieldName: log.identity
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("port")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
- trim:
function: suffix
substring: 'port'
fields:
- action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("port")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
- trim:
function: prefix
substring: ''''
fields:
- origin.port
- log.identity
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("port")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
- trim:
function: suffix
substring: ''''
fields:
- origin.port
- log.identity
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("port")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "identity") && contains("log.genericEvent", "port")'
# ........................................
# Event: event 802.11 disassociation in Meraki MR Access Points
- grok:
@@ -696,115 +696,115 @@ pipeline:
- fieldName: log.aid
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'radio'
fields:
- action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'vap'
fields:
- log.radio
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'channel'
fields:
- log.vap
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'reason'
fields:
- log.channel
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'instigator'
fields:
- log.reason
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'duration'
fields:
- log.instigator
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'auth_neg_dur'
fields:
- log.duration
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'last_auth_ago'
fields:
- log.authNegDur
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'is_wpa'
fields:
- log.lastAuthAgo
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'full_conn'
fields:
- log.isWpa
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'ip_resp'
fields:
- log.fullConn
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'ip_src'
fields:
- log.ipResp
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'arp_resp'
fields:
- origin.ip
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'arp_src'
fields:
- log.arpResp
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'dns_server'
fields:
- log.arpSrc
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'dns_req_rtt'
fields:
- log.dnsServer
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'dns_resp'
fields:
- log.dnsReqRtt
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: 'aid'
fields:
- log.dnsResp
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: prefix
substring: ''''
@@ -827,7 +827,7 @@ pipeline:
- log.dnsReqRtt
- log.dnsResp
- log.aid
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
- trim:
function: suffix
substring: ''''
@@ -850,14 +850,14 @@ pipeline:
- log.dnsReqRtt
- log.dnsResp
- log.aid
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("channel") && safe("log.genericEvent", "").contains("auth_neg_dur") && safe("log.genericEvent", "").contains("last_auth_ago")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "channel") && contains("log.genericEvent", "auth_neg_dur") && contains("log.genericEvent", "last_auth_ago")'
# ........................................
# Event: event 802.1X (all events) in Meraki MR Access Points
- grok:
@@ -883,31 +883,31 @@ pipeline:
- fieldName: log.aid
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("aid")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
- trim:
function: suffix
substring: 'radio'
fields:
- action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("aid")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
- trim:
function: suffix
substring: 'vap'
fields:
- log.radio
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("aid")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
- trim:
function: suffix
substring: 'identity'
fields:
- log.vap
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("aid")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
- trim:
function: suffix
substring: 'aid'
fields:
- log.identity
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("aid")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
- trim:
function: prefix
substring: ''''
@@ -916,7 +916,7 @@ pipeline:
- log.vap
- log.identity
- log.aid
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("aid")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
- trim:
function: suffix
substring: ''''
@@ -925,7 +925,7 @@ pipeline:
- log.vap
- log.identity
- log.aid
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("radio") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("identity") && safe("log.genericEvent", "").contains("aid")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "radio") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "identity") && contains("log.genericEvent", "aid")'
# ........................................
# Event: event splash authentication in Meraki MR Access Points
- grok:
@@ -955,37 +955,37 @@ pipeline:
- fieldName: log.upload
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
- trim:
function: suffix
substring: 'ip'
fields:
- action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
- trim:
function: suffix
substring: 'duration'
fields:
- origin.ip
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
- trim:
function: suffix
substring: 'vap'
fields:
- log.duration
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
- trim:
function: suffix
substring: 'download'
fields:
- log.vap
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
- trim:
function: suffix
substring: 'upload'
fields:
- log.download
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
- trim:
function: prefix
substring: ''''
@@ -995,7 +995,7 @@ pipeline:
- log.duration
- log.download
- log.upload
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
- trim:
function: suffix
substring: ''''
@@ -1005,14 +1005,14 @@ pipeline:
- log.duration
- log.download
- log.upload
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("ip") && safe("log.genericEvent", "").contains("vap") && safe("log.genericEvent", "").contains("duration") && safe("log.genericEvent", "").contains("download") && safe("log.genericEvent", "").contains("upload")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "ip") && contains("log.genericEvent", "vap") && contains("log.genericEvent", "duration") && contains("log.genericEvent", "download") && contains("log.genericEvent", "upload")'
# ........................................
# Event: event wireless packet flood detected in Meraki MR Access Points
- grok:
@@ -1050,49 +1050,49 @@ pipeline:
- fieldName: log.interArrival
pattern: '{{.greedy}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: 'packet'
fields:
- action
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: 'device'
fields:
- log.packet
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: 'radio'
fields:
- origin.mac
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: 'state'
fields:
- log.radio
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: 'alarm_id'
fields:
- log.state
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: 'dos_count'
fields:
- log.alarmId
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: 'inter_arrival'
fields:
- log.dosCount
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: prefix
substring: ''''
@@ -1105,7 +1105,7 @@ pipeline:
- log.alarmId
- log.state
- log.interArrival
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
- trim:
function: suffix
substring: ''''
@@ -1118,7 +1118,7 @@ pipeline:
- log.alarmId
- log.state
- log.interArrival
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("type") && log.merakiGroup=="events" && safe("log.genericEvent", "").contains("packet") && safe("log.genericEvent", "").contains("device") && safe("log.genericEvent", "").contains("state") && safe("log.genericEvent", "").contains("alarm_id") && safe("log.genericEvent", "").contains("dos_count")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "type") && log.merakiGroup=="events" && contains("log.genericEvent", "packet") && contains("log.genericEvent", "device") && contains("log.genericEvent", "state") && contains("log.genericEvent", "alarm_id") && contains("log.genericEvent", "dos_count")'
# ........................................
# Event: flows, flow allowed by Layer 3 firewall in Meraki MR Access Points
- grok:
@@ -1150,33 +1150,33 @@ pipeline:
- fieldName: target.port
pattern: '{{.integer}}'
source: log.genericEvent
- where: safe("log.controlFlag", "")!="Init" && (safe("log.genericEvent", "").startsWith("allow") || safe("log.genericEvent", "").startsWith("deny")) && log.merakiGroup=="flows" && safe("log.genericEvent", "").contains("src") && safe("log.genericEvent", "").contains("dst") && safe("log.genericEvent", "").contains("sport") && safe("log.genericEvent", "").contains("dport") && safe("log.genericEvent", "").contains("mac")
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
- trim:
function: suffix
substring: 'sport'
fields:
- protocol
- where: safe("log.controlFlag", "")!="Init" && (safe("log.genericEvent", "").startsWith("allow") || safe("log.genericEvent", "").startsWith("deny")) && log.merakiGroup=="flows" && safe("log.genericEvent", "").contains("src") && safe("log.genericEvent", "").contains("dst") && safe("log.genericEvent", "").contains("sport") && safe("log.genericEvent", "").contains("dport") && safe("log.genericEvent", "").contains("mac")
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
- trim:
function: suffix
substring: 'protocol'
fields:
- origin.mac
- where: safe("log.controlFlag", "")!="Init" && (safe("log.genericEvent", "").startsWith("allow") || safe("log.genericEvent", "").startsWith("deny")) && log.merakiGroup=="flows" && safe("log.genericEvent", "").contains("src") && safe("log.genericEvent", "").contains("dst") && safe("log.genericEvent", "").contains("sport") && safe("log.genericEvent", "").contains("dport") && safe("log.genericEvent", "").contains("mac")
+ where: '!equals("log.controlFlag", "Init") && (startsWith("log.genericEvent", "allow") || startsWith("log.genericEvent", "deny")) && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("allow") && log.merakiGroup=="flows" && safe("log.genericEvent", "").contains("src") && safe("log.genericEvent", "").contains("dst") && safe("log.genericEvent", "").contains("sport") && safe("log.genericEvent", "").contains("dport") && safe("log.genericEvent", "").contains("mac")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "allow") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'denied'
- where: safe("log.controlFlag", "")!="Init" && safe("log.genericEvent", "").startsWith("deny") && log.merakiGroup=="flows" && safe("log.genericEvent", "").contains("src") && safe("log.genericEvent", "").contains("dst") && safe("log.genericEvent", "").contains("sport") && safe("log.genericEvent", "").contains("dport") && safe("log.genericEvent", "").contains("mac")
+ where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "deny") && log.merakiGroup=="flows" && contains("log.genericEvent", "src") && contains("log.genericEvent", "dst") && contains("log.genericEvent", "sport") && contains("log.genericEvent", "dport") && contains("log.genericEvent", "mac")'
# ........................................
# Event: event rogue SSID detected and SSID spoofing detected in Meraki MR Access Points
# First variant
@@ -1225,7 +1225,7 @@ pipeline:
- fieldName: log.fcSubType
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
# Second variant
- grok:
patterns:
@@ -1268,91 +1268,91 @@ pipeline:
- fieldName: log.fcSubType
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: '='
fields:
- action
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'ssid'
fields:
- action
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'bssid'
fields:
- log.ssid
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'vap'
fields:
- log.ssid
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'bssid'
fields:
- log.vap
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'src'
fields:
- log.bssid
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'dst'
fields:
- origin.mac
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'wired_mac'
fields:
- target.mac
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'channel'
fields:
- target.mac
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'vlan_id'
fields:
- log.wiredMac
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'channel'
fields:
- log.vlanId
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'rssi'
fields:
- log.channel
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'fc_type'
fields:
- log.rssi
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: 'fc_subtype'
fields:
- log.fcType
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: prefix
substring: ''''
@@ -1369,7 +1369,7 @@ pipeline:
- log.fcType
- log.fcSubType
- log.vap
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
- trim:
function: suffix
substring: ''''
@@ -1386,14 +1386,14 @@ pipeline:
- log.fcType
- log.fcSubType
- log.vap
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.genericEvent", "").startsWith("airmarshal_events") && safe("log.genericEvent", "").contains("type") && safe("log.genericEvent", "").contains("ssid") && safe("log.genericEvent", "").contains("bssid")
+ where: startsWith("log.genericEvent", "airmarshal_events") && contains("log.genericEvent", "type") && contains("log.genericEvent", "ssid") && contains("log.genericEvent", "bssid")
# ........................................
# Event: security_event ids_alerted, ids signature matched in Meraki MX Security Appliance
- grok:
@@ -1437,44 +1437,44 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: log.msg
- where: safe("log.genericEvent", "").startsWith("signature") && safe("log.genericEvent", "").contains("priority") && safe("log.genericEvent", "").contains("timestamp") && safe("log.genericEvent", "").contains("direction") && safe("log.genericEvent", "").contains("dhost")
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
- trim:
function: suffix
substring: 'priority'
fields:
- log.signature
- where: safe("log.genericEvent", "").startsWith("signature") && safe("log.genericEvent", "").contains("priority") && safe("log.genericEvent", "").contains("timestamp") && safe("log.genericEvent", "").contains("direction") && safe("log.genericEvent", "").contains("dhost")
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
- trim:
function: suffix
substring: 'dhost'
fields:
- log.msgEventTime
- where: safe("log.genericEvent", "").startsWith("signature") && safe("log.genericEvent", "").contains("priority") && safe("log.genericEvent", "").contains("timestamp") && safe("log.genericEvent", "").contains("direction") && safe("log.genericEvent", "").contains("dhost")
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
- trim:
function: suffix
substring: 'direction'
fields:
- origin.mac
- where: safe("log.genericEvent", "").startsWith("signature") && safe("log.genericEvent", "").contains("priority") && safe("log.genericEvent", "").contains("timestamp") && safe("log.genericEvent", "").contains("direction") && safe("log.genericEvent", "").contains("dhost")
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
- trim:
function: suffix
substring: 'protocol'
fields:
- log.direction
- where: safe("log.genericEvent", "").startsWith("signature") && safe("log.genericEvent", "").contains("priority") && safe("log.genericEvent", "").contains("timestamp") && safe("log.genericEvent", "").contains("direction") && safe("log.genericEvent", "").contains("dhost")
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
- trim:
function: suffix
substring: 'src'
fields:
- protocol
- where: safe("log.genericEvent", "").startsWith("signature") && safe("log.genericEvent", "").contains("priority") && safe("log.genericEvent", "").contains("timestamp") && safe("log.genericEvent", "").contains("direction") && safe("log.genericEvent", "").contains("dhost")
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
# Adding action result
- add:
function: 'string'
params:
key: actionResult
value: 'accepted'
- where: safe("log.genericEvent", "").startsWith("signature") && safe("log.genericEvent", "").contains("priority") && safe("log.genericEvent", "").contains("timestamp") && safe("log.genericEvent", "").contains("direction") && safe("log.genericEvent", "").contains("dhost")
+ where: startsWith("log.genericEvent", "signature") && contains("log.genericEvent", "priority") && contains("log.genericEvent", "timestamp") && contains("log.genericEvent", "direction") && contains("log.genericEvent", "dhost")
# ............................................................................
# Cleaning common fields
- trim:
@@ -1544,6 +1544,6 @@ pipeline:
# Removing unused fields
- delete:
fields:
- - safe("log.controlFlag", "")
+ - log.controlFlag
- log.irrelevant
- log.genericEvent
\ No newline at end of file
diff --git a/filters/crowdstrike/crowdstrike.yml b/filters/crowdstrike/crowdstrike.yml
index 40d8d1bde..72eb5c40c 100644
--- a/filters/crowdstrike/crowdstrike.yml
+++ b/filters/crowdstrike/crowdstrike.yml
@@ -1,4 +1,4 @@
-# Crowdstrike module filter, version 1.1.0
+# Crowdstrike module filter, version 1.1.1
# Based in docs and samples provided
#
# Documentations
@@ -263,35 +263,35 @@ pipeline:
params:
key: action
value: 'get'
- where: safe("log.eventAttributesRequestMethod", "") == "GET"
+ where: equals("log.eventAttributesRequestMethod", "GET")
- add:
function: 'string'
params:
key: action
value: 'post'
- where: safe("log.eventAttributesRequestMethod", "") == "POST"
+ where: equals("log.eventAttributesRequestMethod", "POST")
- add:
function: 'string'
params:
key: action
value: 'put'
- where: safe("log.eventAttributesRequestMethod", "") == "PUT"
+ where: equals("log.eventAttributesRequestMethod", "PUT")
- add:
function: 'string'
params:
key: action
value: 'delete'
- where: safe("log.eventAttributesRequestMethod", "") == "DELETE"
+ where: equals("log.eventAttributesRequestMethod", "DELETE")
- add:
function: 'string'
params:
key: action
value: 'request'
- where: safe("log.eventAttributesRequestMethod", "") == "REQUEST"
+ where: equals("log.eventAttributesRequestMethod", "REQUEST")
# .......................................................................#
# Removing unused fields
diff --git a/filters/deceptivebytes/deceptive-bytes.yml b/filters/deceptivebytes/deceptive-bytes.yml
index 89f3d5800..c43ab48a5 100644
--- a/filters/deceptivebytes/deceptive-bytes.yml
+++ b/filters/deceptivebytes/deceptive-bytes.yml
@@ -1,4 +1,4 @@
-# Deceptive Bytes filter, version 3.0.2
+# Deceptive Bytes filter, version 3.0.3
# Based on previous version of the same filter
pipeline:
@@ -240,17 +240,6 @@ pipeline:
pattern: '{{.integer}}\s'
- fieldName: log.component
pattern: '{{.word}}\,'
- - fieldName: log.errorCode
- pattern: '{{.integer}}\]'
- - fieldName: log.message
- pattern: '{{.greedy}}'
- source: log.restMessage
- where: log.restMessage.contains("file")
-
- - grok:
- patterns:
- - fieldName: log.severityLabelCharacter
- pattern: '{{.word}}\s'
- fieldName: log.trheadId
pattern: '{{.integer}}\,'
- fieldName: log.eventSource
@@ -262,7 +251,7 @@ pipeline:
- fieldName: origin.path
pattern: '(?:[A-Z]:\\(?:[^\\\n]+\\)*[^\\\n]*|\/(?:[^\/\n]+\/)*[^\/\n]*)'
source: log.restMessage
- where: log.severityLabelCharacter.contains("V")
+ where: contains("log.severityLabelCharacter", "V")
- grok:
patterns:
@@ -350,7 +339,7 @@ pipeline:
- fieldName: log.irrelevant
pattern: '{{.greedy}}'
source: raw
- where: log.severityLabelCharacter.contains("W")
+ where: contains("log.severityLabelCharacter", "W")
# Removing unnecessary characters
- trim:
@@ -467,21 +456,21 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.severityLabelCharacter", "") in ["C", "A", "E"]
+ where: oneOf("log.severityLabelCharacter", ["C", "A", "E"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.severityLabelCharacter", "") == "W"
+ where: equals("log.severityLabelCharacter", "W")
- add:
function: 'string'
params:
key: severity
value: 'low'
- where: safe("log.severityLabelCharacter", "") in ["D", "V", "N", "I", "T"]
+ where: oneOf("log.severityLabelCharacter", ["D", "V", "N", "I", "T"])
# Removing unused fields
- delete:
diff --git a/filters/filebeat/apache_module.yml b/filters/filebeat/apache_module.yml
index 9c0826810..9ec5ad46f 100644
--- a/filters/filebeat/apache_module.yml
+++ b/filters/filebeat/apache_module.yml
@@ -1,4 +1,4 @@
-# Apache filter, version 3.0.2
+# Apache filter, version 3.0.3
# Compatible with Common Apache Log and Combined Apache Log. See: https://httpd.apache.org/docs/2.2/logs.html
#Filter Input requirements -> fileset: datatype
# access: plain text
@@ -155,37 +155,37 @@ pipeline:
params:
key: action
value: 'get'
- where: safe("log.method", "") == "GET"
+ where: equals("log.method", "GET")
- add:
function: 'string'
params:
key: action
value: 'post'
- where: safe("log.method", "") == "POST"
+ where: equals("log.method", "POST")
- add:
function: 'string'
params:
key: action
value: 'put'
- where: safe("log.method", "") == "PUT"
+ where: equals("log.method", "PUT")
- add:
function: 'string'
params:
key: action
value: 'delete'
- where: safe("log.method", "") == "DELETE"
+ where: equals("log.method", "DELETE")
- add:
function: 'string'
params:
key: action
value: 'patch'
- where: safe("log.method", "") == "PATCH"
+ where: equals("log.method", "PATCH")
- add:
function: 'string'
params:
key: action
value: 'request'
- where: safe("log.method", "") == "REQUEST"
+ where: equals("log.method", "REQUEST")
# Removing log.method if action was set
- delete:
fields:
@@ -215,7 +215,7 @@ pipeline:
params:
key: actionResult
value: 'accepted'
- where: safe("log.statusCode", 0.0) >= double(200) && safe("log.statusCode", 0.0) <= double(299) || (safe("log.statusCode", 0.0) >= double(300) && safe("log.statusCode", 0.0) <= double(399) && safe("origin.bytesReceived", 0.0) > double(0))
+ where: (greaterOrEqual("log.statusCode", 200) && lessOrEqual("log.statusCode", 299)) || (greaterOrEqual("log.statusCode", 300) && lessOrEqual("log.statusCode", 399) && greaterThan("origin.bytesReceived", 0))
# Removing unused fields
- delete:
fields:
diff --git a/filters/filebeat/elasticsearch_module.yml b/filters/filebeat/elasticsearch_module.yml
index 4c64db303..af0a0f499 100644
--- a/filters/filebeat/elasticsearch_module.yml
+++ b/filters/filebeat/elasticsearch_module.yml
@@ -1,4 +1,4 @@
-# Elasticsearch filter, version 3.0.2
+# Elasticsearch filter, version 3.0.3
# Fields based on https://www.elastic.co/guide/en/elasticsearch/reference/8.17/audit-event-types.html,
# https://www.elastic.co/guide/en/beats/filebeat/7.13/filebeat-module-elasticsearch.html
# and filebeat fields.yml version 7.13.4 oss
@@ -381,19 +381,19 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.level", "") in ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"]
+ where: oneOf("log.level", ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.level", "") in ["WARN", "Warning"]
+ where: oneOf("log.level", ["WARN", "Warning"])
- add:
function: 'string'
params:
key: severity
value: 'low'
- where: safe("log.level", "") in ["Information", "Informational", "INFO", "DEBUG", "TRACE"]
+ where: oneOf("log.level", ["Information", "Informational", "INFO", "DEBUG", "TRACE"])
# Removing unused fields
- delete:
@@ -420,4 +420,4 @@ pipeline:
# Droping unwanted logs
- drop:
- where: safe("log.eventDataset", "") && safe("log.component", "") && ( (safe("log.eventDataset", "") != "elasticsearch.server" && safe("log.eventDataset", "") != "elasticsearch.audit") || (safe("log.eventDataset", "") == "elasticsearch.server" && (safe("log.component", "").matches("(A|a)udit")==false && safe("log.component", "").matches("(S|s)(S|s)(L|l)")==false && safe("log.component", "").matches("(S|s)ecurity")==false ) ) )
\ No newline at end of file
+ where: exists("log.eventDataset") && exists("log.component") && ( (!equals("log.eventDataset", "elasticsearch.server") && !equals("log.eventDataset", "elasticsearch.audit")) || (equals("log.eventDataset", "elasticsearch.server") && (!equalsIgnoreCase("log.component", "audit") && !equalsIgnoreCase("log.component", "ssl") && !equalsIgnoreCase("log.component", "security") ) ) )
\ No newline at end of file
diff --git a/filters/filebeat/iis_module.yml b/filters/filebeat/iis_module.yml
index 1943e0ad9..cc2ad55f5 100644
--- a/filters/filebeat/iis_module.yml
+++ b/filters/filebeat/iis_module.yml
@@ -1,4 +1,4 @@
-# Internet Information Services Filter, version 3.0.2
+# Internet Information Services Filter, version 3.0.3
# Supports IIS 7 and later versions. See: https://learn.microsoft.com/es-es/iis/configuration/system.applicationhost/log/
# and https://learn.microsoft.com/es-es/iis/configuration/system.applicationhost/sites/site/logfile/
# 1. Parsing the json from beats
@@ -132,35 +132,35 @@ pipeline:
params:
key: action
value: 'get'
- where: safe("log.method", "") == "GET"
+ where: equals("log.method", "GET")
- add:
function: 'string'
params:
key: action
value: 'post'
- where: safe("log.method", "") == "POST"
+ where: equals("log.method", "POST")
- add:
function: 'string'
params:
key: action
value: 'put'
- where: safe("log.method", "") == "PUT"
+ where: equals("log.method", "PUT")
- add:
function: 'string'
params:
key: action
value: 'delete'
- where: safe("log.method", "") == "DELETE"
+ where: equals("log.method", "DELETE")
- add:
function: 'string'
params:
key: action
value: 'request'
- where: safe("log.method", "") == "REQUEST"
+ where: equals("log.method", "REQUEST")
# Removing log.method if action was set
- delete:
diff --git a/filters/filebeat/kafka_module.yml b/filters/filebeat/kafka_module.yml
index d89a8f1b6..5ab966008 100644
--- a/filters/filebeat/kafka_module.yml
+++ b/filters/filebeat/kafka_module.yml
@@ -1,4 +1,4 @@
-# Kafka module filter, version 3.0.2
+# Kafka module filter, version 3.0.3
# Filter Input requirements -> fileset: datatype
# log: plain text
#
@@ -142,21 +142,21 @@ pipeline:
params:
key: severity
value: 'low'
- where: safe("log.severity", "") in ["INFO", "TRACE", "DEBUG"]
+ where: oneOf("log.severity", ["INFO", "TRACE", "DEBUG"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.severity", "") in ["WARNING", "WARN"]
+ where: oneOf("log.severity", ["WARNING", "WARN"])
- add:
function: 'string'
params:
key: severity
value: 'high'
- where: safe("log.severity", "") == "ERROR"
+ where: equals("log.severity", "ERROR")
# Removing unused fields
- delete:
diff --git a/filters/filebeat/kibana_module.yml b/filters/filebeat/kibana_module.yml
index 7a5e65f9a..18a34b6d1 100644
--- a/filters/filebeat/kibana_module.yml
+++ b/filters/filebeat/kibana_module.yml
@@ -1,4 +1,4 @@
-# Kibana filter, version 3.0.2
+# Kibana filter, version 3.0.3
# Supports Kibana Log and Kibana Audit version 7.17 or later.
# See: https://www.elastic.co/guide/en/kibana/7.17/xpack-security-audit-logging.html
# and https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-kibana.html#_fields_27
@@ -150,21 +150,21 @@ pipeline:
params:
key: log.severity
value: 'high'
- where: safe("log.severityLabel", "") in ["critical", "alert", "error"]
+ where: oneOf("log.severityLabel", ["critical", "alert", "error"])
- add:
function: 'string'
params:
key: log.severity
value: 'medium'
- where: safe("log.severityLabel", "") == "warning"
+ where: equals("log.severityLabel", "warning")
- add:
function: 'string'
params:
key: log.severity
value: 'low'
- where: safe("log.severityLabel", "") in ["debug", "verbose", "notice", "information", "trace"]
+ where: oneOf("log.severityLabel", ["debug", "verbose", "notice", "information", "trace"])
# Removing unused fields
- delete:
diff --git a/filters/filebeat/logstash_module.yml b/filters/filebeat/logstash_module.yml
index d4b1d3e96..309288b35 100644
--- a/filters/filebeat/logstash_module.yml
+++ b/filters/filebeat/logstash_module.yml
@@ -1,4 +1,4 @@
-# Logstash filter, version 4.0.2
+# Logstash filter, version 4.0.3
# Fields based on https://www.elastic.co/guide/en/beats/filebeat/7.13/filebeat-module-logstash.html
# and filebeat fields.yml version 7.13.4 oss
# Support logs from logstash 7.14.1 ++
@@ -114,19 +114,19 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.level", "") in ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"]
+ where: oneOf("log.level", ["ERROR", "Error", "FATAL", "CRITICAL", "Critical"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.level", "") in ["WARN", "Warning"]
+ where: oneOf("log.level", ["WARN", "Warning"])
- add:
function: 'string'
params:
key: severity
value: 'low'
- where: safe("log.level", "") in ["Information", "Informational", "INFO", "DEBUG", "TRACE"]
+ where: oneOf("log.level", ["Information", "Informational", "INFO", "DEBUG", "TRACE"])
# Removing unused fields
- delete:
fields:
diff --git a/filters/filebeat/mysql_module.yml b/filters/filebeat/mysql_module.yml
index 135a400e9..84c9d3325 100644
--- a/filters/filebeat/mysql_module.yml
+++ b/filters/filebeat/mysql_module.yml
@@ -1,4 +1,4 @@
-# MySQL filter, version 3.0.2
+# MySQL filter, version 3.0.3
# Fields based on https://www.elastic.co/guide/en/beats/filebeat/7.13/filebeat-module-mysql.html
# https://dev.mysql.com/doc/refman/8.0/en/error-log-format.html
# https://docs.oracle.com/en-us/iaas/Content/Logging/Reference/top_level_logging_format.htm
@@ -105,19 +105,19 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.level", "") == "Internal" || safe("log.level", "") == "internal" || safe("log.level", "") == "INTERNAL" || safe("log.level", "") == "Error" || safe("log.level", "") == "error" || safe("log.level", "") == "ERROR"
+ where: oneOf("log.level", ["Internal", "internal", "INTERNAL", "Error", "error", "ERROR"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.level", "") && (safe("log.level", "") == "Warning" || safe("log.level", "") == "warning" || safe("log.level", "") == "WARNING")
+ where: exists("log.level") && oneOf("log.level", ["Warning", "warning", "WARNING"])
- add:
function: 'string'
params:
key: severity
value: 'low'
- where: safe("log.level", "") && safe("log.level", "") != "Internal" && safe("log.level", "") != "internal" && safe("log.level", "") != "INTERNAL" && safe("log.level", "") != "Error" && safe("log.level", "") != "error" && safe("log.level", "") != "ERROR" && safe("log.level", "") != "Warning" && safe("log.level", "") != "warning" && safe("log.level", "") != "WARNING"
+ where: exists("log.level") && !oneOf("log.level", ["Internal", "internal", "INTERNAL", "Error", "error", "ERROR", "Warning", "warning", "WARNING"])
# Removing unused fields
- delete:
fields:
diff --git a/filters/filebeat/nginx_module.yml b/filters/filebeat/nginx_module.yml
index 8cf858831..8b7743564 100644
--- a/filters/filebeat/nginx_module.yml
+++ b/filters/filebeat/nginx_module.yml
@@ -1,4 +1,4 @@
-# Nginx filter, version 3.0.2
+# Nginx filter, version 3.0.3
# Supports Nginx access, error, emergency and notice log
# See: https://github.com/nginx/nginx
# and https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-nginx.html for more documentation
@@ -306,35 +306,35 @@ pipeline:
params:
key: action
value: 'get'
- where: safe("log.method", "") == "GET"
+ where: equals("log.method", "GET")
- add:
function: 'string'
params:
key: action
value: 'post'
- where: safe("log.method", "") == "POST"
+ where: equals("log.method", "POST")
- add:
function: 'string'
params:
key: action
value: 'put'
- where: safe("log.method", "") == "PUT"
+ where: equals("log.method", "PUT")
- add:
function: 'string'
params:
key: action
value: 'delete'
- where: safe("log.method", "") == "DELETE"
+ where: equals("log.method", "DELETE")
- add:
function: 'string'
params:
key: action
value: 'request'
- where: safe("log.method", "") == "REQUEST"
+ where: equals("log.method", "REQUEST")
# Adding actionResult
# denied by default
@@ -349,7 +349,7 @@ pipeline:
params:
key: actionResult
value: 'accepted'
- where: safe("statusCode", 0.0) >= double(200) && safe("statusCode", 0.0) <= double(299) || (safe("statusCode", 0.0) >= double(300) && safe("statusCode", 0.0) <= double(399) && safe("origin.bytesReceived", 0.0) > double(0))
+ where: (greaterOrEqual("statusCode", 200) && lessOrEqual("statusCode", 299)) || (greaterOrEqual("statusCode", 300) && lessOrEqual("statusCode", 399) && greaterThan("origin.bytesReceived", 0))
# Adding severity based on log.severityLabel
- add:
@@ -357,21 +357,21 @@ pipeline:
params:
key: log.severity
value: 'high'
- where: safe("log.severityLabel", "") in ["critical", "alert", "error"]
+ where: oneOf("log.severityLabel", ["critical", "alert", "error"])
- add:
function: 'string'
params:
key: log.severity
value: 'medium'
- where: safe("log.severityLabel", "") == "warning"
+ where: equals("log.severityLabel", "warning")
- add:
function: 'string'
params:
key: log.severity
value: 'low'
- where: safe("log.severityLabel", "") in ["debug", "verbose", "notice", "information", "trace"]
+ where: oneOf("log.severityLabel", ["debug", "verbose", "notice", "information", "trace"])
# Removing log.method if action was set
- delete:
diff --git a/filters/filebeat/redis_module.yml b/filters/filebeat/redis_module.yml
index a99ff7a1d..ad4a05ed3 100644
--- a/filters/filebeat/redis_module.yml
+++ b/filters/filebeat/redis_module.yml
@@ -1,4 +1,4 @@
-# Redis module filter, version 3.0.2
+# Redis module filter, version 3.0.3
# Filter Input requirements -> fileset: datatype
# log: plain text
#
@@ -148,21 +148,21 @@ pipeline:
params:
key: severity
value: 'low'
- where: safe("log.severity", "") in ["debug", "verbose"]
+ where: oneOf("log.severity", ["debug", "verbose"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.severity", "") in ["notice", "warning"]
+ where: oneOf("log.severity", ["notice", "warning"])
- add:
function: 'string'
params:
key: severity
value: 'high'
- where: safe("log.severity", "") in ["error"]
+ where: oneOf("log.severity", ["error"])
# Parse beats field
- rename:
diff --git a/filters/google/gcp.yml b/filters/google/gcp.yml
index 51b73d125..b945ae337 100644
--- a/filters/google/gcp.yml
+++ b/filters/google/gcp.yml
@@ -1,4 +1,4 @@
-# GCP filter, version 2.1.1
+# GCP filter, version 2.1.2
#
# Documentations
# 1- https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry
@@ -309,21 +309,21 @@ pipeline:
params:
key: severity
value: "low"
- where: safe("log.severity", "") in ["INFO", "NOTICE"]
+ where: oneOf("log.severity", ["INFO", "NOTICE"])
- add:
function: "string"
params:
key: severity
value: "medium"
- where: safe("log.severity", "") == "WARNING"
+ where: equals("log.severity", "WARNING")
- add:
function: "string"
params:
key: severity
value: "high"
- where: safe("log.severity", "") == "ERROR"
+ where: equals("log.severity", "ERROR")
# Adding action field based on log.httpRequestMethod
- add:
@@ -331,42 +331,42 @@ pipeline:
params:
key: action
value: "get"
- where: safe("log.httpRequestMethod", "") == "GET"
+ where: equals("log.httpRequestMethod", "GET")
- add:
function: "string"
params:
key: action
value: "post"
- where: safe("log.httpRequestMethod", "") == "POST"
+ where: equals("log.httpRequestMethod", "POST")
- add:
function: "string"
params:
key: action
value: "put"
- where: safe("log.httpRequestMethod", "") == "PUT"
+ where: equals("log.httpRequestMethod", "PUT")
- add:
function: "string"
params:
key: action
value: "patch"
- where: safe("log.httpRequestMethod", "") == "PATCH"
+ where: equals("log.httpRequestMethod", "PATCH")
- add:
function: "string"
params:
key: action
value: "request"
- where: safe("log.httpRequestMethod", "") == "REQUEST"
+ where: equals("log.httpRequestMethod", "REQUEST")
- add:
function: "string"
params:
key: action
value: "delete"
- where: safe("log.httpRequestMethod", "") == "DELETE"
+ where: equals("log.httpRequestMethod", "DELETE")
# Adding actionResult field based on log.jsonPayloadEnforcedEdgeSecurityPolicyOutcome
- add:
@@ -374,14 +374,14 @@ pipeline:
params:
key: actionResult
value: "accepted"
- where: safe("log.jsonPayloadEnforcedEdgeSecurityPolicyOutcome", "") == "ACCEPT"
+ where: equals("log.jsonPayloadEnforcedEdgeSecurityPolicyOutcome", "ACCEPT")
- add:
function: "string"
params:
key: actionResult
value: "denied"
- where: safe("log.jsonPayloadEnforcedEdgeSecurityPolicyOutcome", "") == "DENY"
+ where: equals("log.jsonPayloadEnforcedEdgeSecurityPolicyOutcome", "DENY")
# Adding geolocation to origin.ip
- dynamic:
diff --git a/filters/hids/hids-wazuh.conf b/filters/hids/hids-wazuh.conf
deleted file mode 100644
index 02e844389..000000000
--- a/filters/hids/hids-wazuh.conf
+++ /dev/null
@@ -1,143 +0,0 @@
-filter {
- if [path] and [path] == "/var/ossec/logs/alerts/alerts.json" {
-#......................................................................#
-# Filter version 1.0.7
-# Checking agent.id, when value == 000, dataSource is always hids
- if ([agent][id] and [agent][id] == "000") {
- mutate {
- add_field => {
- "dataSource" => "hids"
- }
- }
- } else {
- # Make a copy of agent.name
- mutate {
- add_field => { "original_agent" => "%{[agent][name]}" }
- }
- mutate {
- rename => ["[agent][name]" , "[dataSrc]"]
- }
- # Check if [agent][name] renamed to [dataSrc] exists
- if ([dataSrc]) {
- # Then check computer common naming conventions: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/naming-conventions-for-computer-domain-site-ou
- if([dataSrc] =~ /^(\w)(\w|\.|-)+$/) and !([dataSrc] =~ /^(\d)(\d|\.)+(\d)$/) {
- mutate {
- rename => ["[dataSrc]" , "[dataSource]"]
- }
- } else {
- # If [dataSrc] not match, means that [agent][name] have wrong values so reset to default field name
- mutate {
- rename => ["[dataSrc]" , "[agent][name]"]
- }
- }
- }
- }
- # If could be parsed, there are no errors so, do the rest
- # If errors detected in [agent][name], [dataSource] is not in the flow so, do nothing
- if ([dataSource]) {
- mutate {
- add_field => {
- "dataType" => "hids"
- }
- rename => ["[agent][id]" , "[logx][hids][agent_id]"]
- rename => ["[agent][ip]" , "[logx][hids][agent_ip]"]
- rename => ["[manager][name]" , "[logx][hids][manager]"]
- }
- # Adding agent.name
- if[agent][name]{
- mutate { rename => ["[agent][name]" , "[logx][hids][agent_name]"] }
- } else {
- mutate { rename => ["[original_agent]" , "[logx][hids][agent_name]"] }
- }
- if [data] {
- mutate {
- rename => ["[data]", "[logx][hids][data]"]
- }
- }
- if [decoder] and [decoder][name] {
- mutate {
- rename => ["[decoder][name]", "[logx][hids][decoder_name]"]
- }
- # Separating remove from rename mutations
- mutate {
- remove_field => ["decoder"]
- }
- }
- if [location] {
- mutate {
- rename => ["[location]", "[logx][hids][location]"]
- }
- }
- if [rule] {
- mutate {
- rename => ["[rule]", "[logx][hids][rule]"]
- }
- if [logx][hids][rule][level] {
- if [logx][hids][rule][level] > 11 {
- mutate {
- add_field => {
- "[logx][hids][severity]" => 3
- }
- add_field => {
- "[logx][hids][severity_label]" => "High"
- }
- add_field => {
- "[logx][hids][category]" => "Potentially Compromised System"
- }
- }
- }
- if [logx][hids][rule][level] <= 11 and [logx][hids][rule][level] >= 7 {
- mutate {
- add_field => {
- "[logx][hids][severity]" => 2
- }
- add_field => {
- "[logx][hids][severity_label]" => "Medium"
- }
- add_field => {
- "[logx][hids][category]" => "Potentially Malicious Activity"
- }
- }
- }
- if [logx][hids][rule][level] < 7 {
- mutate {
- add_field => {
- "[logx][hids][severity]" => 1
- }
- add_field => {
- "[logx][hids][severity_label]" => "Low"
- }
- add_field => {
- "[logx][hids][category]" => "Low Risk or Informational Event"
- }
- }
- }
- }
- }
-
-#......................................................................#
-# Checking again agent.id, when value == 000, dataSource is always hids
- if ([logx][hids][agent_id] and [logx][hids][agent_id] == "000") {
- ruby { code => 'event.set("dataSource", "hids")' }
- }
-#......................................................................#
-# Adding field for filter execution verification
- mutate {
- add_field => {
- "[logx][hids][filter_version]" => "1.0.7"
- }
- }
-#......................................................................#
-# Remove unwanted fields
- mutate {
- remove_field => ["host", "type", "timestamp", "manager", "path", "agent"]
- }
- }
-
-#......................................................................#
-# If "_jsonparsefailure" in tags, was errors in the incoming json file, so, remove the entire message
- if "_jsonparsefailure" in [tags] and ![dataSource]{
- drop {}
- }
- }
-}
diff --git a/filters/hids/hids-wazuh.yml b/filters/hids/hids-wazuh.yml
new file mode 100644
index 000000000..4bbc2cc6d
--- /dev/null
+++ b/filters/hids/hids-wazuh.yml
@@ -0,0 +1,59 @@
+pipeline:
+ - dataTypes:
+ - hids
+ steps:
+ # 1. Parse JSON
+ - json:
+ source: raw
+
+ # 2. Rename Agent Fields
+ - rename:
+ from: [log.agent.id]
+ to: log.agent_id
+ - rename:
+ from: [log.agent.ip]
+ to: log.agent_ip
+ - rename:
+ from: [log.agent.name]
+ to: log.agent_name
+ - rename:
+ from: [log.manager.name]
+ to: log.manager
+
+ # 3. Handle Special "000" Agent Case (from conf)
+ # In the new system, we might just keep the values as is,
+ # or if we need to enforce dataSource changes, we relies on pipeline logic.
+ # The old conf set "dataSource" => "hids" if agent.id == "000".
+ # This is likely handled by defining the dataType as "hids" for this pipeline.
+
+ # 4. Rename Other Fields
+ - rename:
+ from: [log.decoder.name]
+ to: log.decoder_name
+ - rename:
+ from: [log.rule]
+ to: log.rule
+ - rename:
+ from: [log.location]
+ to: log.location
+ - rename:
+ from: [log.data]
+ to: log.data
+
+ # 5. Severity Mapping based on Rule Level
+ - add:
+ function: string
+ params: { key: severity, value: high }
+ where: 'exists("log.rule.level") && greaterThan("log.rule.level", 11)'
+ - add:
+ function: string
+ params: { key: severity, value: medium }
+ where: 'exists("log.rule.level") && lessOrEqual("log.rule.level", 11) && greaterOrEqual("log.rule.level", 7)'
+ - add:
+ function: string
+ params: { key: severity, value: low }
+ where: 'exists("log.rule.level") && lessThan("log.rule.level", 7)'
+
+ # 6. Standard UTMStack Fields
+ # If these exist in log.data or elsewhere, they should be mapped.
+ # The conf didn't map to origin.ip/target.ip explicitly unless they were in "data".
diff --git a/filters/ibm/ibm_aix.yml b/filters/ibm/ibm_aix.yml
index 2d4d9e2b1..49ec5fb4f 100644
--- a/filters/ibm/ibm_aix.yml
+++ b/filters/ibm/ibm_aix.yml
@@ -53,7 +53,7 @@ pipeline:
- fieldName: log.msgAll
pattern: '{{.greedy}}'
source: log.msgInit
- where: log.msgInit.contains("Message forwarded from")
+ where: contains("log.msgInit", "Message forwarded from")
# Removing unnecessary characters
- trim:
@@ -74,7 +74,7 @@ pipeline:
- fieldName: log.msgWithTTY
pattern: '{{.greedy}}'
source: log.msgAll
- where: log.msgAll.contains("TTY=") || log.msgAll.contains("PWD=") || log.msgAll.contains("USER=") || log.msgAll.contains("COMMAND=")
+ where: contains("log.msgAll", "TTY=") || contains("log.msgAll", "PWD=") || contains("log.msgAll", "USER=") || contains("log.msgAll", "COMMAND=")
# Removing unnecessary characters
- trim:
@@ -96,7 +96,7 @@ pipeline:
- fieldName: log.msgWithTTY
pattern: '{{.greedy}}'
source: log.msgWithTTY
- where: log.msgWithTTY.contains("TTY=") || log.msgWithTTY.contains("PWD=") || log.msgWithTTY.contains("USER=") || log.msgWithTTY.contains("COMMAND=")
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
# ......................................................................#
# If "PWD=" in [msgWithTTY]
@@ -110,7 +110,7 @@ pipeline:
- fieldName: log.msgWithTTY
pattern: '{{.greedy}}'
source: log.msgWithTTY
- where: log.msgWithTTY.contains("TTY=") || log.msgWithTTY.contains("PWD=") || log.msgWithTTY.contains("USER=") || log.msgWithTTY.contains("COMMAND=")
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
# ......................................................................#
# If "USER=" in [msgWithTTY]
@@ -124,7 +124,7 @@ pipeline:
- fieldName: log.msgWithTTY
pattern: '{{.greedy}}'
source: log.msgWithTTY
- where: log.msgWithTTYcontains("TTY=") || log.msgWithTTY.contains("PWD=") || log.msgWithTTY.contains("USER=") || log.msgWithTTY.contains("COMMAND=")
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
# ......................................................................#
# If "COMMAND=" in [msgWithTTY]
@@ -136,7 +136,7 @@ pipeline:
- fieldName: origin.command
pattern: '{{.greedy}}'
source: log.msgWithTTY
- where: log.msgWithTTYcontains("TTY=") || log.msgWithTTY.contains("PWD=") || log.msgWithTTY.contains("USER=") || log.msgWithTTY.contains("COMMAND=")
+ where: contains("log.msgWithTTY", "TTY=") || contains("log.msgWithTTY", "PWD=") || contains("log.msgWithTTY", "USER=") || contains("log.msgWithTTY", "COMMAND=")
# ......................................................................#
# Using grok to parse msgAll
@@ -152,7 +152,7 @@ pipeline:
- fieldName: origin.command
pattern: '{{.greedy}}'
source: log.msgAll
- where: log.msgAll.contains("(command continued)")
+ where: contains("log.msgAll", "(command continued)")
# ......................................................................#
# Removing unnecessary characters
@@ -183,7 +183,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msgAll
- where: log.msgAll.matches("\\w+\\[[0-9]+\\]\\:")
+ where: regexMatch("log.msgAll", "\\w+\\[[0-9]+\\]\\:")
# ......................................................................#
# Removing unnecessary characters
@@ -218,7 +218,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "SESSIONID:" in [msg]
@@ -234,7 +234,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "ENTRYID:" in [msg]
@@ -250,7 +250,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "STATEMENT:" in [msg]
@@ -266,7 +266,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "USERID:" in [msg]
@@ -282,7 +282,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "USERHOST:" in [msg]
@@ -298,7 +298,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "ACTION:" in [msg]
@@ -314,7 +314,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "RETURNCODE:" in [msg]
@@ -330,7 +330,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "OBJ$CREATOR:" in [msg]
@@ -346,7 +346,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "OBJ$NAME:" in [msg]
@@ -362,7 +362,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# If "OS$USERID:" in [msg]
@@ -378,7 +378,7 @@ pipeline:
- fieldName: log.msg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................
# Removing msg field
@@ -386,7 +386,7 @@ pipeline:
- delete:
fields:
- log.msg
- where: log.msg.contains("LENGTH:") || log.msg.contains("SESSIONID:") || log.msg.contains("ENTRYID:") || log.msg.contains("STATEMENT:") || log.msg.contains("USERID:") || log.msg.contains("USERHOST:") || log.msg.contains("ACTION:") || log.msg.contains("RETURNCODE:") || log.msg.contains("OBJ$CREATOR:") || log.msg.contains("OBJ$NAME:") || log.msg.contains("OS$USERID:")
+ where: contains("log.msg", "LENGTH:") || contains("log.msg", "SESSIONID:") || contains("log.msg", "ENTRYID:") || contains("log.msg", "STATEMENT:") || contains("log.msg", "USERID:") || contains("log.msg", "USERHOST:") || contains("log.msg", "ACTION:") || contains("log.msg", "RETURNCODE:") || contains("log.msg", "OBJ$CREATOR:") || contains("log.msg", "OBJ$NAME:") || contains("log.msg", "OS$USERID:")
# ......................................................................#
# if ([msg]=~/from(.+)port/)
@@ -404,7 +404,7 @@ pipeline:
- fieldName: log.restMsg
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.matches("from(.+)port")
+ where: regexMatch("log.msg", "from(.+)port")
- grok:
patterns:
@@ -419,7 +419,7 @@ pipeline:
- fieldName: origin.port
pattern: '{{.greedy}}'
source: log.msg
- where: log.msg.matches("from(.+)port")
+ where: regexMatch("log.msg", "from(.+)port")
# ......................................................................#
# if restmsg contains protocol SSH and SHA256
@@ -435,7 +435,7 @@ pipeline:
- fieldName: origin.sha256
pattern: '{{.greedy}}'
source: log.restMsg
- where: log.restMsg.contains("ssh") && log.restMsg.contains("SHA256")
+ where: contains("log.restMsg", "ssh") && contains("log.restMsg", "SHA256")
# ......................................................................#
# Fileds conversions
diff --git a/filters/linux/linux-ufw.conf b/filters/linux/linux-ufw.conf
deleted file mode 100644
index c3db13d57..000000000
--- a/filters/linux/linux-ufw.conf
+++ /dev/null
@@ -1,99 +0,0 @@
-filter {
- # Linux UFW filter version 2.0.1
- split {
- field => "message"
- terminator => ""
- }
-
- #Looking for datasource generated by an agent and parse original message
- if [message]=~/\[utm_stack_agent_ds=(.+)\]-(.+)/ {
- grok {
- match => {
- "message" => [ "\[utm_stack_agent_ds=%{DATA:dataSource}\]-%{GREEDYDATA:original_log_message}" ]
- }
- }
- }
- if [original_log_message] {
- mutate {
- update => { "message" => "%{[original_log_message]}" }
- }
- }
-
- if ![dataType]{
- if [message] {
- grok {
- match => {
- "message" => [
- "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:ufwDataSource} %{DATA:process}(?:\[%{POSINT:pid}\])?:( \[%{NUMBER}\])? \[UFW %{WORD:ufw_action}\] IN=%{DATA:ufw_interface} OUT= MAC=%{DATA:ufw_mac} SRC=%{IP:ufw_src_ip} DST=%{IP:ufw_dest_ip} %{GREEDYDATA} PROTO=%{WORD:ufw_proto} SPT=%{INT:ufw_src_port} DPT=%{INT:ufw_dst_port} %{GREEDYDATA}",
- "%{GREEDYDATA}%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:ufwDataSource} %{DATA:process}(?:\[%{POSINT:pid}\])?:( \[%{NUMBER}\])? \[UFW %{WORD:ufw_action}\] IN=%{DATA:ufw_interface} OUT= MAC=%{DATA:ufw_mac} SRC=%{IP:ufw_src_ip} DST=%{IP:ufw_dest_ip} %{GREEDYDATA} PROTO=%{WORD:ufw_proto} SPT=%{INT:ufw_src_port} DPT=%{INT:ufw_dst_port} %{GREEDYDATA}"
- ]
- }
- }
- }
- }
-
-#......................................................................#
-#Generating dataSource field required by CurrelationRulesEngine
-#Checks if ufwDataSource exists, if true, the dataSource field take its value, if not, take the agent dataSource value
- if ([ufwDataSource]){
- if [dataSource] {
- mutate {
- update => { "dataSource" => "%{[ufwDataSource]}" }
- }
- } else {
- mutate {
- add_field => { "dataSource" => "%{ufwDataSource}" }
- }
- }
- }
-#Finally evaluates to the host variable if can not be calculated
- if ![dataSource] {
- mutate {
- add_field => { "dataSource" => "%{host}" }
- }
- }
-
- if [ufw_action] and ([ufw_action] == "BLOCK" or [ufw_action] == "ALLOW") {
- mutate {
- remove_field => [ "message" ]
- add_field => {"[dataType]" => "firewall-ufw"}
- rename => {
- "[process]" => "[logx][ufw][process]"
- }
- rename => {
- "[pid]" => "[logx][ufw][pid]"
- }
- rename => {
- "[ufw_action]" => "[logx][ufw][action]"
- }
- rename => {
- "[ufw_interface]" => "[logx][ufw][interface]"
- }
- rename => {
- "[ufw_mac]" => "[logx][ufw][mac]"
- }
- rename => {
- "[ufw_src_ip]" => "[logx][ufw][src_ip]"
- }
- rename => {
- "[ufw_dest_ip]" => "[logx][ufw][dest_ip]"
- }
- rename => {
- "[ufw_proto]" => "[logx][ufw][proto]"
- }
- rename => {
- "[ufw_src_port]" => "[logx][ufw][src_port]"
- }
- rename => {
- "[ufw_dst_port]" => "[logx][ufw][dest_port]"
- }
- rename => {
- "[timestamp]" => "[logx][ufw][timestamp]"
- }
- }
- }
- #Also, remove unwanted fields if the message not match with conditions
- mutate {
- remove_field => ["@version","ufwDataSource","original_log_message","headers"]
- }
-}
diff --git a/filters/linux/linux-ufw.yml b/filters/linux/linux-ufw.yml
new file mode 100644
index 000000000..f5840f837
--- /dev/null
+++ b/filters/linux/linux-ufw.yml
@@ -0,0 +1,84 @@
+pipeline:
+ - dataTypes:
+ - firewall-ufw
+ steps:
+ # 1. Handle Agent Wrapper (Optional)
+ - grok:
+ source: raw
+ patterns:
+ - fieldName: log.wrapper_open
+ pattern: '\[utm_stack_agent_ds='
+ - fieldName: log.datasource_override
+ pattern: '{{.data}}'
+ - fieldName: log.wrapper_close
+ pattern: '\]-'
+ - fieldName: log.inner_msg
+ pattern: '{{.greedy}}'
+ - fieldName: log.inner_msg # Fallback if no wrapper, match everything
+ pattern: '{{.greedy}}'
+
+ # 2. Parse UFW Log
+ - grok:
+ source: log.inner_msg
+ patterns:
+ - fieldName: log.timestamp
+ pattern: '{{.monthName}}(\s+){{.monthDay}}(\s+){{.time}}'
+ - fieldName: log.separator
+ pattern: '{{.space}}'
+ - fieldName: log.ufw_host
+ pattern: '{{.hostname}}'
+ - fieldName: log.separator
+ pattern: '{{.space}}'
+ - fieldName: log.process
+ pattern: '{{.data}}'
+ - fieldName: log.separator
+ pattern: '\[UFW '
+ - fieldName: log.action
+ pattern: '{{.word}}'
+ - fieldName: log.separator
+ pattern: '\] '
+ - fieldName: log.ufw_data
+ pattern: '{{.greedy}}'
+
+ # 2b. Parse the Key-Value part of UFW
+ - kv:
+ source: log.ufw_data
+ fieldSplit: " "
+ valueSplit: "="
+
+ # 3. Standardize Fields from KV
+ - rename:
+ from: [SRC]
+ to: origin.ip
+ - rename:
+ from: [DST]
+ to: target.ip
+ - rename:
+ from: [SPT]
+ to: origin.port
+ - rename:
+ from: [DPT]
+ to: target.port
+ - rename:
+ from: [PROTO]
+ to: protocol
+ - rename:
+ from: [MAC]
+ to: log.mac
+ - rename:
+ from: [IN]
+ to: log.interface
+
+ # 4. Standardize Action
+ - rename:
+ from: [log.action]
+ to: action
+
+ # 5. Cast Types
+ - cast:
+ fields: [origin.port, target.port]
+ to: int
+
+ # 6. Cleanup
+ - delete:
+ fields: [log.wrapper_open, log.wrapper_close, log.inner_msg, log.ufw_data, log.separator]
diff --git a/filters/linux/linux.conf b/filters/linux/linux.conf
deleted file mode 100644
index 8d8e9c39b..000000000
--- a/filters/linux/linux.conf
+++ /dev/null
@@ -1,75 +0,0 @@
-filter {
- # Linux filter version 2.0.2
- split {
- field => "message"
- terminator => ""
- }
-
- #Looking for datasource generated by an agent and parse original message
- if [message]=~/\[utm_stack_agent_ds=(.+)\]-(.+)/ {
- grok {
- match => {
- "message" => [ "\[utm_stack_agent_ds=%{DATA:dataSource}\]-%{GREEDYDATA:original_log_message}" ]
- }
- }
- }
- if [original_log_message] {
- mutate {
- update => { "message" => "%{[original_log_message]}" }
- }
- }
-
- if ![dataType]{
- if [message] and !([message]=~/\[UFW \w+\]/){
- grok {
- match => {
- "message" => [
- "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:rsyslogDataSource} %{DATA:process}(\[%{POSINT:pid}\])?: %{GREEDYDATA:msg}",
- "%{GREEDYDATA}%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:rsyslogDataSource} %{DATA:process}(\[%{POSINT:pid}\])?: %{GREEDYDATA:msg}"
- ]
- }
- }
-
- #......................................................................#
- #Generating dataSource field required by CurrelationRulesEngine
- #Checks if rsyslogDataSource exists, if true, the dataSource field take its value, if not, take the agent dataSource value
- if ([rsyslogDataSource]){
- if [dataSource] {
- mutate {
- update => { "dataSource" => "%{[rsyslogDataSource]}" }
- }
- } else {
- mutate {
- add_field => { "dataSource" => "%{rsyslogDataSource}" }
- }
- }
- }
- #Finally evaluates to the host variable if can not be calculated
- if ![dataSource] {
- mutate {
- add_field => { "dataSource" => "%{host}" }
- }
- }
-
- if [timestamp] and [dataSource] and [process]{
- mutate {
- remove_field => [ "message" ]
- #Generating dataType field required by CurrelationRulesEngine
- add_field => {"[dataType]" => "rsyslog-linux"}
-
- # Rename fields
- rename => { "[process]" => "[logx][rsyslog_linux][process]" }
- rename => { "[pid]" => "[logx][rsyslog_linux][pid]" }
- rename => { "[msg]" => "[logx][rsyslog_linux][msg]" }
-
- #Finally, remove unnecessary fields
- remove_field => ["timestamp", "@version","path","type"]
- }
- }
- }
- }
- #Also, remove unwanted fields if the message not match with conditions
- mutate {
- remove_field => ["@version","rsyslogDataSource","original_log_message","headers"]
- }
-}
diff --git a/filters/linux/linux.yml b/filters/linux/linux.yml
new file mode 100644
index 000000000..7dad671a1
--- /dev/null
+++ b/filters/linux/linux.yml
@@ -0,0 +1,55 @@
+pipeline:
+ - dataTypes:
+ - rsyslog-linux
+ steps:
+ # 1. Handle Agent Wrapper (Optional)
+ - grok:
+ source: raw
+ patterns:
+ - fieldName: log.wrapper_open
+ pattern: '\[utm_stack_agent_ds='
+ - fieldName: log.datasource_override
+ pattern: '{{.data}}'
+ - fieldName: log.wrapper_close
+ pattern: '\]-'
+ - fieldName: log.inner_msg
+ pattern: '{{.greedy}}'
+ - fieldName: log.inner_msg
+ pattern: '{{.greedy}}'
+
+ # 2. Parse Syslog
+ - grok:
+ source: log.inner_msg
+ patterns:
+ - fieldName: log.timestamp
+ pattern: '{{.monthName}}(\s+){{.monthDay}}(\s+){{.time}}'
+ - fieldName: log.separator
+ pattern: '{{.space}}'
+ - fieldName: log.syslog_host
+ pattern: '{{.hostname}}'
+ - fieldName: log.separator
+ pattern: '{{.space}}'
+ - fieldName: log.process_info
+ pattern: '{{.data}}:'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+
+ # 3. Rename Fields
+ # Extract PID if present in process info (e.g. sshd[123])
+ - grok:
+ source: log.process_info
+ patterns:
+ - fieldName: log.process_name
+ pattern: '{{.word}}'
+ - fieldName: log.pid_wrapper
+ pattern: '\[{{.integer}}\]'
+ where: 'contains(log.process_info, "[")'
+
+ - rename:
+ from: [log.process_info]
+ to: log.process_name
+ where: '!contains(log.process_info, "[")'
+
+ # 4. Cleanup
+ - delete:
+ fields: [log.wrapper_open, log.wrapper_close, log.inner_msg, log.separator, log.pid_wrapper]
diff --git a/filters/macos/macos-syslog.conf b/filters/macos/macos-syslog.conf
deleted file mode 100644
index 85d297dea..000000000
--- a/filters/macos/macos-syslog.conf
+++ /dev/null
@@ -1,40 +0,0 @@
-filter {
-# MacOS filter, version 3.0.0
-
-split {
- field => "message"
- terminator => ""
-}
-
-#Looking for datasource generated by an agent and parse original message
-if [message]=~/\[utm_stack_agent_ds=(.+)\]-(.+)/ {
- grok {
- match => {
- "message" => [ "\[utm_stack_agent_ds=%{DATA:dataSource}\]-%{GREEDYDATA:original_log_message}" ]
- }
- }
-}
-if [original_log_message] {
- mutate {
- update => { "message" => "%{[original_log_message]}" }
- }
-}
-#......................................................................#
-#Generating dataSource field required by CurrelationRulesEngine
-if ![dataSource] {
- mutate {
- add_field => { "dataSource" => "%{host}" }
- }
-}
-#......................................................................#
-#Generating logx structure
- mutate {
- add_field => {"dataType" => "macos"}
- rename => ["message", "[logx][macos][message]"]
- }
-
-#Remove unwanted fields if the message not match with conditions
- mutate {
- remove_field => ["@version","original_log_message","headers"]
- }
-}
diff --git a/filters/macos/macos-syslog.yml b/filters/macos/macos-syslog.yml
new file mode 100644
index 000000000..71ac66c8b
--- /dev/null
+++ b/filters/macos/macos-syslog.yml
@@ -0,0 +1,22 @@
+pipeline:
+ - dataTypes:
+ - macos
+ steps:
+ # 1. Handle Agent Wrapper (Optional)
+ - grok:
+ source: raw
+ patterns:
+ - fieldName: log.wrapper_open
+ pattern: '\[utm_stack_agent_ds='
+ - fieldName: log.datasource_override
+ pattern: '{{.data}}'
+ - fieldName: log.wrapper_close
+ pattern: '\]-'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+
+ # 2. Cleanup
+ - delete:
+ fields: [log.wrapper_open, log.wrapper_close]
diff --git a/filters/netflow/netflow.yml b/filters/netflow/netflow.yml
index ce2266623..a92c36581 100644
--- a/filters/netflow/netflow.yml
+++ b/filters/netflow/netflow.yml
@@ -1,4 +1,4 @@
-# Netflow firewall module filter, version 3.0.1
+# Netflow firewall module filter, version 3.1.0
# Based in docs and Netflow Generator (Solarwinds) for send log
#
# Documentations
@@ -44,6 +44,103 @@ pipeline:
pattern: '{{.word}}(=)'
source: log.msg
+ # Using grok to parse fields that have issues with kv filter
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}bytes="\['
+ - fieldName: log.totalBytes
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant1
+ pattern: '{{.data}}packets="\['
+ - fieldName: log.totalPackets
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant2
+ pattern: '{{.data}}inEth="\['
+ - fieldName: log.inEthernet
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant3
+ pattern: '{{.data}}outEth="\['
+ - fieldName: log.outEthernet
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant4
+ pattern: '{{.data}}proto="\['
+ - fieldName: protocol
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant5
+ pattern: '{{.data}}srcPort="\['
+ - fieldName: log.srcPortg
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant6
+ pattern: '{{.data}}dstPort="\['
+ - fieldName: log.dstPortg
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant7
+ pattern: '{{.data}}dstMask="\['
+ - fieldName: log.destMask
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant8
+ pattern: '{{.data}}srcMask="\['
+ - fieldName: log.sourceMask
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant9
+ pattern: '{{.data}}tcpFlags="\['
+ - fieldName: log.tcpFlgs
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant10
+ pattern: '{{.data}}dstAs="\['
+ - fieldName: log.destAs
+ pattern: '{{.data}}\]"'
+ source: raw
+
+ - grok:
+ patterns:
+ - fieldName: log.irrelevant11
+ pattern: '{{.data}}srcAs="\['
+ - fieldName: log.sourceAs
+ pattern: '{{.data}}\]"'
+ source: raw
+
# Rename filds
- rename:
from:
@@ -63,11 +160,7 @@ pipeline:
to: target.ip
- rename:
from:
- - log.proto
- to: protocol
- - rename:
- from:
- - log.srcPort
+ - log.srcPortg
to: origin.port
- rename:
from:
@@ -75,8 +168,8 @@ pipeline:
to: origin.port
- rename:
from:
- - log.dstPort
- to: taget.port
+ - log.dstPortg
+ to: target.port
- rename:
from:
- log.dest_port
@@ -88,6 +181,55 @@ pipeline:
fields:
- origin.port
- target.port
+
+ # Removing unused caracters
+ - trim:
+ function: prefix
+ substring: '"'
+ fields:
+ - log.bytesIn
+ - log.bytesOut
+ - log.exporter
+ - log.first
+ - log.last
+ - log.nextHop
+ - log.packetsIn
+ - log.packetsOut
+ - log.version
+ - target.ip
+ - origin.ip
+ - trim:
+ function: suffix
+ substring: '"'
+ fields:
+ - log.bytesIn
+ - log.bytesOut
+ - log.exporter
+ - log.first
+ - log.last
+ - log.nextHop
+ - log.packetsIn
+ - log.packetsOut
+ - log.version
+ - target.ip
+ - origin.ip
+
+ - trim:
+ function: suffix
+ substring: ']"'
+ fields:
+ - log.totalBytes
+ - log.totalPackets
+ - log.inEthernet
+ - log.outEthernet
+ - protocol
+ - origin.port
+ - target.port
+ - log.destMask
+ - log.sourceMask
+ - log.tcpFlgs
+ - log.destAs
+ - log.sourceAs
# Adding geolocation to origin.ip
- dynamic:
@@ -103,4 +245,31 @@ pipeline:
params:
source: target.ip
destination: target.geolocation
- where: exists("target.ip")
\ No newline at end of file
+ where: exists("target.ip")
+
+ # Removing unused fields
+ - delete:
+ fields:
+ - log.bytes
+ - log.packets
+ - log.inEth
+ - log.outEth
+ - log.srcPort
+ - log.dstMask
+ - log.srcMask
+ - log.tcpFlags
+ - log.dstAs
+ - log.srcAs
+ - log.dstPort
+ - log.irrelevant
+ - log.irrelevant1
+ - log.irrelevant2
+ - log.irrelevant3
+ - log.irrelevant4
+ - log.irrelevant5
+ - log.irrelevant6
+ - log.irrelevant7
+ - log.irrelevant8
+ - log.irrelevant9
+ - log.irrelevant10
+ - log.irrelevant11
\ No newline at end of file
diff --git a/filters/office365/o365.yml b/filters/office365/o365.yml
index 742e0af55..c829fa0d4 100755
--- a/filters/office365/o365.yml
+++ b/filters/office365/o365.yml
@@ -1,4 +1,4 @@
-# Microsoft 365 filter, version 1.0.2
+# Microsoft 365 filter, version 1.0.3
# Based on Official documentation
# See https://learn.microsoft.com/en-us/compliance/assurance/assurance-microsoft-365-audit-log-collection
@@ -72,9 +72,29 @@ pipeline:
- log.UserId
to: origin.user
+ - rename:
+ from:
+ - log.Folder.Path
+ to: log.folderPath
+
+ - rename:
+ from:
+ - log.Folder.Id
+ to: log.folderId
+
+ - rename:
+ from:
+ - log.DestFolder.Id
+ to: log.destFolderId
+
+ - rename:
+ from:
+ - log.DestFolder.Path
+ to: log.destFolderPath
+
# Drop unnecessary events
- drop:
- where: "['SupervisionRuleMatch', 'SupervisoryReviewTag', 'ComplianceManagerAutomationChange', 'LabelContentExplorerAccessedItem', 'CreateCopilotPlugin', 'CreateCopilotPromptBook', 'DeleteCopilotPlugin', 'DeleteCopilotPromptBook', 'DisableCopilotPlugin', 'DisableCopilotPromptBook', 'EnableCopilotPlugin', 'EnableCopilotPromptBook', 'CopilotInteraction', 'UpdateCopilotPlugin', 'UpdateCopilotPromptBook', 'UpdateCopilotSettings', 'ApproveDisposal', 'ExtendRetention', 'RelabelItem', 'SearchUpdated', 'CaseUpdated', 'SearchPermissionUpdated', 'HoldUpdated', 'PreviewItemDownloaded', 'PreviewItemListed', 'SearchCreated', 'CaseAdded', 'HoldCreated', 'SearchRemoved', 'HoldRemoved', 'SearchExportDownloaded', 'SearchPreviewed', 'SearchResultsPurged', 'RemovedSearchResultsSentToZoom', 'RemovedSearchExported', 'RemovedSearchPreviewed', 'RemovedSearchResultsPurged', 'SearchReportRemoved', 'SearchResultsSentToZoom', 'SearchStarted', 'SearchExported', 'SearchReport', 'SearchStopped', 'SearchViewed', 'ViewedSearchExported', 'ViewedSearchPreviewed', 'AddRemediatedData', 'BurnJob', 'CreateWorkingSet', 'CreateWorkingSetSearch', 'CreateTag', 'DeleteWorkingSetSearch', 'DeleteTag', 'DownloadDocument', 'UpdateTag', 'ExportJob', 'UpdateWorkingSetSearch', 'PreviewWorkingSetSearch', 'ErrorRemediationJob', 'TagFiles', 'TagJob', 'ViewDocument', 'Copy', 'Create', 'ApplyRecordLabel', 'HardDelete', 'Send', 'Update', 'FileAccessed', 'FileAccessedExtended', 'ComplianceSettingChanged', 'LockRecord', 'UnlockRecord', 'FileCheckedIn', 'FileCheckedOut', 'FileCopied', 'FileDeletedFirstStageRecycleBin', 'FileDeletedSecondStageRecycleBin', 'RecordDelete', 'DocumentSensitivityMismatchDetected', 'FileCheckOutDiscarded', 'FileDownloaded', 'FileModifiedExtended', 'FilePreviewed', 'SearchQueryPerformed', 'FileRecycled', 'FolderRecycled', 'FileVersionsAllMinorsRecycled', 'FileVersionsAllRecycled', 'FileVersionRecycled', 'FileRestored', 'FileUploaded', 'PageViewed', 'PageViewedExtended', 'ClientViewSignaled', 'PagePrefetched', 'FolderCopied', 'FolderCreated', 'FolderDeletedFirstStageRecycleBin', 'FolderDeletedSecondStageRecycleBin', 'FolderRestored', 'InformationBarriersInsightsReportCompleted', 'InformationBarriersInsightsReportOneDriveSectionQueried', 'InformationBarriersInsightsReportSchedule', 'InformationBarriersInsightsReportSharePointSectionQueried', 'updateddeviceconfiguration', 'UpdatedPolicyConfigPriority', 'BackupPolicyActivated', 'RestoreTaskActivated', 'BackupItemAdded', 'BackupItemRemoved', 'RestoreTaskCompleted', 'DraftRestoreTaskCreated', 'NewBackupPolicyCreated', 'DraftRestoreTaskDeleted', 'DraftRestoreTaskEdited', 'BackupPolicyPaused', 'GetBackupItem', 'ViewBackupPolicyDetails', 'GetRestoreTaskDetails', 'ListAllBackupPolicies', 'ListAllBackupItemsInPolicies', 'ListAllBackupItemsInTenant', 'ListAllBackupItemsInWorkload', 'GetAllRestoreArtifactsInTask', 'ListAllRestorePoints', 'ListAllRestoreTasks', 'BackupItemRestoreCompleted', 'BackupItemRestoreTriggered', 'SetAdvancedFeatures', 'RunAntiVirusScan', 'LogsCollection', 'TaggingConfigurationUpdated', 'AlertExcelDownloaded', 'RemediationActionAdded', 'RemediationActionUpdated', 'SensorCreated', 'SensorDeploymentAccessKeyReceived', 'SensorDeploymentAccessKeyUpdated', 'SensorActivationMethodConfigurationUpdated', 'DomainControllerCoverageExcelDownloaded', 'MonitoringAlertUpdated', 'ReportDownloaded', 'AlertNotificationsRecipientAdded', 'MonitoringAlertNotificationRecipientAdded', 'WorkspaceCreated', 'AddCommentToIncident.', 'AssignUserToIncident', 'UpdateIncidentStatus', 'AddTagsToIncident', 'RemoveTagsFromIncident', 'CreateComment', 'CreateForm', 'MoveForm', 'ViewForm', 'PreviewForm', 'ExportForm', 'AllowShareFormForCopy', 'DisallowShareFormForCopy', 'AddFormCoauthor', 'RemoveFormCoauthor', 'ViewRuntimeForm', 'CreateResponse', 'UpdateResponse', 'ViewResponses', 'ViewResponse', 'GetSummaryLink', 'DeleteSummaryLink', 'ProInvitation', 'ListForms', 'SubmitResponse', 'ConnectToExcelWorkbook', 'CollectionCreated', 'CollectionUpdated', 'CollectionHardDeleted', 'CollectionSoftDeleted', 'CollectionRenamed', 'MovedFormIntoCollection', 'MovedFormOutofCollection', 'PlanCopied', 'TaskAssigned', 'TaskCompleted', 'PlanListRead', 'TaskListRead', 'ProjectCreated', 'RoadmapCreated', 'RoadmapItemCreated', 'TaskCreated', 'ProjectListAccessed', 'RoadmapAccessed', 'RoadmapItemAccessed', 'TaskAccessed', 'AuditSearchCreated', 'AuditSearchCompleted', 'AuditSearchCancelled', 'AuditSearchExportJobCreated', 'AuditSearchExportJobCompleted', 'AuditSearchExportResultsDownloaded', 'EntityCreated', 'ClassificationAdded', 'ClassificationDefinitionCreated', 'GlossaryTermAssigned', 'GlossaryTermCreated', 'BotAddedToTeam', 'ChannelAdded', 'ConnectorAdded', 'MeetingDetail', 'MeetingParticipantDetail', 'MemberAdded', 'TabAdded', 'SensitivityLabelApplied', 'SensitivityLabelChanged', 'ChatCreated', 'TeamCreated', 'MessageDeleted', 'MessageEditedHasLink', 'MessagesExported', 'RecordingExported', 'TranscriptsExported', 'FailedValidation', 'ChatRetrieved', 'MessageHostedContentsListed', 'PerformedCardAction', 'MessageSent', 'AINotesUpdate', 'LiveNotesUpdate', 'AppPublishedToCatalog', 'MessageRead', 'InviteeResponded', 'ChannelOwnerResponded', 'MessagesListed', 'MessageCreatedHasLink', 'MessageCreatedNotification', 'MessageDeletedNotification', 'MessageUpdatedNotification', 'InviteSent', 'SubscribedToMessages', 'AppUpdatedInCatalog', 'ChatUpdated', 'MessageUpdated', 'TabUpdated', 'AppUpgraded', 'MessageSent', 'ScheduleGroupAdded', 'ShiftAdded', 'TimeOffAdded', 'OpenShiftAdded', 'ScheduleShared', 'ClockedIn', 'ClockedOut', 'BreakEnded', 'TimeClockEntryAdded', 'RequestAdded', 'RequestRespondedTo', 'WorkforceIntegrationAdded', 'OffShiftDialogAccepted', 'CreateUpdateRequest', 'EditUpdateRequest', 'SubmitUpdate', 'ViewUpdate', 'AcceptedSharingLinkOnFolder', 'FolderSharingLinkShared', 'LinkedEntityCreated', 'SubTaskCreated', 'TaskCreated', 'TaskRead', 'TaskListCreated', 'TaskListRead', 'AccessedOdataLink', 'CanceledQuery', 'DeletedResult', 'DownloadedReport', 'ExecutedQuery', 'UploadedOrgData', 'ViewedExplore', 'QuarantineReleaseRequestDeny', 'QuarantinePreview', 'QuarantineReleaseRequest', 'QuarantineViewHeader', 'UpdateUsageReportsPrivacySetting', 'NewAdaptiveScope', 'NewComplianceTag', 'NewRetentionCompliancePolicy', 'RemoveAdaptiveScope', 'RemoveComplianceTag', 'SetRestrictiveRetentionUI', 'ExchangeDataProactivelyPreserved', 'SharePointDataProactivelyPreserved', 'ListCreated', 'ListColumnCreated', 'ListContentTypeCreated', 'ListItemCreated', 'SiteColumnCreated', 'SiteContentTypeCreated', 'ListContentTypeDeleted', 'SiteColumnDeleted', 'SiteContentTypeDeleted', 'ListItemRecycled', 'ListItemRestored', 'ListColumnUpdated', 'ListContentTypeUpdated', 'SiteColumnUpdated', 'SiteContentTypeUpdated', 'SharingInvitationCreated', 'AccessRequestUpdated', 'SharingInvitationUpdated', 'SharingInvitationRevoked', 'AllowedDataLocationAdded', 'SiteGeoMoveCancelled', 'MigrationJobCompleted', 'SiteGeoMoveCompleted', 'SiteCollectionCreated', 'HubSiteOrphanHubDeleted', 'PreviewModeEnabledSet', 'LegacyWorkflowEnabledSet', 'OfficeOnDemandSet', 'PeopleResultsScopeSet', 'NewsFeedEnabledSet', 'HubSiteJoined', 'SiteCollectionQuotaModified', 'HubSiteRegistered', 'SiteGeoMoveScheduled', 'GeoQuotaAllocated', 'SiteAdminChangeRequest', 'ManagedSyncClientAllowed', 'FileSyncDownloadedFull', 'FileSyncUploadedFull', 'DataShareCreated', 'DataShareDeleted', 'GenerateCopyOfLakeData', 'DownloadCopyOfLakeData', 'SoftDeleteSettingsUpdated', 'CloseConversation', 'OpenConversation', 'MessageCreation', 'MessageDeleted', 'FileDownloaded', 'DataExport', 'ThreadAccessFailure', 'MarkedMessageChanged', 'RemoveCuratedTopic', 'UsagePolicyAcceptance', 'AdminThreadMuted', 'AdminThreadUnmuted', 'FileUpdateDescription', 'MessageUpdated', 'FileVisited', 'ThreadViewed', 'PulseSubmit', 'PulseCreate', 'PulseExtendDeadline', 'PulseInvite', 'PulseCancel', 'PulseShareResults', 'PulseCreateDraft', 'PulseDeleteDraft'].exists_one(v, v == action)"
+ where: oneOf("action", ['SupervisionRuleMatch', 'SupervisoryReviewTag', 'ComplianceManagerAutomationChange', 'LabelContentExplorerAccessedItem', 'CreateCopilotPlugin', 'CreateCopilotPromptBook', 'DeleteCopilotPlugin', 'DeleteCopilotPromptBook', 'DisableCopilotPlugin', 'DisableCopilotPromptBook', 'EnableCopilotPlugin', 'EnableCopilotPromptBook', 'CopilotInteraction', 'UpdateCopilotPlugin', 'UpdateCopilotPromptBook', 'UpdateCopilotSettings', 'ApproveDisposal', 'ExtendRetention', 'RelabelItem', 'SearchUpdated', 'CaseUpdated', 'SearchPermissionUpdated', 'HoldUpdated', 'PreviewItemDownloaded', 'PreviewItemListed', 'SearchCreated', 'CaseAdded', 'HoldCreated', 'SearchRemoved', 'HoldRemoved', 'SearchExportDownloaded', 'SearchPreviewed', 'SearchResultsPurged', 'RemovedSearchResultsSentToZoom', 'RemovedSearchExported', 'RemovedSearchPreviewed', 'RemovedSearchResultsPurged', 'SearchReportRemoved', 'SearchResultsSentToZoom', 'SearchStarted', 'SearchExported', 'SearchReport', 'SearchStopped', 'SearchViewed', 'ViewedSearchExported', 'ViewedSearchPreviewed', 'AddRemediatedData', 'BurnJob', 'CreateWorkingSet', 'CreateWorkingSetSearch', 'CreateTag', 'DeleteWorkingSetSearch', 'DeleteTag', 'DownloadDocument', 'UpdateTag', 'ExportJob', 'UpdateWorkingSetSearch', 'PreviewWorkingSetSearch', 'ErrorRemediationJob', 'TagFiles', 'TagJob', 'ViewDocument', 'Copy', 'Create', 'ApplyRecordLabel', 'HardDelete', 'Send', 'Update', 'FileAccessed', 'FileAccessedExtended', 'ComplianceSettingChanged', 'LockRecord', 'UnlockRecord', 'FileCheckedIn', 'FileCheckedOut', 'FileCopied', 'FileDeletedFirstStageRecycleBin', 'FileDeletedSecondStageRecycleBin', 'RecordDelete', 'DocumentSensitivityMismatchDetected', 'FileCheckOutDiscarded', 'FileDownloaded', 'FileModifiedExtended', 'FilePreviewed', 'SearchQueryPerformed', 'FileRecycled', 'FolderRecycled', 'FileVersionsAllMinorsRecycled', 'FileVersionsAllRecycled', 'FileVersionRecycled', 'FileRestored', 'FileUploaded', 'PageViewed', 'PageViewedExtended', 'ClientViewSignaled', 'PagePrefetched', 'FolderCopied', 'FolderCreated', 'FolderDeletedFirstStageRecycleBin', 'FolderDeletedSecondStageRecycleBin', 'FolderRestored', 'InformationBarriersInsightsReportCompleted', 'InformationBarriersInsightsReportOneDriveSectionQueried', 'InformationBarriersInsightsReportSchedule', 'InformationBarriersInsightsReportSharePointSectionQueried', 'updateddeviceconfiguration', 'UpdatedPolicyConfigPriority', 'BackupPolicyActivated', 'RestoreTaskActivated', 'BackupItemAdded', 'BackupItemRemoved', 'RestoreTaskCompleted', 'DraftRestoreTaskCreated', 'NewBackupPolicyCreated', 'DraftRestoreTaskDeleted', 'DraftRestoreTaskEdited', 'BackupPolicyPaused', 'GetBackupItem', 'ViewBackupPolicyDetails', 'GetRestoreTaskDetails', 'ListAllBackupPolicies', 'ListAllBackupItemsInPolicies', 'ListAllBackupItemsInTenant', 'ListAllBackupItemsInWorkload', 'GetAllRestoreArtifactsInTask', 'ListAllRestorePoints', 'ListAllRestoreTasks', 'BackupItemRestoreCompleted', 'BackupItemRestoreTriggered', 'SetAdvancedFeatures', 'RunAntiVirusScan', 'LogsCollection', 'TaggingConfigurationUpdated', 'AlertExcelDownloaded', 'RemediationActionAdded', 'RemediationActionUpdated', 'SensorCreated', 'SensorDeploymentAccessKeyReceived', 'SensorDeploymentAccessKeyUpdated', 'SensorActivationMethodConfigurationUpdated', 'DomainControllerCoverageExcelDownloaded', 'MonitoringAlertUpdated', 'ReportDownloaded', 'AlertNotificationsRecipientAdded', 'MonitoringAlertNotificationRecipientAdded', 'WorkspaceCreated', 'AddCommentToIncident.', 'AssignUserToIncident', 'UpdateIncidentStatus', 'AddTagsToIncident', 'RemoveTagsFromIncident', 'CreateComment', 'CreateForm', 'MoveForm', 'ViewForm', 'PreviewForm', 'ExportForm', 'AllowShareFormForCopy', 'DisallowShareFormForCopy', 'AddFormCoauthor', 'RemoveFormCoauthor', 'ViewRuntimeForm', 'CreateResponse', 'UpdateResponse', 'ViewResponses', 'ViewResponse', 'GetSummaryLink', 'DeleteSummaryLink', 'ProInvitation', 'ListForms', 'SubmitResponse', 'ConnectToExcelWorkbook', 'CollectionCreated', 'CollectionUpdated', 'CollectionHardDeleted', 'CollectionSoftDeleted', 'CollectionRenamed', 'MovedFormIntoCollection', 'MovedFormOutofCollection', 'PlanCopied', 'TaskAssigned', 'TaskCompleted', 'PlanListRead', 'TaskListRead', 'ProjectCreated', 'RoadmapCreated', 'RoadmapItemCreated', 'TaskCreated', 'ProjectListAccessed', 'RoadmapAccessed', 'RoadmapItemAccessed', 'TaskAccessed', 'AuditSearchCreated', 'AuditSearchCompleted', 'AuditSearchCancelled', 'AuditSearchExportJobCreated', 'AuditSearchExportJobCompleted', 'AuditSearchExportResultsDownloaded', 'EntityCreated', 'ClassificationAdded', 'ClassificationDefinitionCreated', 'GlossaryTermAssigned', 'GlossaryTermCreated', 'BotAddedToTeam', 'ChannelAdded', 'ConnectorAdded', 'MeetingDetail', 'MeetingParticipantDetail', 'MemberAdded', 'TabAdded', 'SensitivityLabelApplied', 'SensitivityLabelChanged', 'ChatCreated', 'TeamCreated', 'MessageDeleted', 'MessageEditedHasLink', 'MessagesExported', 'RecordingExported', 'TranscriptsExported', 'FailedValidation', 'ChatRetrieved', 'MessageHostedContentsListed', 'PerformedCardAction', 'MessageSent', 'AINotesUpdate', 'LiveNotesUpdate', 'AppPublishedToCatalog', 'MessageRead', 'InviteeResponded', 'ChannelOwnerResponded', 'MessagesListed', 'MessageCreatedHasLink', 'MessageCreatedNotification', 'MessageDeletedNotification', 'MessageUpdatedNotification', 'InviteSent', 'SubscribedToMessages', 'AppUpdatedInCatalog', 'ChatUpdated', 'MessageUpdated', 'TabUpdated', 'AppUpgraded', 'MessageSent', 'ScheduleGroupAdded', 'ShiftAdded', 'TimeOffAdded', 'OpenShiftAdded', 'ScheduleShared', 'ClockedIn', 'ClockedOut', 'BreakEnded', 'TimeClockEntryAdded', 'RequestAdded', 'RequestRespondedTo', 'WorkforceIntegrationAdded', 'OffShiftDialogAccepted', 'CreateUpdateRequest', 'EditUpdateRequest', 'SubmitUpdate', 'ViewUpdate', 'AcceptedSharingLinkOnFolder', 'FolderSharingLinkShared', 'LinkedEntityCreated', 'SubTaskCreated', 'TaskCreated', 'TaskRead', 'TaskListCreated', 'TaskListRead', 'AccessedOdataLink', 'CanceledQuery', 'DeletedResult', 'DownloadedReport', 'ExecutedQuery', 'UploadedOrgData', 'ViewedExplore', 'QuarantineReleaseRequestDeny', 'QuarantinePreview', 'QuarantineReleaseRequest', 'QuarantineViewHeader', 'UpdateUsageReportsPrivacySetting', 'NewAdaptiveScope', 'NewComplianceTag', 'NewRetentionCompliancePolicy', 'RemoveAdaptiveScope', 'RemoveComplianceTag', 'SetRestrictiveRetentionUI', 'ExchangeDataProactivelyPreserved', 'SharePointDataProactivelyPreserved', 'ListCreated', 'ListColumnCreated', 'ListContentTypeCreated', 'ListItemCreated', 'SiteColumnCreated', 'SiteContentTypeCreated', 'ListContentTypeDeleted', 'SiteColumnDeleted', 'SiteContentTypeDeleted', 'ListItemRecycled', 'ListItemRestored', 'ListColumnUpdated', 'ListContentTypeUpdated', 'SiteColumnUpdated', 'SiteContentTypeUpdated', 'SharingInvitationCreated', 'AccessRequestUpdated', 'SharingInvitationUpdated', 'SharingInvitationRevoked', 'AllowedDataLocationAdded', 'SiteGeoMoveCancelled', 'MigrationJobCompleted', 'SiteGeoMoveCompleted', 'SiteCollectionCreated', 'HubSiteOrphanHubDeleted', 'PreviewModeEnabledSet', 'LegacyWorkflowEnabledSet', 'OfficeOnDemandSet', 'PeopleResultsScopeSet', 'NewsFeedEnabledSet', 'HubSiteJoined', 'SiteCollectionQuotaModified', 'HubSiteRegistered', 'SiteGeoMoveScheduled', 'GeoQuotaAllocated', 'SiteAdminChangeRequest', 'ManagedSyncClientAllowed', 'FileSyncDownloadedFull', 'FileSyncUploadedFull', 'DataShareCreated', 'DataShareDeleted', 'GenerateCopyOfLakeData', 'DownloadCopyOfLakeData', 'SoftDeleteSettingsUpdated', 'CloseConversation', 'OpenConversation', 'MessageCreation', 'MessageDeleted', 'FileDownloaded', 'DataExport', 'ThreadAccessFailure', 'MarkedMessageChanged', 'RemoveCuratedTopic', 'UsagePolicyAcceptance', 'AdminThreadMuted', 'AdminThreadUnmuted', 'FileUpdateDescription', 'MessageUpdated', 'FileVisited', 'ThreadViewed', 'PulseSubmit', 'PulseCreate', 'PulseExtendDeadline', 'PulseInvite', 'PulseCancel', 'PulseShareResults', 'PulseCreateDraft', 'PulseDeleteDraft'])
# Removing unused fields
- delete:
diff --git a/filters/paloalto/pa_cortex_xdr.conf b/filters/paloalto/pa_cortex_xdr.conf
deleted file mode 100644
index a954a7479..000000000
--- a/filters/paloalto/pa_cortex_xdr.conf
+++ /dev/null
@@ -1,470 +0,0 @@
-filter {
-
-# Palo Alto Cortex XDR filter version 2.0.0
-# Support Syslog CEF format and Syslog CSV format
-# Based on CORTEX XDR Pro Administrators Guide version 3.3
-# https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/logs/cortex-xdr-log-notification-formats (june, 2022)
-
- split {
- field => "message"
- terminator => ""
- }
-
- if ![dataType] {
- #First, search to define the entry point contain CEF:, contain |something, or look for Palo Alto
- #Also can be syslog CSV format
- if [message] and ( ( ("CEF:" in [message] or "LEEF:" in [message]) and [message] =~/\|(\w+)?(\s)?Palo(\s)Alto(\s)Networks(\s)?(\w+)?\|/ and [message] =~/\|(\w+)?(\s)?Cortex XDR(\s)?(\w+)?\|/ )
- or ( [message] =~/(threat)(\s)?,(.+),(\s)?(AgentActionReport|AgentDeviceControlViolation|AgentGenericMessage|AgentSamReport|AgentScanReport|AgentSecurityEvent|AgentStatistics|AgentTimelineEvent|ServerLogPerAgent|ServerLogPerTenant|ServerLogSystem)(\s)?,(.+),(\s)?(CYSTATUS_)(.+)/ )
- or (( [message] =~/(config)(\s)?,(\s)?(config)(\s)?,(.+),(\s)?(deviceManagement|distributionManagement|reportManagement|securityEventManagement|systemManagement)(\s)?,(.+)/ )
- or ( [message] =~/(config)(\s)?,(\s)?(policy)(\s)?,(.+),(\s)?(exceptionManagement|policyManagement|profileManagement|sam)(\s)?,(.+)/ )
- or ( [message] =~/(config)(\s)?,(\s)?(system)(\s)?,(.+),(\s)?(licensing|provisioning|tenant|userAuthentication|workerProcessing)(\s)?,(.+)/ )
- or ( [message] =~/(config)(\s)?,(\s)?(agent_log)(\s)?,(.+),(\s)?(agentFlow)(\s)?,(.+)/ ) )
- or (( [message] =~/(analytics)(\s)?,(\s)?(config)(\s)?,(.+),(\s)?(deviceManagement|distributionManagement|reportManagement|securityEventManagement|systemManagement)(\s)?,(.+)/ )
- or ( [message] =~/(analytics)(\s)?,(\s)?(policy)(\s)?,(.+),(\s)?(exceptionManagement|policyManagement|profileManagement|sam)(\s)?,(.+)/ )
- or ( [message] =~/(analytics)(\s)?,(\s)?(system)(\s)?,(.+),(\s)?(licensing|provisioning|tenant|userAuthentication|workerProcessing)(\s)?,(.+)/ )
- or ( [message] =~/(analytics)(\s)?,(\s)?(agent_log)(\s)?,(.+),(\s)?(agentFlow)(\s)?,(.+)/ ) )
- or (( [message] =~/(system)(\s)?,(\s)?(system)(\s)?,(.+),(\s)?(licensing|provisioning|tenant|userAuthentication|workerProcessing)(\s)?,(.+)/ ) ) ){
-#......................................................................#
-#Generating dataSource field required by CurrelationRulesEngine
-#Checks if exists, if not evaluate to the host variable
- if (![dataSource]){
- mutate {
- add_field => { "dataSource" => "%{host}" }
- }
- }
-#......................................................................#
-#Generating dataType field required by CurrelationRulesEngine
- mutate {
- add_field => { "dataType" => "paloalto-cortex-xdr" }
- }
-#......................................................................#
-#If CEF formatted log do the parsing of the message
- if ("CEF:" in [message] or "LEEF:" in [message]) {
-#......................................................................#
-#Using grok to parse header of the message
- grok {
- match => {
- "message" => [
- "(%{INT:not_defined})?(\s)?(<%{NUMBER:priority}>)?(%{INT:syslog_version})?((\s)%{GREEDYDATA:syslog_date_host}(\s))?(?(CEF|LEEF)):(\s)?(?(%{INT}\.%{INT}|%{INT}))%{GREEDYDATA:cef_or_leef_msg_all}"
- ]
- }
- }
-#......................................................................#
-#If CSV formatted log do the parsing of the message (Threat Logs)
- } else if ( [message] =~/(threat)(\s)?,(.+),(\s)?(AgentActionReport|AgentDeviceControlViolation|AgentGenericMessage|AgentSamReport|AgentScanReport|AgentSecurityEvent|AgentStatistics|AgentTimelineEvent|ServerLogPerAgent|ServerLogPerTenant|ServerLogSystem)(\s)?,(.+),(\s)?(CYSTATUS_)(.+)/ ) {
- csv {
- source => "message"
- skip_header => "true"
- columns => ["recordType", "class", "FUTURE_USE", "eventType", "generatedTime", "serverTime",
- "agentTime", "tzOffset", "FUTURE_USE", "facility", "customerId", "trapsId", "serverHost",
- "serverComponentVersion", "regionId", "isEndpoint", "agentId", "osType", "isVdi", "osVersion", "is64",
- "agentIp", "deviceName", "deviceDomain", "severity", "trapsSeverity", "agentVersion", "contentVersion",
- "protectionStatus", "preventionKey", "moduleId", "profile", "moduleStatusId", "verdict", "preventionMode",
- "terminate", "terminateTarget", "quarantine", "block", "postDetected", "eventParameters",
- "sourceProcessIdx", "targetProcessIdx", "fileIdx", "processes", "files",
- "users", "urls", "description"]
- }
-# Then, move fields to logx structure
- mutate {
- rename => { "[recordType]" => "[kv_field][recordType]" }
- rename => { "[class]" => "[kv_field][class]" }
- rename => { "[FUTURE_USE]" => "[kv_field][FUTURE_USE]" }
- rename => { "[eventType]" => "[kv_field][eventType]" }
- rename => { "[generatedTime]" => "[kv_field][generatedTime]" }
- rename => { "[serverTime]" => "[kv_field][serverTime]" }
- rename => { "[agentTime]" => "[kv_field][agentTime]" }
- rename => { "[tzOffset]" => "[kv_field][tzOffset]" }
- rename => { "[facility]" => "[kv_field][facility]" }
- rename => { "[customerId]" => "[kv_field][customerId]" }
- rename => { "[trapsId]" => "[kv_field][trapsId]" }
- rename => { "[serverHost]" => "[kv_field][serverHost]" }
- rename => { "[serverComponentVersion]" => "[kv_field][serverComponentVersion]" }
- rename => { "[regionId]" => "[kv_field][regionId]" }
- rename => { "[isEndpoint]" => "[kv_field][isEndpoint]" }
- rename => { "[agentId]" => "[kv_field][agentId]" }
- rename => { "[osType]" => "[kv_field][osType]" }
- rename => { "[isVdi]" => "[kv_field][isVdi]" }
- rename => { "[osVersion]" => "[kv_field][osVersion]" }
- rename => { "[is64]" => "[kv_field][is64]" }
- rename => { "[agentIp]" => "[kv_field][agentIp]" }
- rename => { "[deviceName]" => "[kv_field][deviceName]" }
- rename => { "[deviceDomain]" => "[kv_field][deviceDomain]" }
- rename => { "[severity]" => "[kv_field][severity]" }
- rename => { "[trapsSeverity]" => "[kv_field][trapsSeverity]" }
- rename => { "[agentVersion]" => "[kv_field][agentVersion]" }
- rename => { "[contentVersion]" => "[kv_field][contentVersion]" }
- rename => { "[protectionStatus]" => "[kv_field][protectionStatus]" }
- rename => { "[preventionKey]" => "[kv_field][preventionKey]" }
- rename => { "[moduleId]" => "[kv_field][moduleId]" }
- rename => { "[profile]" => "[kv_field][profile]" }
- rename => { "[moduleStatusId]" => "[kv_field][moduleStatusId]" }
- rename => { "[verdict]" => "[kv_field][verdict]" }
- rename => { "[preventionMode]" => "[kv_field][preventionMode]" }
- rename => { "[terminate]" => "[kv_field][terminate]" }
- rename => { "[terminateTarget]" => "[kv_field][terminateTarget]" }
- rename => { "[quarantine]" => "[kv_field][quarantine]" }
- rename => { "[block]" => "[kv_field][block]" }
- rename => { "[postDetected]" => "[kv_field][postDetected]" }
- rename => { "[eventParameters]" => "[kv_field][eventParameters]" }
- rename => { "[sourceProcessIdx]" => "[kv_field][sourceProcessIdx]" }
- rename => { "[targetProcessIdx]" => "[kv_field][targetProcessIdx]" }
- rename => { "[fileIdx]" => "[kv_field][fileIdx]" }
- rename => { "[processes]" => "[kv_field][processes]" }
- rename => { "[files]" => "[kv_field][files]" }
- rename => { "[users]" => "[kv_field][users]" }
- rename => { "[urls]" => "[kv_field][urls]" }
- rename => { "[description]" => "[kv_field][description]" }
- }
-#CSV formatted log do the parsing of the message (Config Logs)
- } else if ( [message] =~/(config)(\s)?,(\s)?(config)(\s)?,(.+),(\s)?(deviceManagement|distributionManagement|reportManagement|securityEventManagement|systemManagement)(\s)?,(.+)/ )
- or ( [message] =~/(config)(\s)?,(\s)?(policy)(\s)?,(.+),(\s)?(exceptionManagement|policyManagement|profileManagement|sam)(\s)?,(.+)/ )
- or ( [message] =~/(config)(\s)?,(\s)?(system)(\s)?,(.+),(\s)?(licensing|provisioning|tenant|userAuthentication|workerProcessing)(\s)?,(.+)/ )
- or ( [message] =~/(config)(\s)?,(\s)?(agent_log)(\s)?,(.+),(\s)?(agentFlow)(\s)?,(.+)/ ) {
- csv {
- source => "message"
- skip_header => "true"
- columns => ["recordType", "class", "FUTURE_USE", "subClassId", "eventType", "eventCategory",
- "generatedTime", "serverTime", "FUTURE_USE", "facility", "customerId", "trapsId", "serverHost",
- "serverComponentVersion", "regionId", "isEndpoint", "severity", "trapsSeverity", "messageCode",
- "friendlyName", "FUTURE_USE", "msgTextEn", "userFullName", "userName", "userRole", "userDomain",
- "additionalData", "messageCode2", "errorText", "errorData", "resultData"
- ]
- }
-# Then, move fields to logx structure
- mutate {
- rename => { "[recordType]" => "[kv_field][recordType]" }
- rename => { "[class]" => "[kv_field][class]" }
- rename => { "[FUTURE_USE]" => "[kv_field][FUTURE_USE]" }
- rename => { "[subClassId]" => "[kv_field][subClassId]" }
- rename => { "[eventType]" => "[kv_field][eventType]" }
- rename => { "[eventCategory]" => "[kv_field][eventCategory]" }
- rename => { "[generatedTime]" => "[kv_field][generatedTime]" }
- rename => { "[serverTime]" => "[kv_field][serverTime]" }
- rename => { "[facility]" => "[kv_field][facility]" }
- rename => { "[customerId]" => "[kv_field][customerId]" }
- rename => { "[trapsId]" => "[kv_field][trapsId]" }
- rename => { "[serverHost]" => "[kv_field][serverHost]" }
- rename => { "[serverComponentVersion]" => "[kv_field][serverComponentVersion]" }
- rename => { "[regionId]" => "[kv_field][regionId]" }
- rename => { "[isEndpoint]" => "[kv_field][isEndpoint]" }
- rename => { "[severity]" => "[kv_field][severity]" }
- rename => { "[trapsSeverity]" => "[kv_field][trapsSeverity]" }
- rename => { "[messageCode]" => "[kv_field][messageCode]" }
- rename => { "[friendlyName]" => "[kv_field][friendlyName]" }
- rename => { "[msgTextEn]" => "[kv_field][msgTextEn]" }
- rename => { "[userFullName]" => "[kv_field][userFullName]" }
- rename => { "[userName]" => "[kv_field][userName]" }
- rename => { "[userRole]" => "[kv_field][userRole]" }
- rename => { "[userDomain]" => "[kv_field][userDomain]" }
- rename => { "[additionalData]" => "[kv_field][additionalData]" }
- rename => { "[messageCode2]" => "[kv_field][messageCode2]" }
- rename => { "[errorText]" => "[kv_field][errorText]" }
- rename => { "[errorData]" => "[kv_field][errorData]" }
- rename => { "[resultData]" => "[kv_field][resultData]" }
- }
-#CSV formatted log do the parsing of the message (Analytics Logs)
- } else if ( [message] =~/(analytics)(\s)?,(\s)?(config)(\s)?,(.+),(\s)?(deviceManagement|distributionManagement|reportManagement|securityEventManagement|systemManagement)(\s)?,(.+)/ )
- or ( [message] =~/(analytics)(\s)?,(\s)?(policy)(\s)?,(.+),(\s)?(exceptionManagement|policyManagement|profileManagement|sam)(\s)?,(.+)/ )
- or ( [message] =~/(analytics)(\s)?,(\s)?(system)(\s)?,(.+),(\s)?(licensing|provisioning|tenant|userAuthentication|workerProcessing)(\s)?,(.+)/ )
- or ( [message] =~/(analytics)(\s)?,(\s)?(agent_log)(\s)?,(.+),(\s)?(agentFlow)(\s)?,(.+)/ ) {
- csv {
- source => "message"
- skip_header => "true"
- columns => ["recordType", "class", "FUTURE_USE", "eventType", "eventCategory", "generatedTime",
- "serverTime", "agentTime", "tzOffset", "FUTURE_USE", "facility", "customerId", "trapsId", "serverHost",
- "serverComponentVersion", "regionId", "isEndpoint", "agentId", "osType", "isVdi", "osVersion", "is64",
- "agentIp", "deviceName", "deviceDomain", "severity", "agentVersion", "contentVersion",
- "protectionStatus", "sha256", "type", "parentSha256", "lastSeen", "fileName", "filePath",
- "fileSize", "localAnalysisResult", "reported", "blocked", "executionCount"
- ]
- }
-# Then, move fields to logx structure
- mutate {
- rename => { "[recordType]" => "[kv_field][recordType]" }
- rename => { "[class]" => "[kv_field][class]" }
- rename => { "[FUTURE_USE]" => "[kv_field][FUTURE_USE]" }
- rename => { "[eventType]" => "[kv_field][eventType]" }
- rename => { "[eventCategory]" => "[kv_field][eventCategory]" }
- rename => { "[generatedTime]" => "[kv_field][generatedTime]" }
- rename => { "[serverTime]" => "[kv_field][serverTime]" }
- rename => { "[agentTime]" => "[kv_field][agentTime]" }
- rename => { "[tzOffset]" => "[kv_field][tzOffset]" }
- rename => { "[facility]" => "[kv_field][facility]" }
- rename => { "[customerId]" => "[kv_field][customerId]" }
- rename => { "[trapsId]" => "[kv_field][trapsId]" }
- rename => { "[serverHost]" => "[kv_field][serverHost]" }
- rename => { "[serverComponentVersion]" => "[kv_field][serverComponentVersion]" }
- rename => { "[regionId]" => "[kv_field][regionId]" }
- rename => { "[isEndpoint]" => "[kv_field][isEndpoint]" }
- rename => { "[agentId]" => "[kv_field][agentId]" }
- rename => { "[osType]" => "[kv_field][osType]" }
- rename => { "[isVdi]" => "[kv_field][isVdi]" }
- rename => { "[osVersion]" => "[kv_field][osVersion]" }
- rename => { "[is64]" => "[kv_field][is64]" }
- rename => { "[agentIp]" => "[kv_field][agentIp]" }
- rename => { "[deviceName]" => "[kv_field][deviceName]" }
- rename => { "[deviceDomain]" => "[kv_field][deviceDomain]" }
- rename => { "[severity]" => "[kv_field][severity]" }
- rename => { "[agentVersion]" => "[kv_field][agentVersion]" }
- rename => { "[contentVersion]" => "[kv_field][contentVersion]" }
- rename => { "[protectionStatus]" => "[kv_field][protectionStatus]" }
- rename => { "[sha256]" => "[kv_field][sha256]" }
- rename => { "[type]" => "[kv_field][type]" }
- rename => { "[parentSha256]" => "[kv_field][parentSha256]" }
- rename => { "[lastSeen]" => "[kv_field][lastSeen]" }
- rename => { "[fileName]" => "[kv_field][fileName]" }
- rename => { "[filePath]" => "[kv_field][filePath]" }
- rename => { "[fileSize]" => "[kv_field][fileSize]" }
- rename => { "[localAnalysisResult]" => "[kv_field][localAnalysisResult]" }
- rename => { "[reported]" => "[kv_field][reported]" }
- rename => { "[blocked]" => "[kv_field][blocked]" }
- rename => { "[executionCount]" => "[kv_field][executionCount]" }
- }
-#CSV formatted log do the parsing of the message (System Logs)
- } else if ( [message] =~/(system)(\s)?,(\s)?(system)(\s)?,(.+),(\s)?(licensing|provisioning|tenant|userAuthentication|workerProcessing)(\s)?,(.+)/ ) {
- csv {
- source => "message"
- skip_header => "true"
- columns => ["recordType", "class", "FUTURE_USE", "subClassId", "eventType", "eventCategory",
- "generatedTime", "serverTime", "FUTURE_USE", "facility", "customerId", "trapsId", "serverHost",
- "serverComponentVersion", "regionId", "isEndpoint", "agentId", "severity", "trapsSeverity", "messageCode",
- "friendlyName", "FUTURE_USE", "msgTextEn", "userFullName", "username", "userRole", "userDomain",
- "agentTime", "tzOffset", "osType", "isVdi", "osVersion", "is64", "agentIp", "deviceName", "deviceDomain",
- "agentVersion", "contentVersion", "protectionStatus", "userFullName2", "username2", "userRole2", "userDomain2",
- "messageName", "messageId", "processStatus", "errorText", "errorData", "resultData", "parameters",
- "additionalData"
- ]
- }
-# Then, move fields to logx structure
- mutate {
- rename => { "[recordType]" => "[kv_field][recordType]" }
- rename => { "[class]" => "[kv_field][class]" }
- rename => { "[FUTURE_USE]" => "[kv_field][FUTURE_USE]" }
- rename => { "[subClassId]" => "[kv_field][subClassId]" }
- rename => { "[eventType]" => "[kv_field][eventType]" }
- rename => { "[eventCategory]" => "[kv_field][eventCategory]" }
- rename => { "[generatedTime]" => "[kv_field][generatedTime]" }
- rename => { "[serverTime]" => "[kv_field][serverTime]" }
- rename => { "[facility]" => "[kv_field][facility]" }
- rename => { "[customerId]" => "[kv_field][customerId]" }
- rename => { "[trapsId]" => "[kv_field][trapsId]" }
- rename => { "[serverHost]" => "[kv_field][serverHost]" }
- rename => { "[serverComponentVersion]" => "[kv_field][serverComponentVersion]" }
- rename => { "[regionId]" => "[kv_field][regionId]" }
- rename => { "[isEndpoint]" => "[kv_field][isEndpoint]" }
- rename => { "[agentId]" => "[kv_field][agentId]" }
- rename => { "[severity]" => "[kv_field][severity]" }
- rename => { "[trapsSeverity]" => "[kv_field][trapsSeverity]" }
- rename => { "[messageCode]" => "[kv_field][messageCode]" }
- rename => { "[friendlyName]" => "[kv_field][friendlyName]" }
- rename => { "[msgTextEn]" => "[kv_field][msgTextEn]" }
- rename => { "[userFullName]" => "[kv_field][userFullName]" }
- rename => { "[username]" => "[kv_field][username]" }
- rename => { "[userRole]" => "[kv_field][userRole]" }
- rename => { "[userDomain]" => "[kv_field][userDomain]" }
- rename => { "[agentTime]" => "[kv_field][agentTime]" }
- rename => { "[tzOffset]" => "[kv_field][tzOffset]" }
- rename => { "[osType]" => "[kv_field][osType]" }
- rename => { "[isVdi]" => "[kv_field][isVdi]" }
- rename => { "[osVersion]" => "[kv_field][osVersion]" }
- rename => { "[is64]" => "[kv_field][is64]" }
- rename => { "[agentIp]" => "[kv_field][agentIp]" }
- rename => { "[deviceName]" => "[kv_field][deviceName]" }
- rename => { "[deviceDomain]" => "[kv_field][deviceDomain]" }
- rename => { "[agentVersion]" => "[kv_field][agentVersion]" }
- rename => { "[contentVersion]" => "[kv_field][contentVersion]" }
- rename => { "[protectionStatus]" => "[kv_field][protectionStatus]" }
- rename => { "[userFullName2]" => "[kv_field][userFullName2]" }
- rename => { "[username2]" => "[kv_field][username2]" }
- rename => { "[userRole2]" => "[kv_field][userRole2]" }
- rename => { "[userDomain2]" => "[kv_field][userDomain2]" }
- rename => { "[messageName]" => "[kv_field][messageName]" }
- rename => { "[messageId]" => "[kv_field][messageId]" }
- rename => { "[processStatus]" => "[kv_field][processStatus]" }
- rename => { "[errorText]" => "[kv_field][errorText]" }
- rename => { "[errorData]" => "[kv_field][errorData]" }
- rename => { "[resultData]" => "[kv_field][resultData]" }
- rename => { "[parameters]" => "[kv_field][parameters]" }
- rename => { "[additionalData]" => "[kv_field][additionalData]" }
-
- }
-
- }
- if ("CEF:" in [message] ) {
-#......................................................................#
-#Logs have different structure according to CORTEX XDR Log Types, so first, define Log Type
-#Using grok to parse components of the cef_message
-#......................................................................#
-
- if ([cef_or_leef_msg_all]){
- grok {
- match => {
- "cef_or_leef_msg_all" => [
- "\|%{DATA:embDeviceVendor}\|%{DATA:embDeviceProduct}\|%{DATA:embDeviceVersion}\|%{DATA:embDeviceEventClass}\|%{DATA:act_msg}\|%{DATA:severity}\|%{GREEDYDATA:cef_or_leef_msg}"
- ]
- }
- }
-
-#......................................................................#
-#Using grok to parse individual fields
- grok { match => { "cef_or_leef_msg" => ["act=%{DATA:act} %{WORD}=","act=%{GREEDYDATA:act}"] } }
- grok { match => { "cef_or_leef_msg" => ["cat=%{DATA:cat} %{WORD}=","cat=%{GREEDYDATA:cat}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs1=%{DATA:cs1} %{WORD}=","cs1=%{GREEDYDATA:cs1}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs1Label=%{DATA:cs1Label} %{WORD}=","cs1Label=%{GREEDYDATA:cs1Label}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs2=%{DATA:cs2} %{WORD}=","cs2=%{GREEDYDATA:cs2}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs2Label=%{DATA:cs2Label} %{WORD}=","cs2Label=%{GREEDYDATA:cs2Label}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs3=%{DATA:cs3} %{WORD}=","cs3=%{GREEDYDATA:cs3}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs3Label=%{DATA:cs3Label} %{WORD}=","cs3Label=%{GREEDYDATA:cs3Label}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs4=%{DATA:cs4} %{WORD}=","cs4=%{GREEDYDATA:cs4}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs4Label=%{DATA:cs4Label} %{WORD}=","cs4Label=%{GREEDYDATA:cs4Label}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs5=%{DATA:cs5} %{WORD}=","cs5=%{GREEDYDATA:cs5}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs5Label=%{DATA:cs5Label} %{WORD}=","cs5Label=%{GREEDYDATA:cs5Label}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs6=%{DATA:cs6} %{WORD}=","cs6=%{GREEDYDATA:cs6}"] } }
- grok { match => { "cef_or_leef_msg" => ["cs6Label=%{DATA:cs6Label} %{WORD}=","cs6Label=%{GREEDYDATA:cs6Label}"] } }
- grok { match => { "cef_or_leef_msg" => ["CSPaccountname=%{DATA:CSPaccountname} %{WORD}=","CSPaccountname=%{GREEDYDATA:CSPaccountname}"] } }
- grok { match => { "cef_or_leef_msg" => ["deviceFacility=%{DATA:deviceFacility} %{WORD}=","deviceFacility=%{GREEDYDATA:deviceFacility}"] } }
- grok { match => { "cef_or_leef_msg" => ["dpt=%{DATA:dpt} %{WORD}=","dpt=%{GREEDYDATA:dpt}"] } }
- grok { match => { "cef_or_leef_msg" => ["dst=%{DATA:dst} %{WORD}=","dst=%{GREEDYDATA:dst}"] } }
- grok { match => { "cef_or_leef_msg" => ["dvchost=%{DATA:dvchost} %{WORD}=","dvchost=%{GREEDYDATA:dvchost}"] } }
- grok { match => { "cef_or_leef_msg" => ["end=%{DATA:end} %{WORD}=","end=%{GREEDYDATA:end}"] } }
- grok { match => { "cef_or_leef_msg" => ["externalId=%{DATA:externalId} %{WORD}=","externalId=%{GREEDYDATA:externalId}"] } }
- grok { match => { "cef_or_leef_msg" => ["fileHash=%{DATA:fileHash} %{WORD}=","fileHash=%{GREEDYDATA:fileHash}"] } }
- grok { match => { "cef_or_leef_msg" => ["filePath=%{DATA:filePath} %{WORD}=","filePath=%{GREEDYDATA:filePath}"] } }
- grok { match => { "cef_or_leef_msg" => ["incident=%{DATA:incident} %{WORD}=","incident=%{GREEDYDATA:incident}"] } }
- grok { match => { "cef_or_leef_msg" => ["initiatorPath=%{DATA:initiatorPath} %{WORD}=","initiatorPath=%{GREEDYDATA:initiatorPath}"] } }
- grok { match => { "cef_or_leef_msg" => ["initiatorSha256=%{DATA:initiatorSha256} %{WORD}=","initiatorSha256=%{GREEDYDATA:initiatorSha256}"] } }
- grok { match => { "cef_or_leef_msg" => ["msg=%{DATA:msg} %{WORD}=","msg=%{GREEDYDATA:msg}"] } }
- grok { match => { "cef_or_leef_msg" => ["osParentCmd=%{DATA:osParentCmd} %{WORD}=","osParentCmd=%{GREEDYDATA:osParentCmd}"] } }
- grok { match => { "cef_or_leef_msg" => ["osParentName=%{DATA:osParentName} %{WORD}=","osParentName=%{GREEDYDATA:osParentName}"] } }
- grok { match => { "cef_or_leef_msg" => ["osParentSha256=%{DATA:osParentSha256} %{WORD}=","osParentSha256=%{GREEDYDATA:osParentSha256}"] } }
- grok { match => { "cef_or_leef_msg" => ["osParentSignature=%{DATA:osParentSignature} %{WORD}=","osParentSignature=%{GREEDYDATA:osParentSignature}"] } }
- grok { match => { "cef_or_leef_msg" => ["osParentSigner=%{DATA:osParentSigner} %{WORD}=","osParentSigner=%{GREEDYDATA:osParentSigner}"] } }
- grok { match => { "cef_or_leef_msg" => ["request=%{DATA:request} %{WORD}=","request=%{GREEDYDATA:request}"] } }
- grok { match => { "cef_or_leef_msg" => ["rt=%{DATA:rt} %{WORD}=","rt=%{GREEDYDATA:rt}"] } }
- grok { match => { "cef_or_leef_msg" => ["shost=%{DATA:shost} %{WORD}=","shost=%{GREEDYDATA:shost}"] } }
- grok { match => { "cef_or_leef_msg" => ["spt=%{DATA:spt} %{WORD}=","spt=%{GREEDYDATA:spt}"] } }
- grok { match => { "cef_or_leef_msg" => ["src=%{DATA:src} %{WORD}=","src=%{GREEDYDATA:src}"] } }
- grok { match => { "cef_or_leef_msg" => ["suser=%{DATA:suser} %{WORD}=","suser=%{GREEDYDATA:suser}"] } }
- grok { match => { "cef_or_leef_msg" => ["targetprocesssignature=%{DATA:targetprocesssignature} %{WORD}=","targetprocesssignature=%{GREEDYDATA:targetprocesssignature}"] } }
- grok { match => { "cef_or_leef_msg" => ["tenantCDLid=%{DATA:tenantCDLid} %{WORD}=","tenantCDLid=%{GREEDYDATA:tenantCDLid}"] } }
- grok { match => { "cef_or_leef_msg" => ["tenantname=%{DATA:tenantname} %{WORD}=","tenantname=%{GREEDYDATA:tenantname}"] } }
-
- #......................................................................#
- #First, replace whitespaces with default string after = to avoid issues, example:
-
- mutate {
- gsub => [
- "cef_or_leef_msg", "(\w+)= ", "\1=X0X "
- ]
- }
- mutate {
- #Rename fields (individual groks)
- rename => { "[act]" => "[kv_field][act]" }
- rename => { "[cat]" => "[kv_field][cat]" }
- rename => { "[cs1]" => "[kv_field][cs1]" }
- rename => { "[cs1Label]" => "[kv_field][cs1Label]" }
- rename => { "[cs2]" => "[kv_field][cs2]" }
- rename => { "[cs2Label]" => "[kv_field][cs2Label]" }
- rename => { "[cs3]" => "[kv_field][cs3]" }
- rename => { "[cs3Label]" => "[kv_field][cs3Label]" }
- rename => { "[cs4]" => "[kv_field][cs4]" }
- rename => { "[cs4Label]" => "[kv_field][cs4Label]" }
- rename => { "[cs5]" => "[kv_field][cs5]" }
- rename => { "[cs5Label]" => "[kv_field][cs5Label]" }
- rename => { "[cs6]" => "[kv_field][cs6]" }
- rename => { "[cs6Label]" => "[kv_field][cs6Label]" }
- rename => { "[CSPaccountname]" => "[kv_field][CSPaccountname]" }
- rename => { "[deviceFacility]" => "[kv_field][deviceFacility]" }
- rename => { "[dpt]" => "[kv_field][dpt]" }
- rename => { "[dst]" => "[kv_field][dst]" }
- rename => { "[dvchost]" => "[kv_field][dvchost]" }
- rename => { "[end]" => "[kv_field][end]" }
- rename => { "[externalId]" => "[kv_field][externalId]" }
- rename => { "[fileHash]" => "[kv_field][fileHash]" }
- rename => { "[filePath]" => "[kv_field][filePath]" }
- rename => { "[incident]" => "[kv_field][incident]" }
- rename => { "[initiatorPath]" => "[kv_field][initiatorPath]" }
- rename => { "[initiatorSha256]" => "[kv_field][initiatorSha256]" }
- rename => { "[msg]" => "[kv_field][msg]" }
- rename => { "[osParentCmd]" => "[kv_field][osParentCmd]" }
- rename => { "[osParentName]" => "[kv_field][osParentName]" }
- rename => { "[osParentSha256]" => "[kv_field][osParentSha256]" }
- rename => { "[osParentSignature]" => "[kv_field][osParentSignature]" }
- rename => { "[osParentSigner]" => "[kv_field][osParentSigner]" }
- rename => { "[request]" => "[kv_field][request]" }
- rename => { "[rt]" => "[kv_field][rt]" }
- rename => { "[shost]" => "[kv_field][shost]" }
- rename => { "[spt]" => "[kv_field][spt]" }
- rename => { "[src]" => "[kv_field][src]" }
- rename => { "[suser]" => "[kv_field][suser]" }
- rename => { "[targetprocesssignature]" => "[kv_field][targetprocesssignature]" }
- rename => { "[tenantCDLid]" => "[kv_field][tenantCDLid]" }
- rename => { "[tenantname]" => "[kv_field][tenantname]" }
- }
- }
- }
-#......................................................................#
-#Add standard fields to the tree structure
-#......................................................................#
- mutate {
- #Rename the fileds
- rename => { "[embDeviceVendor]" => "[kv_field][embDeviceVendor]" }
- rename => { "[embDeviceProduct]" => "[kv_field][embDeviceProduct]" }
- rename => { "[format_version]" => "[kv_field][format_version]" }
- rename => { "[format_type]" => "[kv_field][format_type]" }
- rename => { "[embDeviceVersion]" => "[kv_field][embDeviceVersion]" }
- rename => { "[priority]" => "[kv_field][priority]" }
- rename => { "[severity]" => "[kv_field][severity]" }
- rename => { "[embDeviceEventClass]" => "[kv_field][embDeviceEventClass]" }
- rename => { "[act_msg]" => "[kv_field][act_msg]" }
- rename => { "[message]" => "[kv_field][message]" }
- }
-
-#......................................................................#
-#Correlation standard fields
-#......................................................................#
- #src can be in multiple fields
- if [kv_field][src] {
- mutate {
- rename => { "[kv_field][src]" => "[kv_field][src_ip]" }
- }
- }
-
- mutate {
- rename => { "[kv_field][dst]" => "[kv_field][dest_ip]" }
- rename => { "[kv_field][spt]" => "[kv_field][src_port]" }
- rename => { "[kv_field][dpt]" => "[kv_field][dest_port]" }
- }
-
-#......................................................................#
-#Set null the fields with de X0X value (default string for null), and replace simple and double quotation
-#also generate logx tree structure dynamically
- if [kv_field] {
- ruby {
- code => '
- event.get("[kv_field]").each do |k, v|
- if (v == "X0X")
- event.set("[logx][paloalto_cortex_xdr][#{k}]",nil)
- elsif (k=~/(\W)$/)
- event.remove(k)
- elsif !(v.kind_of?(Array))
- new_v = v.to_s.gsub(/\"/, "")
- new_v = new_v.gsub(/\'/, "")
- event.set("[logx][paloalto_cortex_xdr][#{k}]",new_v)
- else
- event.set("[logx][paloalto_cortex_xdr][#{k}]",v)
- end
- end
- '
- }
- }
-#......................................................................#
- #Finally, remove unnecessary fields
- mutate {
- remove_field => ["@version","path","tags","type","syslog_version","kv_field",
- "not_defined","cef_or_leef_msg_all","cef_or_leef_msg","syslog_date_host",
- "irrelevant","init_msg","[logx][paloalto_cortex_xdr][FUTURE_USE]"]
- }
- }
- }
-}
diff --git a/filters/paloalto/pa_cortex_xdr.yml b/filters/paloalto/pa_cortex_xdr.yml
new file mode 100644
index 000000000..81a664a47
--- /dev/null
+++ b/filters/paloalto/pa_cortex_xdr.yml
@@ -0,0 +1,295 @@
+pipeline:
+ - dataTypes:
+ - paloalto-cortex-xdr
+ steps:
+ # ==================================================================================
+ # 1. CEF / LEEF Handling
+ # ==================================================================================
+ - grok:
+ source: raw
+ where: 'contains(raw, "CEF:") || contains(raw, "LEEF:")'
+ patterns:
+ - fieldName: log.format_type
+ pattern: '{{.word}}' # Extracts CEF or LEEF
+ - fieldName: log.ignore
+ pattern: ':'
+ - fieldName: log.format_version
+ pattern: '{{.data}}' # Extracts version until next |
+ - fieldName: log.ignore
+ pattern: '\|'
+ - fieldName: log.vendor
+ pattern: '{{.data}}'
+ - fieldName: log.ignore
+ pattern: '\|'
+ - fieldName: log.product
+ pattern: '{{.data}}'
+ - fieldName: log.ignore
+ pattern: '\|'
+ - fieldName: log.device_version
+ pattern: '{{.data}}'
+ - fieldName: log.ignore
+ pattern: '\|'
+ - fieldName: log.event_class
+ pattern: '{{.data}}'
+ - fieldName: log.ignore
+ pattern: '\|'
+ - fieldName: log.name
+ pattern: '{{.data}}'
+ - fieldName: log.ignore
+ pattern: '\|'
+ - fieldName: log.severity
+ pattern: '{{.data}}'
+ - fieldName: log.ignore
+ pattern: '\|'
+ - fieldName: log.extension
+ pattern: '{{.greedy}}'
+
+ - kv:
+ source: log.extension
+ where: 'exists("log.extension")'
+ fieldSplit: " "
+ valueSplit: "="
+
+ # Cleanup CEF fields
+ - delete:
+ fields: [log.ignore]
+
+ # ==================================================================================
+ # 2. CSV Handling - Threat Logs
+ # ==================================================================================
+ # Regex: (threat)(\s)?,...
+ - csv:
+ source: raw
+ where: 'regexMatch(raw, "^(threat)(\\s)?,.*")'
+ separator: ","
+ headers:
+ - log.recordType
+ - log.class
+ - log.FUTURE_USE
+ - log.eventType
+ - log.generatedTime
+ - log.serverTime
+ - log.agentTime
+ - log.tzOffset
+ - log.FUTURE_USE_2
+ - log.facility
+ - log.customerId
+ - log.trapsId
+ - log.serverHost
+ - log.serverComponentVersion
+ - log.regionId
+ - log.isEndpoint
+ - log.agentId
+ - log.osType
+ - log.isVdi
+ - log.osVersion
+ - log.is64
+ - log.agentIp
+ - log.deviceName
+ - log.deviceDomain
+ - log.severity
+ - log.trapsSeverity
+ - log.agentVersion
+ - log.contentVersion
+ - log.protectionStatus
+ - log.preventionKey
+ - log.moduleId
+ - log.profile
+ - log.moduleStatusId
+ - log.verdict
+ - log.preventionMode
+ - log.terminate
+ - log.terminateTarget
+ - log.quarantine
+ - log.block
+ - log.postDetected
+ - log.eventParameters
+ - log.sourceProcessIdx
+ - log.targetProcessIdx
+ - log.fileIdx
+ - log.processes
+ - log.files
+ - log.users
+ - log.urls
+ - log.description
+
+ # ==================================================================================
+ # 3. CSV Handling - Config / Policy / System Management
+ # ==================================================================================
+ # Regex: ^(config|system),.*
+ # Note: The conf groups these together for Config Logs + System Logs separate.
+ # Config Logs column mapping:
+ - csv:
+ source: raw
+ where: 'regexMatch(raw, "^config,.*")'
+ separator: ","
+ headers:
+ - log.recordType
+ - log.class
+ - log.FUTURE_USE
+ - log.subClassId
+ - log.eventType
+ - log.eventCategory
+ - log.generatedTime
+ - log.serverTime
+ - log.FUTURE_USE_2
+ - log.facility
+ - log.customerId
+ - log.trapsId
+ - log.serverHost
+ - log.serverComponentVersion
+ - log.regionId
+ - log.isEndpoint
+ - log.severity
+ - log.trapsSeverity
+ - log.messageCode
+ - log.friendlyName
+ - log.FUTURE_USE_3
+ - log.msgTextEn
+ - log.userFullName
+ - log.userName
+ - log.userRole
+ - log.userDomain
+ - log.additionalData
+ - log.messageCode2
+ - log.errorText
+ - log.errorData
+ - log.resultData
+
+ # ==================================================================================
+ # 4. CSV Handling - Analytics Logs
+ # ==================================================================================
+ - csv:
+ source: raw
+ where: 'regexMatch(raw, "^analytics,.*")'
+ separator: ","
+ headers:
+ - log.recordType
+ - log.class
+ - log.FUTURE_USE
+ - log.eventType
+ - log.eventCategory
+ - log.generatedTime
+ - log.serverTime
+ - log.agentTime
+ - log.tzOffset
+ - log.FUTURE_USE_2
+ - log.facility
+ - log.customerId
+ - log.trapsId
+ - log.serverHost
+ - log.serverComponentVersion
+ - log.regionId
+ - log.isEndpoint
+ - log.agentId
+ - log.osType
+ - log.isVdi
+ - log.osVersion
+ - log.is64
+ - log.agentIp
+ - log.deviceName
+ - log.deviceDomain
+ - log.severity
+ - log.agentVersion
+ - log.contentVersion
+ - log.protectionStatus
+ - log.sha256
+ - log.type
+ - log.parentSha256
+ - log.lastSeen
+ - log.fileName
+ - log.filePath
+ - log.fileSize
+ - log.localAnalysisResult
+ - log.reported
+ - log.blocked
+ - log.executionCount
+
+ # ==================================================================================
+ # 5. CSV Handling - System Logs
+ # ==================================================================================
+ - csv:
+ source: raw
+ where: 'regexMatch(raw, "^system,.*")'
+ separator: ","
+ headers:
+ - log.recordType
+ - log.class
+ - log.FUTURE_USE
+ - log.subClassId
+ - log.eventType
+ - log.eventCategory
+ - log.generatedTime
+ - log.serverTime
+ - log.FUTURE_USE_2
+ - log.facility
+ - log.customerId
+ - log.trapsId
+ - log.serverHost
+ - log.serverComponentVersion
+ - log.regionId
+ - log.isEndpoint
+ - log.agentId
+ - log.severity
+ - log.trapsSeverity
+ - log.messageCode
+ - log.friendlyName
+ - log.FUTURE_USE_3
+ - log.msgTextEn
+ - log.userFullName
+ - log.userName
+ - log.userRole
+ - log.userDomain
+ - log.agentTime
+ - log.tzOffset
+ - log.osType
+ - log.isVdi
+ - log.osVersion
+ - log.is64
+ - log.agentIp
+ - log.deviceName
+ - log.deviceDomain
+ - log.agentVersion
+ - log.contentVersion
+ - log.protectionStatus
+ - log.userFullName2
+ - log.username2
+ - log.userRole2
+ - log.userDomain2
+ - log.messageName
+ - log.messageId
+ - log.processStatus
+ - log.errorText
+ - log.errorData
+ - log.resultData
+ - log.parameters
+ - log.additionalData
+
+ # ==================================================================================
+ # 6. Standard Mappings
+ # ==================================================================================
+ # Map fields extracted from CEF/CSV to standard UTMStack schema (origin.ip, target.ip, etc)
+ # Assuming KV filter extracted typical CEF keys like src, dst, spt, dpt
+
+ - rename:
+ from: [log.src, log.u_srcIp] # u_srcIp might be from CSV if named differently? No, CSV columns are named above.
+ to: origin.ip
+ where: 'exists("log.src")'
+ - rename:
+ from: [log.agentIp] # From CSV
+ to: origin.ip
+ where: 'exists("log.agentIp") && !exists("origin.ip")'
+
+ - rename:
+ from: [log.dst]
+ to: target.ip
+ - rename:
+ from: [log.spt, log.srcPort]
+ to: origin.port
+ - rename:
+ from: [log.dpt, log.dstPort]
+ to: target.port
+
+ # Clean up FUTURE_USE fields
+ - delete:
+ fields: [log.FUTURE_USE, log.FUTURE_USE_2, log.FUTURE_USE_3]
diff --git a/filters/paloalto/pa_firewall.yml b/filters/paloalto/pa_firewall.yml
index 485908e67..cb27985d3 100644
--- a/filters/paloalto/pa_firewall.yml
+++ b/filters/paloalto/pa_firewall.yml
@@ -37,7 +37,7 @@ pipeline:
- fieldName: log.cefOrLeefMsgAll
pattern: '{{.greedy}}'
source: raw
- where: raw.contains("CEF:") || raw.contains("LEEF:")
+ where: contains("raw", "CEF:") || contains("raw", "LEEF:")
#......................................................................#
# Removing unnecessary characters of the syslogHeader
@@ -83,7 +83,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("TRAFFIC") || log.cefOrLeefMsgAll.contains("traffic")
+ where: contains("log.cefOrLeefMsgAll", "TRAFFIC") || contains("log.cefOrLeefMsgAll", "traffic")
#......................................................................#
# Detect if its an url threat log
@@ -105,7 +105,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("THREAT") || log.cefOrLeefMsgAll.contains("threat") && log.cefOrLeefMsgAll.contains("url") || log.cefOrLeefMsgAll.contains("URL")
+ where: contains("log.cefOrLeefMsgAll", "THREAT") || contains("log.cefOrLeefMsgAll", "threat") && (contains("log.cefOrLeefMsgAll", "url") || contains("log.cefOrLeefMsgAll", "URL"))
#......................................................................#
# Detect if its a data threat log
@@ -127,7 +127,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("THREAT") || log.cefOrLeefMsgAll.contains("threat") && (log.cefOrLeefMsgAll.contains("data") || log.cefOrLeefMsgAll.contains("DATA")) || log.cefOrLeefMsgAll.containscontains("DLP") || log.cefOrLeefMsgAll.contains("DLP-NON-FILE") || log.cefOrLeefMsgAll.containscontains("FILE")
+ where: contains("log.cefOrLeefMsgAll", "data") || contains("log.cefOrLeefMsgAll", "DLP") || contains("log.cefOrLeefMsgAll", "DLP-NON-FILE") || contains("log.cefOrLeefMsgAll", "FILE") || contains("log.cefOrLeefMsgAll", "file") || contains("log.cefOrLeefMsgAll", "flood") || contains("log.cefOrLeefMsgAll", "packet") || contains("log.cefOrLeefMsgAll", "scan") || contains("log.cefOrLeefMsgAll", "spyware") || contains("log.cefOrLeefMsgAll", "URL") || contains("log.cefOrLeefMsgAll", "ml-virus") || contains("log.cefOrLeefMsgAll", "virus") || contains("log.cefOrLeefMsgAll", "vulnerability")
#......................................................................#
# Detect if its a WildFire threat log
@@ -149,7 +149,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("THREAT") || log.cefOrLeefMsgAll.contains("threat") && log.cefOrLeefMsgAll.containscontains("wildfire") || log.cefOrLeefMsgAll.contains("WILDFIRE")
+ where: (contains("log.cefOrLeefMsgAll", "THREAT") || contains("log.cefOrLeefMsgAll", "threat")) && (contains("log.cefOrLeefMsgAll", "wildfire") || contains("log.cefOrLeefMsgAll", "WILDFIRE"))
# ......................................................................#
# Detect if its general threat log
@@ -171,7 +171,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("THREAT") || log.cefOrLeefMsgAll.contains("threat")
+ where: contains("log.cefOrLeefMsgAll", "THREAT") || contains("log.cefOrLeefMsgAll", "threat")
#......................................................................#
# Detect if its a CONFIG threat log
@@ -193,7 +193,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("CONFIG") || log.cefOrLeefMsgAll.contains("config")
+ where: contains("log.cefOrLeefMsgAll", "CONFIG") || contains("log.cefOrLeefMsgAll", "config")
#......................................................................#
# Detect if its a System log
@@ -215,7 +215,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("SYSTEM") || log.cefOrLeefMsgAll.contains("system")
+ where: contains("log.cefOrLeefMsgAll", "SYSTEM") || contains("log.cefOrLeefMsgAll", "system")
#......................................................................#
# Detect if its a HIP-MATCH log
@@ -237,7 +237,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("HIP-MATCH") || log.cefOrLeefMsgAll.contains("hip-match")
+ where: contains("log.cefOrLeefMsgAll", "HIP-MATCH") || contains("log.cefOrLeefMsgAll", "hip-match")
#......................................................................#
# Detect if its an AUTHENTICATION log
@@ -259,7 +259,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("AUTHENTICATION") || log.cefOrLeefMsgAll.contains("authentication")
+ where: contains("log.cefOrLeefMsgAll", "AUTHENTICATION") || contains("log.cefOrLeefMsgAll", "authentication")
#......................................................................#
# Detect if its an USERID log
@@ -281,7 +281,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("USERID") || log.cefOrLeefMsgAll.contains("userid")
+ where: contains("log.cefOrLeefMsgAll", "USERID") || contains("log.cefOrLeefMsgAll", "userid")
#......................................................................#
# Detect if its an IPTAG log
@@ -303,7 +303,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("IPTAG") || log.cefOrLeefMsgAll.contains("iptag")
+ where: contains("log.cefOrLeefMsgAll", "IPTAG") || contains("log.cefOrLeefMsgAll", "iptag")
#......................................................................#
# Detect if its an Tunnel log
@@ -325,7 +325,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("START") || log.cefOrLeefMsgAll.contains("start") || log.cefOrLeefMsgAll.containscontains("END") || log.cefOrLeefMsgAll.contains("end")
+ where: (contains("log.cefOrLeefMsgAll", "START") || contains("log.cefOrLeefMsgAll", "start")) || (contains("log.cefOrLeefMsgAll", "END") || contains("log.cefOrLeefMsgAll", "end"))
#......................................................................#
# Detect if its an CORRELATION log
@@ -347,7 +347,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("CORRELATION") || log.cefOrLeefMsgAll.contains("correlation")
+ where: contains("log.cefOrLeefMsgAll", "CORRELATION") || contains("log.cefOrLeefMsgAll", "correlation")
#......................................................................#
# Detect if its an GTP log
@@ -369,7 +369,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("GTP") || log.cefOrLeefMsgAll.contains("gtp")
+ where: contains("log.cefOrLeefMsgAll", "GTP") || contains("log.cefOrLeefMsgAll", "gtp")
#......................................................................#
# Detect if its an SCTP log
@@ -387,7 +387,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("SCTP") || log.cefOrLeefMsgAll.contains("sctp")
+ where: contains("log.cefOrLeefMsgAll", "SCTP") || contains("log.cefOrLeefMsgAll", "sctp")
#......................................................................#
# Detect if its an GLOBALPROTECT log
@@ -407,7 +407,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("GLOBALPROTECT") || log.cefOrLeefMsgAll.contains("globalprotect")
+ where: contains("log.cefOrLeefMsgAll", "GLOBALPROTECT") || contains("log.cefOrLeefMsgAll", "globalprotect")
#......................................................................#
# Detect if its an DECRYPTION log
@@ -427,7 +427,7 @@ pipeline:
- fieldName: log.cefOrLeefMsg
pattern: '{{.greedy}}'
source: log.cefOrLeefMsgAll
- where: log.cefOrLeefMsgAll.contains("DECRYPTION") || log.cefOrLeefMsgAll.contains("decryption")
+ where: contains("log.cefOrLeefMsgAll", "DECRYPTION") || contains("log.cefOrLeefMsgAll", "decryption")
#......................................................................#
# Remove unnecessary caracters
@@ -5959,7 +5959,7 @@ pipeline:
- log.is_saas_of_app
- log.sanctioned_state_of_app
- log.offloaded
- where: log.csvMsgAll.matches("(.+),(\\s)?(TRAFFIC)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(TRAFFIC)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)")
#......................................................................#
# Detect if its a THREAT log in csvMsgAll
@@ -6088,7 +6088,7 @@ pipeline:
- log.is_saas_of_app
- log.sanctioned_state_of_app
- log.cloud_reportid
- where: log.csvMsgAll.matches("(.+),(\\s)?(THREAT)(\\s)?,(\\s)?(data|DLP|DLP-NON-FILE|FILE|file|flood|packet|scan|spyware|URL|ml-virus|virus|vulnerability|wildfire|wildfire-virus)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(THREAT)(\\s)?,(\\s)?(data|DLP|DLP-NON-FILE|FILE|file|flood|packet|scan|spyware|URL|ml-virus|virus|vulnerability|wildfire|wildfire-virus)(\\s)?,(.+)")
#......................................................................#
# Detect if its a HIP-MATCH log in csvMsgAll
@@ -6127,7 +6127,7 @@ pipeline:
- log.serialnumber
- log.mac
- log.high_res_timestamp
- where: log.csvMsgAll.matches("(.+),(\\s)?(HIP-MATCH)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(HIP-MATCH)(\\s)?,(.+)")
# ..........................................................................#
# Detect if its a GLOBALPROTECT log
@@ -6184,7 +6184,7 @@ pipeline:
- log.vsys_name
- log.device_name
- log.vsys_id
- where: log.csvMsgAll.matches("(.+),(\\s)?(GLOBALPROTECT)(\\s)?,(\\s)?(data|file|flood|packet|scan|spyware|URL|virus|vulnerability|wildfire|wildfire-virus)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(GLOBALPROTECT)(\\s)?,(\\s)?(data|file|flood|packet|scan|spyware|URL|virus|vulnerability|wildfire|wildfire-virus)(\\s)?,(.+)")
# ..........................................................................#
# Detect if its a IPTAG log
@@ -6218,7 +6218,7 @@ pipeline:
- log.device_name
- log.vsys_id
- log.high_res_timestamp
- where: log.csvMsgAll.matches("(.+),(\\s)?(IPTAG)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(IPTAG)(\\s)?,(.+)")
# ..........................................................................#
# Detect if its a USERID log
@@ -6261,7 +6261,7 @@ pipeline:
- log.ugflags
- log.userbysource
- log.high_res_timestamp
- where: log.csvMsgAll.matches("(.+),(\\s)?(USERID)(\\s)?,(\\s)?(login|logout|register-tag|unregister-tag)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(USERID)(\\s)?,(\\s)?(login|logout|register-tag|unregister-tag)(\\s)?,(.+)")
# ..........................................................................#
# Detect if its a DECRYPTION log
@@ -6375,7 +6375,7 @@ pipeline:
- log.container_of_app
- log.is_saas_of_app
- log.sanctioned_state_of_app
- where: log.csvMsgAll.matches("(.+),(\\s)?(DECRYPTION)(\\s)?,(.+),(\\s)?(allow|deny|drop|drop ICMP|reset both|reset client|reset server)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(DECRYPTION)(\\s)?,(.+),(\\s)?(allow|deny|drop|drop ICMP|reset both|reset client|reset server)(\\s)?,(.+)")
# ..........................................................................#
# Detect if its a TUNNEL INSPECTION log
@@ -6466,7 +6466,7 @@ pipeline:
- log.container_of_app
- log.is_saas_of_app
- log.sanctioned_state_of_app
- where: log.csvMsgAll.matches("(.+),(\\s)?(START|END)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(START|END)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)")
# ..........................................................................#
# Detect if its a SCTP log
@@ -6539,7 +6539,7 @@ pipeline:
- log.pkts_received
- log.rule_uuid
- log.high_res_timestamp
- where: log.csvMsgAll.matches("(.+),(\\s)?(SCTP)(\\s)?,(.+),(\\s)?(allow|deny)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(SCTP)(\\s)?,(.+),(\\s)?(allow|deny)(\\s)?,(.+)")
#......................................................................#
# Detect if its a CONFIG log
@@ -6574,7 +6574,7 @@ pipeline:
- log.dg_id
- log.comment
- log.high_res_timestamp
- where: log.csvMsgAll.matches("(.+),(\\s)?(CONFIG)(\\s)?,(.+),(\\s)?(add|clone|commit|delete|edit|move|rename|set)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(CONFIG)(\\s)?,(.+),(\\s)?(add|clone|commit|delete|edit|move|rename|set)(\\s)?,(.+)")
#......................................................................#
# Detect if its a AUTHENTICATION log
@@ -6627,7 +6627,7 @@ pipeline:
- log.region
- log.user_agent
- log.sessionid
- where: log.csvMsgAll.matches("(.+),(\\s)?(AUTHENTICATION)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(AUTHENTICATION)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)")
#......................................................................#
# Detect if its a SYSTEM log
@@ -6661,7 +6661,7 @@ pipeline:
- log.future_use
- log.future_use
- log.high_res_timestamp
- where: log.csvMsgAll.matches("(.+),(\\s)?(SYSTEM)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(SYSTEM)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)")
#......................................................................#
# Detect if its a CORRELATED EVENTS log
@@ -6691,7 +6691,7 @@ pipeline:
- log.objectname
- log.object_id
- log.evidence
- where: log.csvMsgAll.matches("(.+),(\\s)?(CORRELATION)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(CORRELATION)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)")
#......................................................................#
# Detect if its a GTP log
@@ -6762,7 +6762,7 @@ pipeline:
- log.future_use
- log.future_use
- log.high_res_timestamp
- where: log.csvMsgAll.matches("(.+),(\\s)?(GTP)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)")
+ where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(GTP)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)")
# ................................................#
# Rename fields
diff --git a/filters/sonicwall/sonic_wall.yml b/filters/sonicwall/sonic_wall.yml
index aa685a16b..05ab41c48 100644
--- a/filters/sonicwall/sonic_wall.yml
+++ b/filters/sonicwall/sonic_wall.yml
@@ -1,4 +1,4 @@
-# SonicWall Firewall, version 3.0.1
+# SonicWall Firewall, version 3.2.0
# Based on docs
# Support Syslog CEF format
#
@@ -48,6 +48,30 @@ pipeline:
pattern: '{{.greedy}}'
source: raw
+ - grok:
+ patterns:
+ - fieldName: log.priority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\='
+ - fieldName: log.device
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant1
+ pattern: '{{.data}}\='
+ - fieldName: log.sn
+ pattern: '{{.word}}'
+ - fieldName: log.irrelevant2
+ pattern: '{{.data}}\"'
+ - fieldName: log.dvcTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}'
+ - fieldName: log.irrelevant3
+ pattern: '{{.data}}\='
+ - fieldName: log.srcIp
+ pattern: '{{.ipv4}}'
+ - fieldName: log.msgAll
+ pattern: '{{.greedy}}'
+ source: raw
+
# ......................................................................#
# Checking if the log is in CEF format
#......................................................................#
@@ -70,7 +94,7 @@ pipeline:
- fieldName: log.cefMsgAll
pattern: '{{.greedy}}'
source: log.msgAll
- where: log.msgAll.contains("CEF:")
+ where: contains("log.msgAll", "CEF:")
- grok:
patterns:
@@ -85,7 +109,7 @@ pipeline:
- fieldName: log.cefMsgAll
pattern: '{{.greedy}}'
source: log.msgAll
- where: log.msgAll.contains("CEF:")
+ where: contains("log.msgAll", "CEF:")
#......................................................................#
# Removing unnecessary characters of the syslogHeader
@@ -317,119 +341,119 @@ pipeline:
params:
key: log.groupCategory
value: 'System'
- where: safe("log.gcat", "") == "1"
+ where: equals("log.gcat", "1")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Log'
- where: safe("log.gcat", "") == "2"
+ where: equals("log.gcat", "2")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Security Services'
- where: safe("log.gcat", "") == "3"
+ where: equals("log.gcat", "3")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Users'
- where: safe("log.gcat", "") == "4"
+ where: equals("log.gcat", "4")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Firewall Settings'
- where: safe("log.gcat", "") == "5"
+ where: equals("log.gcat", "5")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Network'
- where: safe("log.gcat", "") == "6"
+ where: equals("log.gcat", "6")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'VPN'
- where: safe("log.gcat", "") == "7"
+ where: equals("log.gcat", "7")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'High Availability'
- where: safe("log.gcat", "") == "8"
+ where: equals("log.gcat", "8")
- add:
function: 'string'
params:
key: log.groupCategory
value: '3G/4G, Modem, and Module'
- where: safe("log.gcat", "") == "9"
+ where: equals("log.gcat", "9")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Firewall'
- where: safe("log.gcat", "") == "10"
+ where: equals("log.gcat", "10")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Wireless'
- where: safe("log.gcat", "") == "11"
+ where: equals("log.gcat", "11")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'VoIP'
- where: safe("log.gcat", "") == "12"
+ where: equals("log.gcat", "12")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'SSL VPN'
- where: safe("log.gcat", "") == "13"
+ where: equals("log.gcat", "13")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Anti-Spam'
- where: safe("log.gcat", "") == "14"
+ where: equals("log.gcat", "14")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'WAN Acceleration'
- where: safe("log.gcat", "") == "15"
+ where: equals("log.gcat", "15")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'SD-WAN'
- where: safe("log.gcat", "") == "16"
+ where: equals("log.gcat", "16")
- add:
function: 'string'
params:
key: log.groupCategory
value: 'Multi-Tenancy'
- where: safe("log.gcat", "") == "17"
+ where: equals("log.gcat", "17")
# Adding geolocation to origin.ip
- dynamic:
@@ -455,19 +479,19 @@ pipeline:
params:
key: severity
value: 'high'
- where: safe("log.pri", "") in ["0", "1", "2", "3"]
+ where: oneOf("log.pri", ["0", "1", "2", "3"])
- add:
function: 'string'
params:
key: severity
value: 'medium'
- where: safe("log.pri", "") == "4"
+ where: equals("log.pri", "4")
- add:
function: 'string'
params:
key: severity
value: 'low'
- where: safe("log.pri", "") in ["5", "6", "7"]
+ where: oneOf("log.pri", ["5", "6", "7"])
# ..........................................................................#
# Removing unnuse fields
@@ -475,6 +499,9 @@ pipeline:
- delete:
fields:
- log.irrelevant
+ - log.irrelevant1
+ - log.irrelevant2
+ - log.irrelevant3
- log.msgAll
- log.cefMsgAll
- log.pri
diff --git a/filters/sophos/sophos_xg_firewall.yml b/filters/sophos/sophos_xg_firewall.yml
index 980737252..1feb4926e 100644
--- a/filters/sophos/sophos_xg_firewall.yml
+++ b/filters/sophos/sophos_xg_firewall.yml
@@ -1,4 +1,4 @@
-# Sophos_XG filter, version 3.0.4
+# Sophos_XG filter, version 3.0.5
# Supports SF 20.0 version log types
# See manual: https://docs.sophos.com/nsg/sophos-firewall/20.0/pdf/sf-syslog-guide-20.0.pdf
# and documentation https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/TroubleshootingLogs/LogFileDetails/index.html#https-ftp-waf
@@ -701,7 +701,7 @@ pipeline:
params:
key: actionResult
value: 'accepted'
- where: safe("statusCode", 0.0) >= double(200) && safe("statusCode", 0.0) <= double(299) || (safe("statusCode", 0.0) >= double(300) && safe("statusCode", 0.0) <= double(399) && safe("origin.bytesReceived", 0.0) > double(0))
+ where: (greaterOrEqual("statusCode", 200) && lessOrEqual("statusCode", 299)) || (greaterOrEqual("statusCode", 300) && lessOrEqual("statusCode", 399) && greaterThan("origin.bytesReceived", 0))
# Removing unused fields
- delete:
diff --git a/filters/suricata/suricata.yml b/filters/suricata/suricata.yml
index d49de1ff1..a35499f4b 100644
--- a/filters/suricata/suricata.yml
+++ b/filters/suricata/suricata.yml
@@ -1,4 +1,4 @@
-# Suricata filter version 1.0.0
+# Suricata filter version 1.0.1
# Based on https://suricata.readthedocs.io/en/latest/output/eve/eve-json-format.html (latest 8.0.0) (august 2025)
# and real events log provided
# Support json format
@@ -9,7 +9,7 @@ pipeline:
steps:
# Drop log incomplete jSon structure
- drop:
- where: safe("raw", "").matches(".*\\\"event_type\\\"\\s*:\\s*\\\"stats\\\".*")
+ where: regexMatch("raw", ".*\\\"event_type\\\"\\s*:\\s*\\\"stats\\\".*")
# Parsing RAW field log
- grok:
@@ -30,7 +30,7 @@ pipeline:
# Parse Suricata JSON logs
- json:
source: log.suricataJson
- where: safe("log.suricataJson", "").matches("^\\{.*\\}$")
+ where: regexMatch("log.suricataJson", "^\\{.*\\}$")
# Rename fields to conversion v11 schema
- rename:
@@ -95,21 +95,21 @@ pipeline:
params:
key: severity
value: "low"
- where: safe("log.alert.severity", 0.0) == double(1)
+ where: equals("log.alert.severity", 1)
- add:
function: "string"
params:
key: severity
value: "medium"
- where: safe("log.alert.severity", 0.0) == double(2)
+ where: equals("log.alert.severity", 2)
- add:
function: "string"
params:
key: severity
value: "high"
- where: safe("log.alert.severity", 0.0) == double(3)
+ where: equals("log.alert.severity", 3)
#.......................................................................
# Add new eventtypes to logx structure, detected in real logs, present in suricata 7.0.0
@@ -129,26 +129,26 @@ pipeline:
params:
key: action
value: "success"
- where: (safe("log.eventType", "") == "tls" && exists("log.tls.sessionresumed")) ||
- (safe("log.eventType", "") == "dns" && safe("log.dns.type", "") == "answer") ||
- (safe("log.eventType", "") == "flow" && exists("origin.ip") && exists("target.ip") && safe("log.flow.bytestoserver", 0.0) > double(0) && safe("log.flow.bytestoclient", 0.0) > double(0)) ||
- (safe("log.eventType", "") == "ssh" && exists("log.ssh.server") && exists("log.ssh.client")) ||
- (safe("log.eventType", "") == "alert" && exists("origin.ip") && exists("target.ip") && safe("log.alert.action", "") == "allowed" && safe("log.flow.bytestoserver", 0.0) > double(0) && safe("log.flow.bytestoclient", 0.0) > double(0)) ||
- (safe("log.eventType", "") == "http" && exists("origin.ip") && exists("target.ip") && exists("log.http.status")) ||
- (safe("log.eventType", "") == "ftp" && exists("origin.ip") && exists("target.ip") && exists("log.ftp.completioncode")) ||
- (safe("log.eventType", "") == "tftp" && exists("origin.ip") && exists("target.ip") && safe("log.tftp.packet", "") != "error") ||
- (safe("log.eventType", "") == "smb" && exists("origin.ip") && exists("target.ip") && safe("log.smb.command", "") in ["NEGOTIATE"] && safe("log.smb.status", "") in ["SUCCESS", "GRANTED", "CONNECTED"]) ||
- (safe("log.eventType", "") == "rdp" && exists("origin.ip") && exists("target.ip") && (safe("log.rdp.eventType", "") == "connectresponse" || safe("log.rdp.eventType", "") == "tlshandshake")) ||
- (safe("log.eventType", "") == "rfb" && exists("origin.ip") && exists("target.ip") && safe("log.rfb.authentication.security-result", "") == "OK") ||
- (safe("log.eventType", "") == "mqtt" && exists("origin.ip") && exists("target.ip") && (safe("log.mqtt.connack.returncode", "") == "0" || safe("log.mqtt.connack.returncode", "") == "0x00")) ||
- (safe("log.eventType", "") == "pgsql" && exists("origin.ip") && exists("target.ip") && (exists("log.pgsql.request.simplequery") || exists("log.pgsql.response.commandcompleted") || safe("log.pgsql.response.sslaccepted", "") == "true" || safe("log.pgsql.response.accepted", "") == "true" || exists("log.pgsql.response.authenticationmd5password"))) ||
- ((safe("log.eventType", "") == "ike" || safe("log.eventType", "") == "ikev1" || safe("log.eventType", "") == "ikev2") && exists("origin.ip") && exists("target.ip")) ||
- (safe("log.eventType", "") == "modbus" && exists("origin.ip") && exists("target.ip")) ||
- (safe("log.eventType", "") == "sip" && exists("origin.ip") && exists("target.ip")) ||
- (safe("log.eventType", "") == "quic" && exists("origin.ip") && exists("target.ip")) ||
- (safe("log.eventType", "") == "fileinfo" && exists("origin.ip") && exists("target.ip")) ||
- (safe("log.eventType", "") == "snmp" && exists("origin.ip") && exists("target.ip")) ||
- (safe("log.eventType", "") == "dhcp" && exists("origin.ip") && exists("target.ip") && safe("log.dhcp.assignedip", "") != "0")
+ where: (equals("log.eventType", "tls") && exists("log.tls.sessionresumed")) ||
+ (equals("log.eventType", "dns") && equals("log.dns.type", "answer")) ||
+ (equals("log.eventType", "flow") && exists("origin.ip") && exists("target.ip") && greaterThan("log.flow.bytestoserver", 0) && greaterThan("log.flow.bytestoclient", 0)) ||
+ (equals("log.eventType", "ssh") && exists("log.ssh.server") && exists("log.ssh.client")) ||
+ (equals("log.eventType", "alert") && exists("origin.ip") && exists("target.ip") && equals("log.alert.action", "allowed") && greaterThan("log.flow.bytestoserver", 0) && greaterThan("log.flow.bytestoclient", 0)) ||
+ (equals("log.eventType", "http") && exists("origin.ip") && exists("target.ip") && exists("log.http.status")) ||
+ (equals("log.eventType", "ftp") && exists("origin.ip") && exists("target.ip") && exists("log.ftp.completioncode")) ||
+ (equals("log.eventType", "tftp") && exists("origin.ip") && exists("target.ip") && !equals("log.tftp.packet", "error")) ||
+ (equals("log.eventType", "smb") && exists("origin.ip") && exists("target.ip") && oneOf("log.smb.command", ["NEGOTIATE"]) && oneOf("log.smb.status", ["SUCCESS", "GRANTED", "CONNECTED"])) ||
+ (equals("log.eventType", "rdp") && exists("origin.ip") && exists("target.ip") && (equals("log.rdp.eventType", "connectresponse") || equals("log.rdp.eventType", "tlshandshake"))) ||
+ (equals("log.eventType", "rfb") && exists("origin.ip") && exists("target.ip") && equals("log.rfb.authentication.security-result", "OK")) ||
+ (equals("log.eventType", "mqtt") && exists("origin.ip") && exists("target.ip") && (equals("log.mqtt.connack.returncode", "0") || equals("log.mqtt.connack.returncode", "0x00"))) ||
+ (equals("log.eventType", "pgsql") && exists("origin.ip") && exists("target.ip") && (exists("log.pgsql.request.simplequery") || exists("log.pgsql.response.commandcompleted") || equals("log.pgsql.response.sslaccepted", "true") || equals("log.pgsql.response.accepted", "true") || exists("log.pgsql.response.authenticationmd5password"))) ||
+ ((equals("log.eventType", "ike") || equals("log.eventType", "ikev1") || equals("log.eventType", "ikev2")) && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "modbus") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "sip") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "quic") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "fileinfo") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "snmp") && exists("origin.ip") && exists("target.ip")) ||
+ (equals("log.eventType", "dhcp") && exists("origin.ip") && exists("target.ip") && !equals("log.dhcp.assignedip", "0"))
# Adding geolocation to origin.ip
diff --git a/filters/utmstack/utmstack.yml b/filters/utmstack/utmstack.yml
index b1819e459..2535065c2 100644
--- a/filters/utmstack/utmstack.yml
+++ b/filters/utmstack/utmstack.yml
@@ -1,8 +1,18 @@
-# UTMStack filter, version 1.0.0
+# UTMStack filter, version 1.0.1
pipeline:
- dataTypes:
- utmstack
steps:
+ # Only parse as JSON if it contains the standard schema with "msg": and "args":
- json:
- source: raw
\ No newline at end of file
+ source: raw
+ where: 'contains("raw", "\"msg\":") && contains("raw", "\"args\":")'
+
+ # If it doesn't have the standard schema, just store the content in log.message using grok
+ - grok:
+ source: raw
+ patterns:
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+ where: '!contains("raw", "\"msg\":") || !contains("raw", "\"args\":")'
\ No newline at end of file
diff --git a/filters/vmware/vmware-esxi.yml b/filters/vmware/vmware-esxi.yml
index a689943af..7c533dd72 100644
--- a/filters/vmware/vmware-esxi.yml
+++ b/filters/vmware/vmware-esxi.yml
@@ -1,4 +1,4 @@
-# VMWare-ESXi, version 3.0.0
+# VMWare-ESXi, version 3.0.1
#
# Based on docs and real logs provided
# Support VMWare-ESXi log
@@ -48,6 +48,33 @@ pipeline:
pattern: '\[{{.data}}\]:'
- fieldName: log.message
pattern: '{{.greedy}}'
+
+ - grok:
+ patterns:
+ - fieldName: log.priority
+ pattern: '\<{{.data}}\>'
+ - fieldName: log.deviceTime
+ pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}T{{.time}}Z'
+ - fieldName: origin.hostname
+ pattern: '{{.hostname}}'
+ - fieldName: log.process
+ pattern: '{{.hostname}}'
+ - fieldName: log.pid
+ pattern: '\[{{.data}}\]:'
+ - fieldName: log.originIdComponent
+ pattern: '\[{{.data}}\]'
+ - fieldName: log.message
+ pattern: '{{.greedy}}'
+
+ - grok:
+ patterns:
+ - fieldName: log.moduleIdentifier
+ pattern: '\[{{.data}}\@'
+ - fieldName: log.irrelevant
+ pattern: '{{.data}}\='
+ - fieldName: log.subModuleIdentifier
+ pattern: '{{.word}}\]'
+ source: log.originIdComponent
# Removing unused caracters
- trim:
@@ -61,6 +88,12 @@ pipeline:
fields:
- log.pid
- log.eventInfo
+ - log.moduleIdentifier
+ - trim:
+ function: prefix
+ substring: '-'
+ fields:
+ - log.message
- trim:
function: suffix
substring: '>'
@@ -78,8 +111,20 @@ pipeline:
fields:
- log.pid
- log.eventInfo
+ - log.subModuleIdentifier
+ - trim:
+ function: suffix
+ substring: '-'
+ fields:
+ - log.message
+ - trim:
+ function: suffix
+ substring: '@'
+ fields:
+ - log.moduleIdentifier
# Removing unused fields
- delete:
fields:
- - log.processName
\ No newline at end of file
+ - log.processName
+ - log.irrelevant
\ No newline at end of file
diff --git a/filters/windows/windows-events.yml b/filters/windows/windows-events.yml
index 42275399e..2457dea08 100644
--- a/filters/windows/windows-events.yml
+++ b/filters/windows/windows-events.yml
@@ -1,4 +1,4 @@
-# Windows_Agent filter, version 3.0.3
+# Windows_Agent filter, version 3.0.4
# Based on winlogbeat fields, reference [8.15]
# See https://www.elastic.co/guide/en/beats/winlogbeat/current/exported-fields-winlog.html
@@ -422,7 +422,7 @@ pipeline:
# Drop unnecessary events
- drop:
- where: "[0, 1, 43, 44, 1040, 1042, 1105, 1500, 1501, 4608, 4609, 4614, 4615, 4616, 4626, 4627, 4650, 4651, 4652, 4653, 4654, 4655, 4659, 4665, 4666, 4667, 4668, 4688, 4689, 4696, 4709, 4710, 4711, 4712, 4778, 4779, 4826, 4864, 4866, 4898, 4899, 4902, 4904, 4905, 4906, 4909, 4910, 4911, 4928, 4929, 4930, 4931, 4932, 4933, 4934, 4935, 4936, 4937, 4944, 4945, 4951, 4952, 4953, 4957, 4958, 4965, 4979, 4980, 4981, 4982, 4983, 4984, 4985, 5024, 5027, 5028, 5029, 5033, 5034, 5035, 5038, 5039, 5051, 5056, 5057, 5058, 5059, 5060, 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069, 5070, 5071, 5120, 5121, 5122, 5123, 5125, 5126, 5127, 5137, 5138, 5139, 5141, 5145, 5168, 5169, 5170, 5376, 5377, 5378, 5379, 5380, 5381, 5440, 5441, 5442, 5443, 5444, 5446, 5450, 5451, 5452, 5456, 5457, 5458, 5459, 5460, 5461, 5462, 5463, 5464, 5465, 5466, 5467, 5468, 5471, 5472, 5473, 5474, 5477, 5478, 5712, 5888, 5889, 5890, 6145, 6274, 6275, 6281, 6400, 6401, 6402, 6403, 6405, 6406, 6407, 6408, 6409, 6410, 6417, 6418, 6423, 6424, 7040, 8191, 10000, 10010, 16384, 16394, 24578, 24579, 24581, 24582, 24583, 24584, 24586, 24588, 24592, 24593, 24594, 24595, 24621].exists_one(v, v == log.eventCode)"
+ where: "oneOf('log.eventCode', [0, 1, 43, 44, 1040, 1042, 1105, 1500, 1501, 4608, 4609, 4614, 4615, 4616, 4626, 4627, 4650, 4651, 4652, 4653, 4654, 4655, 4659, 4665, 4666, 4667, 4668, 4688, 4689, 4696, 4709, 4710, 4711, 4712, 4778, 4779, 4826, 4864, 4866, 4898, 4899, 4902, 4904, 4905, 4906, 4909, 4910, 4911, 4928, 4929, 4930, 4931, 4932, 4933, 4934, 4935, 4936, 4937, 4944, 4945, 4951, 4952, 4953, 4957, 4958, 4965, 4979, 4980, 4981, 4982, 4983, 4984, 4985, 5024, 5027, 5028, 5029, 5033, 5034, 5035, 5038, 5039, 5051, 5056, 5057, 5058, 5059, 5060, 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069, 5070, 5071, 5120, 5121, 5122, 5123, 5125, 5126, 5127, 5137, 5138, 5139, 5141, 5145, 5168, 5169, 5170, 5376, 5377, 5378, 5379, 5380, 5381, 5440, 5441, 5442, 5443, 5444, 5446, 5450, 5451, 5452, 5456, 5457, 5458, 5459, 5460, 5461, 5462, 5463, 5464, 5465, 5466, 5467, 5468, 5471, 5472, 5473, 5474, 5477, 5478, 5712, 5888, 5889, 5890, 6145, 6274, 6275, 6281, 6400, 6401, 6402, 6403, 6405, 6406, 6407, 6408, 6409, 6410, 6417, 6418, 6423, 6424, 7040, 8191, 10000, 10010, 16384, 16394, 24578, 24579, 24581, 24582, 24583, 24584, 24586, 24588, 24592, 24593, 24594, 24595, 24621])"
# Decoding event code
- add:
@@ -430,1862 +430,1862 @@ pipeline:
params:
key: log.eventName
value: 'A product has been installed successfully'
- where: safe("log.eventCode", 0.0)==double(1033)
+ where: equals("log.eventCode", 1033)
- add:
function: 'string'
params:
key: log.eventName
value: 'The event logging service has shut down'
- where: safe("log.eventCode", 0.0)==double(1100)
+ where: equals("log.eventCode", 1100)
- add:
function: 'string'
params:
key: log.eventName
value: 'Audit events have been dropped by the transport.'
- where: safe("log.eventCode", 0.0)==double(1101)
+ where: equals("log.eventCode", 1101)
- add:
function: 'string'
params:
key: log.eventName
value: 'The audit log was cleared'
- where: safe("log.eventCode", 0.0)==double(1102)
+ where: equals("log.eventCode", 1102)
- add:
function: 'string'
params:
key: log.eventName
value: 'The security Log is now full'
- where: safe("log.eventCode", 0.0)==double(1104)
+ where: equals("log.eventCode", 1104)
- add:
function: 'string'
params:
key: log.eventName
value: 'The event logging service encountered an error'
- where: safe("log.eventCode", 0.0)==double(1108)
+ where: equals("log.eventCode", 1108)
- add:
function: 'string'
params:
key: log.eventName
value: 'A PowerShell script block has been executed and the script text has been logged to the event viewer.'
- where: safe("log.eventCode", 0.0)==double(4104)
+ where: equals("log.eventCode", 4104)
- add:
function: 'string'
params:
key: log.eventName
value: 'An authentication package has been loaded by the Local Security Authority'
- where: safe("log.eventCode", 0.0)==double(4610)
+ where: equals("log.eventCode", 4610)
- add:
function: 'string'
params:
key: log.eventName
value: 'A trusted logon process has been registered with the Local Security Authority'
- where: safe("log.eventCode", 0.0)==double(4611)
+ where: equals("log.eventCode", 4611)
- add:
function: 'string'
params:
key: log.eventName
value: 'Internal resources allocated for the queuing of audit messages have been exhausted: leading to the loss of some audits.'
- where: safe("log.eventCode", 0.0)==double(4612)
+ where: equals("log.eventCode", 4612)
- add:
function: 'string'
params:
key: log.eventName
value: 'A monitored security event pattern has occurred'
- where: safe("log.eventCode", 0.0)==double(4618)
+ where: equals("log.eventCode", 4618)
- add:
function: 'string'
params:
key: log.eventName
value: 'Administrator recovered system from CrashOnAuditFail'
- where: safe("log.eventCode", 0.0)==double(4621)
+ where: equals("log.eventCode", 4621)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security package has been loaded by the Local Security Authority.'
- where: safe("log.eventCode", 0.0)==double(4622)
+ where: equals("log.eventCode", 4622)
- add:
function: 'string'
params:
key: log.eventName
value: 'An account was successfully logged on'
- where: safe("log.eventCode", 0.0)==double(4624)
+ where: equals("log.eventCode", 4624)
- add:
function: 'string'
params:
key: log.eventName
value: 'An account failed to log on'
- where: safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.eventCode", 4625)
- add:
function: 'string'
params:
key: log.eventName
value: 'An account was logged off'
- where: safe("log.eventCode", 0.0)==double(4634)
+ where: equals("log.eventCode", 4634)
- add:
function: 'string'
params:
key: log.eventName
value: 'IKE DoS-prevention mode started'
- where: safe("log.eventCode", 0.0)==double(4646)
+ where: equals("log.eventCode", 4646)
- add:
function: 'string'
params:
key: log.eventName
value: 'User initiated logoff'
- where: safe("log.eventCode", 0.0)==double(4647)
+ where: equals("log.eventCode", 4647)
- add:
function: 'string'
params:
key: log.eventName
value: 'A logon was attempted using explicit credentials'
- where: safe("log.eventCode", 0.0)==double(4648)
+ where: equals("log.eventCode", 4648)
- add:
function: 'string'
params:
key: log.eventName
value: 'A replay attack was detected'
- where: safe("log.eventCode", 0.0)==double(4649)
+ where: equals("log.eventCode", 4649)
- add:
function: 'string'
params:
key: log.eventName
value: 'A handle to an object was requested'
- where: safe("log.eventCode", 0.0)==double(4656)
+ where: equals("log.eventCode", 4656)
- add:
function: 'string'
params:
key: log.eventName
value: 'A registry value was modified'
- where: safe("log.eventCode", 0.0)==double(4657)
+ where: equals("log.eventCode", 4657)
- add:
function: 'string'
params:
key: log.eventName
value: 'The handle to an object was closed'
- where: safe("log.eventCode", 0.0)==double(4658)
+ where: equals("log.eventCode", 4658)
- add:
function: 'string'
params:
key: log.eventName
value: 'An object was deleted'
- where: safe("log.eventCode", 0.0)==double(4660)
+ where: equals("log.eventCode", 4660)
- add:
function: 'string'
params:
key: log.eventName
value: 'A handle to an object was requested'
- where: safe("log.eventCode", 0.0)==double(4661)
+ where: equals("log.eventCode", 4661)
- add:
function: 'string'
params:
key: log.eventName
value: 'An operation was performed on an object'
- where: safe("log.eventCode", 0.0)==double(4662)
+ where: equals("log.eventCode", 4662)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt was made to access an object'
- where: safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt was made to create a hard link'
- where: safe("log.eventCode", 0.0)==double(4664)
+ where: equals("log.eventCode", 4664)
- add:
function: 'string'
params:
key: log.eventName
value: 'Permissions on an object were changed'
- where: safe("log.eventCode", 0.0)==double(4670)
+ where: equals("log.eventCode", 4670)
- add:
function: 'string'
params:
key: log.eventName
value: 'An application attempted to access a blocked ordinal through the TBS'
- where: safe("log.eventCode", 0.0)==double(4671)
+ where: equals("log.eventCode", 4671)
- add:
function: 'string'
params:
key: log.eventName
value: 'Special privileges assigned to new logon'
- where: safe("log.eventCode", 0.0)==double(4672)
+ where: equals("log.eventCode", 4672)
- add:
function: 'string'
params:
key: log.eventName
value: 'A privileged service was called'
- where: safe("log.eventCode", 0.0)==double(4673)
+ where: equals("log.eventCode", 4673)
- add:
function: 'string'
params:
key: log.eventName
value: 'An operation was attempted on a privileged object'
- where: safe("log.eventCode", 0.0)==double(4674)
+ where: equals("log.eventCode", 4674)
- add:
function: 'string'
params:
key: log.eventName
value: 'SIDs were filtered'
- where: safe("log.eventCode", 0.0)==double(4675)
+ where: equals("log.eventCode", 4675)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt was made to duplicate a handle to an object'
- where: safe("log.eventCode", 0.0)==double(4690)
+ where: equals("log.eventCode", 4690)
- add:
function: 'string'
params:
key: log.eventName
value: 'Indirect access to an object was requested'
- where: safe("log.eventCode", 0.0)==double(4691)
+ where: equals("log.eventCode", 4691)
- add:
function: 'string'
params:
key: log.eventName
value: 'Backup of data protection master key was attempted'
- where: safe("log.eventCode", 0.0)==double(4692)
+ where: equals("log.eventCode", 4692)
- add:
function: 'string'
params:
key: log.eventName
value: 'Recovery of data protection master key was attempted'
- where: safe("log.eventCode", 0.0)==double(4693)
+ where: equals("log.eventCode", 4693)
- add:
function: 'string'
params:
key: log.eventName
value: 'Protection of auditable protected data was attempted'
- where: safe("log.eventCode", 0.0)==double(4694)
+ where: equals("log.eventCode", 4694)
- add:
function: 'string'
params:
key: log.eventName
value: 'Unprotection of auditable protected data was attempted'
- where: safe("log.eventCode", 0.0)==double(4695)
+ where: equals("log.eventCode", 4695)
- add:
function: 'string'
params:
key: log.eventName
value: 'A service was installed in the system'
- where: safe("log.eventCode", 0.0)==double(4697)
+ where: equals("log.eventCode", 4697)
- add:
function: 'string'
params:
key: log.eventName
value: 'A scheduled task was created'
- where: safe("log.eventCode", 0.0)==double(4698)
+ where: equals("log.eventCode", 4698)
- add:
function: 'string'
params:
key: log.eventName
value: 'A scheduled task was deleted'
- where: safe("log.eventCode", 0.0)==double(4699)
+ where: equals("log.eventCode", 4699)
- add:
function: 'string'
params:
key: log.eventName
value: 'A scheduled task was enabled'
- where: safe("log.eventCode", 0.0)==double(4700)
+ where: equals("log.eventCode", 4700)
- add:
function: 'string'
params:
key: log.eventName
value: 'A scheduled task was disabled'
- where: safe("log.eventCode", 0.0)==double(4701)
+ where: equals("log.eventCode", 4701)
- add:
function: 'string'
params:
key: log.eventName
value: 'A scheduled task was updated'
- where: safe("log.eventCode", 0.0)==double(4702)
+ where: equals("log.eventCode", 4702)
- add:
function: 'string'
params:
key: log.eventName
value: 'A token right was adjusted'
- where: safe("log.eventCode", 0.0)==double(4703)
+ where: equals("log.eventCode", 4703)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user right was assigned'
- where: safe("log.eventCode", 0.0)==double(4704)
+ where: equals("log.eventCode", 4704)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user right was removed'
- where: safe("log.eventCode", 0.0)==double(4705)
+ where: equals("log.eventCode", 4705)
- add:
function: 'string'
params:
key: log.eventName
value: 'A new trust was created to a domain'
- where: safe("log.eventCode", 0.0)==double(4706)
+ where: equals("log.eventCode", 4706)
- add:
function: 'string'
params:
key: log.eventName
value: 'A trust to a domain was removed'
- where: safe("log.eventCode", 0.0)==double(4707)
+ where: equals("log.eventCode", 4707)
- add:
function: 'string'
params:
key: log.eventName
value: 'Kerberos policy was changed'
- where: safe("log.eventCode", 0.0)==double(4713)
+ where: equals("log.eventCode", 4713)
- add:
function: 'string'
params:
key: log.eventName
value: 'Encrypted data recovery policy was changed'
- where: safe("log.eventCode", 0.0)==double(4714)
+ where: equals("log.eventCode", 4714)
- add:
function: 'string'
params:
key: log.eventName
value: 'The audit policy (SACL) on an object was changed'
- where: safe("log.eventCode", 0.0)==double(4715)
+ where: equals("log.eventCode", 4715)
- add:
function: 'string'
params:
key: log.eventName
value: 'Trusted domain information was modified'
- where: safe("log.eventCode", 0.0)==double(4716)
+ where: equals("log.eventCode", 4716)
- add:
function: 'string'
params:
key: log.eventName
value: 'System security access was granted to an account'
- where: safe("log.eventCode", 0.0)==double(4717)
+ where: equals("log.eventCode", 4717)
- add:
function: 'string'
params:
key: log.eventName
value: 'System security access was removed from an account'
- where: safe("log.eventCode", 0.0)==double(4718)
+ where: equals("log.eventCode", 4718)
- add:
function: 'string'
params:
key: log.eventName
value: 'System audit policy was changed'
- where: safe("log.eventCode", 0.0)==double(4719)
+ where: equals("log.eventCode", 4719)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user account was created'
- where: safe("log.eventCode", 0.0)==double(4720)
+ where: equals("log.eventCode", 4720)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user account was enabled'
- where: safe("log.eventCode", 0.0)==double(4722)
+ where: equals("log.eventCode", 4722)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt was made to change the password for an account'
- where: safe("log.eventCode", 0.0)==double(4723)
+ where: equals("log.eventCode", 4723)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt was made to reset an accounts password'
- where: safe("log.eventCode", 0.0)==double(4724)
+ where: equals("log.eventCode", 4724)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user account was disabled'
- where: safe("log.eventCode", 0.0)==double(4725)
+ where: equals("log.eventCode", 4725)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user account was deleted'
- where: safe("log.eventCode", 0.0)==double(4726)
+ where: equals("log.eventCode", 4726)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled global group was created'
- where: safe("log.eventCode", 0.0)==double(4727)
+ where: equals("log.eventCode", 4727)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was added to a security-enabled global group'
- where: safe("log.eventCode", 0.0)==double(4728)
+ where: equals("log.eventCode", 4728)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was removed from a security-enabled global group'
- where: safe("log.eventCode", 0.0)==double(4729)
+ where: equals("log.eventCode", 4729)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled global group was deleted'
- where: safe("log.eventCode", 0.0)==double(4730)
+ where: equals("log.eventCode", 4730)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled local group was created'
- where: safe("log.eventCode", 0.0)==double(4731)
+ where: equals("log.eventCode", 4731)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was added to a security-enabled local group'
- where: safe("log.eventCode", 0.0)==double(4732)
+ where: equals("log.eventCode", 4732)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was removed from a security-enabled local group'
- where: safe("log.eventCode", 0.0)==double(4733)
+ where: equals("log.eventCode", 4733)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled local group was deleted'
- where: safe("log.eventCode", 0.0)==double(4734)
+ where: equals("log.eventCode", 4734)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled local group was changed'
- where: safe("log.eventCode", 0.0)==double(4735)
+ where: equals("log.eventCode", 4735)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled global group was changed'
- where: safe("log.eventCode", 0.0)==double(4737)
+ where: equals("log.eventCode", 4737)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user account was changed'
- where: safe("log.eventCode", 0.0)==double(4738)
+ where: equals("log.eventCode", 4738)
- add:
function: 'string'
params:
key: log.eventName
value: 'Domain Policy was changed'
- where: safe("log.eventCode", 0.0)==double(4739)
+ where: equals("log.eventCode", 4739)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user account was locked out'
- where: safe("log.eventCode", 0.0)==double(4740)
+ where: equals("log.eventCode", 4740)
- add:
function: 'string'
params:
key: log.eventName
value: 'A computer account was created'
- where: safe("log.eventCode", 0.0)==double(4741)
+ where: equals("log.eventCode", 4741)
- add:
function: 'string'
params:
key: log.eventName
value: 'A computer account was changed'
- where: safe("log.eventCode", 0.0)==double(4742)
+ where: equals("log.eventCode", 4742)
- add:
function: 'string'
params:
key: log.eventName
value: 'A computer account was deleted'
- where: safe("log.eventCode", 0.0)==double(4743)
+ where: equals("log.eventCode", 4743)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled local group was created'
- where: safe("log.eventCode", 0.0)==double(4744)
+ where: equals("log.eventCode", 4744)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled local group was changed'
- where: safe("log.eventCode", 0.0)==double(4745)
+ where: equals("log.eventCode", 4745)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was added to a security-disabled local group'
- where: safe("log.eventCode", 0.0)==double(4746)
+ where: equals("log.eventCode", 4746)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was removed from a security-disabled local group'
- where: safe("log.eventCode", 0.0)==double(4747)
+ where: equals("log.eventCode", 4747)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled local group was deleted'
- where: safe("log.eventCode", 0.0)==double(4748)
+ where: equals("log.eventCode", 4748)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled global group was created'
- where: safe("log.eventCode", 0.0)==double(4749)
+ where: equals("log.eventCode", 4749)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled global group was changed'
- where: safe("log.eventCode", 0.0)==double(4750)
+ where: equals("log.eventCode", 4750)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was added to a security-disabled global group'
- where: safe("log.eventCode", 0.0)==double(4751)
+ where: equals("log.eventCode", 4751)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was removed from a security-disabled global group'
- where: safe("log.eventCode", 0.0)==double(4752)
+ where: equals("log.eventCode", 4752)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled global group was deleted'
- where: safe("log.eventCode", 0.0)==double(4753)
+ where: equals("log.eventCode", 4753)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled universal group was created'
- where: safe("log.eventCode", 0.0)==double(4754)
+ where: equals("log.eventCode", 4754)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled universal group was changed'
- where: safe("log.eventCode", 0.0)==double(4755)
+ where: equals("log.eventCode", 4755)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was added to a security-enabled universal group'
- where: safe("log.eventCode", 0.0)==double(4756)
+ where: equals("log.eventCode", 4756)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was removed from a security-enabled universal group'
- where: safe("log.eventCode", 0.0)==double(4757)
+ where: equals("log.eventCode", 4757)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled universal group was deleted'
- where: safe("log.eventCode", 0.0)==double(4758)
+ where: equals("log.eventCode", 4758)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled universal group was created'
- where: safe("log.eventCode", 0.0)==double(4759)
+ where: equals("log.eventCode", 4759)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled universal group was changed'
- where: safe("log.eventCode", 0.0)==double(4760)
+ where: equals("log.eventCode", 4760)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was added to a security-disabled universal group'
- where: safe("log.eventCode", 0.0)==double(4761)
+ where: equals("log.eventCode", 4761)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was removed from a security-disabled universal group'
- where: safe("log.eventCode", 0.0)==double(4762)
+ where: equals("log.eventCode", 4762)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-disabled universal group was deleted'
- where: safe("log.eventCode", 0.0)==double(4763)
+ where: equals("log.eventCode", 4763)
- add:
function: 'string'
params:
key: log.eventName
value: 'A groups type was changed'
- where: safe("log.eventCode", 0.0)==double(4764)
+ where: equals("log.eventCode", 4764)
- add:
function: 'string'
params:
key: log.eventName
value: 'SID History was added to an account'
- where: safe("log.eventCode", 0.0)==double(4765)
+ where: equals("log.eventCode", 4765)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt to add SID History to an account failed'
- where: safe("log.eventCode", 0.0)==double(4766)
+ where: equals("log.eventCode", 4766)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user account was unlocked'
- where: safe("log.eventCode", 0.0)==double(4767)
+ where: equals("log.eventCode", 4767)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Kerberos authentication ticket (TGT) was requested'
- where: safe("log.eventCode", 0.0)==double(4768)
+ where: equals("log.eventCode", 4768)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Kerberos service ticket was requested'
- where: safe("log.eventCode", 0.0)==double(4769)
+ where: equals("log.eventCode", 4769)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Kerberos service ticket was renewed'
- where: safe("log.eventCode", 0.0)==double(4770)
+ where: equals("log.eventCode", 4770)
- add:
function: 'string'
params:
key: log.eventName
value: 'Kerberos pre-authentication failed'
- where: safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Kerberos authentication ticket request failed'
- where: safe("log.eventCode", 0.0)==double(4772)
+ where: equals("log.eventCode", 4772)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Kerberos service ticket request failed'
- where: safe("log.eventCode", 0.0)==double(4773)
+ where: equals("log.eventCode", 4773)
- add:
function: 'string'
params:
key: log.eventName
value: 'An account was mapped for logon'
- where: safe("log.eventCode", 0.0)==double(4774)
+ where: equals("log.eventCode", 4774)
- add:
function: 'string'
params:
key: log.eventName
value: 'An account could not be mapped for logon'
- where: safe("log.eventCode", 0.0)==double(4775)
+ where: equals("log.eventCode", 4775)
- add:
function: 'string'
params:
key: log.eventName
value: 'The domain controller attempted to validate the credentials for an account'
- where: safe("log.eventCode", 0.0)==double(4776)
+ where: equals("log.eventCode", 4776)
- add:
function: 'string'
params:
key: log.eventName
value: 'The domain controller failed to validate the credentials for an account'
- where: safe("log.eventCode", 0.0)==double(4777)
+ where: equals("log.eventCode", 4777)
- add:
function: 'string'
params:
key: log.eventName
value: 'The ACL was set on accounts which are members of administrators groups'
- where: safe("log.eventCode", 0.0)==double(4780)
+ where: equals("log.eventCode", 4780)
- add:
function: 'string'
params:
key: log.eventName
value: 'The name of an account was changed'
- where: safe("log.eventCode", 0.0)==double(4781)
+ where: equals("log.eventCode", 4781)
- add:
function: 'string'
params:
key: log.eventName
value: 'The password hash an account was accessed'
- where: safe("log.eventCode", 0.0)==double(4782)
+ where: equals("log.eventCode", 4782)
- add:
function: 'string'
params:
key: log.eventName
value: 'A basic application group was created'
- where: safe("log.eventCode", 0.0)==double(4783)
+ where: equals("log.eventCode", 4783)
- add:
function: 'string'
params:
key: log.eventName
value: 'A basic application group was changed'
- where: safe("log.eventCode", 0.0)==double(4784)
+ where: equals("log.eventCode", 4784)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was added to a basic application group'
- where: safe("log.eventCode", 0.0)==double(4785)
+ where: equals("log.eventCode", 4785)
- add:
function: 'string'
params:
key: log.eventName
value: 'A member was removed from a basic application group'
- where: safe("log.eventCode", 0.0)==double(4786)
+ where: equals("log.eventCode", 4786)
- add:
function: 'string'
params:
key: log.eventName
value: 'A non-member was added to a basic application group'
- where: safe("log.eventCode", 0.0)==double(4787)
+ where: equals("log.eventCode", 4787)
- add:
function: 'string'
params:
key: log.eventName
value: 'A non-member was removed from a basic application group.'
- where: safe("log.eventCode", 0.0)==double(4788)
+ where: equals("log.eventCode", 4788)
- add:
function: 'string'
params:
key: log.eventName
value: 'A basic application group was deleted'
- where: safe("log.eventCode", 0.0)==double(4789)
+ where: equals("log.eventCode", 4789)
- add:
function: 'string'
params:
key: log.eventName
value: 'An LDAP query group was created'
- where: safe("log.eventCode", 0.0)==double(4790)
+ where: equals("log.eventCode", 4790)
- add:
function: 'string'
params:
key: log.eventName
value: 'A basic application group was changed'
- where: safe("log.eventCode", 0.0)==double(4791)
+ where: equals("log.eventCode", 4791)
- add:
function: 'string'
params:
key: log.eventName
value: 'An LDAP query group was deleted'
- where: safe("log.eventCode", 0.0)==double(4792)
+ where: equals("log.eventCode", 4792)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Password Policy Checking API was called'
- where: safe("log.eventCode", 0.0)==double(4793)
+ where: equals("log.eventCode", 4793)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt was made to set the Directory Services Restore Mode administrator password'
- where: safe("log.eventCode", 0.0)==double(4794)
+ where: equals("log.eventCode", 4794)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt was made to query the existence of a blank password for an account'
- where: safe("log.eventCode", 0.0)==double(4797)
+ where: equals("log.eventCode", 4797)
- add:
function: 'string'
params:
key: log.eventName
value: 'A users local group membership was enumerated.'
- where: safe("log.eventCode", 0.0)==double(4798)
+ where: equals("log.eventCode", 4798)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security-enabled local group membership was enumerated'
- where: safe("log.eventCode", 0.0)==double(4799)
+ where: equals("log.eventCode", 4799)
- add:
function: 'string'
params:
key: log.eventName
value: 'The workstation was locked'
- where: safe("log.eventCode", 0.0)==double(4800)
+ where: equals("log.eventCode", 4800)
- add:
function: 'string'
params:
key: log.eventName
value: 'The workstation was unlocked'
- where: safe("log.eventCode", 0.0)==double(4801)
+ where: equals("log.eventCode", 4801)
- add:
function: 'string'
params:
key: log.eventName
value: 'The screen saver was invoked'
- where: safe("log.eventCode", 0.0)==double(4802)
+ where: equals("log.eventCode", 4802)
- add:
function: 'string'
params:
key: log.eventName
value: 'The screen saver was dismissed'
- where: safe("log.eventCode", 0.0)==double(4803)
+ where: equals("log.eventCode", 4803)
- add:
function: 'string'
params:
key: log.eventName
value: 'RPC detected an integrity violation while decrypting an incoming message'
- where: safe("log.eventCode", 0.0)==double(4816)
+ where: equals("log.eventCode", 4816)
- add:
function: 'string'
params:
key: log.eventName
value: 'Auditing settings on object were changed.'
- where: safe("log.eventCode", 0.0)==double(4817)
+ where: equals("log.eventCode", 4817)
- add:
function: 'string'
params:
key: log.eventName
value: 'Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy'
- where: safe("log.eventCode", 0.0)==double(4818)
+ where: equals("log.eventCode", 4818)
- add:
function: 'string'
params:
key: log.eventName
value: 'Central Access Policies on the machine have been changed'
- where: safe("log.eventCode", 0.0)==double(4819)
+ where: equals("log.eventCode", 4819)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions'
- where: safe("log.eventCode", 0.0)==double(4820)
+ where: equals("log.eventCode", 4820)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Kerberos service ticket was denied because the user: device: or both does not meet the access control restrictions'
- where: safe("log.eventCode", 0.0)==double(4821)
+ where: equals("log.eventCode", 4821)
- add:
function: 'string'
params:
key: log.eventName
value: 'NTLM authentication failed because the account was a member of the Protected User group'
- where: safe("log.eventCode", 0.0)==double(4822)
+ where: equals("log.eventCode", 4822)
- add:
function: 'string'
params:
key: log.eventName
value: 'NTLM authentication failed because access control restrictions are required'
- where: safe("log.eventCode", 0.0)==double(4823)
+ where: equals("log.eventCode", 4823)
- add:
function: 'string'
params:
key: log.eventName
value: 'Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group'
- where: safe("log.eventCode", 0.0)==double(4824)
+ where: equals("log.eventCode", 4824)
- add:
function: 'string'
params:
key: log.eventName
value: 'A user was denied the access to Remote Desktop. By default: users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group'
- where: safe("log.eventCode", 0.0)==double(4825)
+ where: equals("log.eventCode", 4825)
- add:
function: 'string'
params:
key: log.eventName
value: 'SID History was removed from an account'
- where: safe("log.eventCode", 0.0)==double(4830)
+ where: equals("log.eventCode", 4830)
- add:
function: 'string'
params:
key: log.eventName
value: 'A trusted forest information entry was added'
- where: safe("log.eventCode", 0.0)==double(4865)
+ where: equals("log.eventCode", 4865)
- add:
function: 'string'
params:
key: log.eventName
value: 'A trusted forest information entry was modified'
- where: safe("log.eventCode", 0.0)==double(4867)
+ where: equals("log.eventCode", 4867)
- add:
function: 'string'
params:
key: log.eventName
value: 'The certificate manager denied a pending certificate request'
- where: safe("log.eventCode", 0.0)==double(4868)
+ where: equals("log.eventCode", 4868)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services received a resubmitted certificate request'
- where: safe("log.eventCode", 0.0)==double(4869)
+ where: equals("log.eventCode", 4869)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services revoked a certificate'
- where: safe("log.eventCode", 0.0)==double(4870)
+ where: equals("log.eventCode", 4870)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services received a request to publish the certificate revocation list (CRL)'
- where: safe("log.eventCode", 0.0)==double(4871)
+ where: equals("log.eventCode", 4871)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services published the certificate revocation list (CRL)'
- where: safe("log.eventCode", 0.0)==double(4872)
+ where: equals("log.eventCode", 4872)
- add:
function: 'string'
params:
key: log.eventName
value: 'A certificate request extension changed'
- where: safe("log.eventCode", 0.0)==double(4873)
+ where: equals("log.eventCode", 4873)
- add:
function: 'string'
params:
key: log.eventName
value: 'One or more certificate request attributes changed.'
- where: safe("log.eventCode", 0.0)==double(4874)
+ where: equals("log.eventCode", 4874)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services received a request to shut down'
- where: safe("log.eventCode", 0.0)==double(4875)
+ where: equals("log.eventCode", 4875)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services backup started'
- where: safe("log.eventCode", 0.0)==double(4876)
+ where: equals("log.eventCode", 4876)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services backup completed'
- where: safe("log.eventCode", 0.0)==double(4877)
+ where: equals("log.eventCode", 4877)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services restore started'
- where: safe("log.eventCode", 0.0)==double(4878)
+ where: equals("log.eventCode", 4878)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services restore completed'
- where: safe("log.eventCode", 0.0)==double(4879)
+ where: equals("log.eventCode", 4879)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services started'
- where: safe("log.eventCode", 0.0)==double(4880)
+ where: equals("log.eventCode", 4880)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services stopped'
- where: safe("log.eventCode", 0.0)==double(4881)
+ where: equals("log.eventCode", 4881)
- add:
function: 'string'
params:
key: log.eventName
value: 'The security permissions for Certificate Services changed'
- where: safe("log.eventCode", 0.0)==double(4882)
+ where: equals("log.eventCode", 4882)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services retrieved an archived key'
- where: safe("log.eventCode", 0.0)==double(4883)
+ where: equals("log.eventCode", 4883)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services imported a certificate into its database'
- where: safe("log.eventCode", 0.0)==double(4884)
+ where: equals("log.eventCode", 4884)
- add:
function: 'string'
params:
key: log.eventName
value: 'The audit filter for Certificate Services changed'
- where: safe("log.eventCode", 0.0)==double(4885)
+ where: equals("log.eventCode", 4885)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services received a certificate request'
- where: safe("log.eventCode", 0.0)==double(4886)
+ where: equals("log.eventCode", 4886)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services approved a certificate request and issued a certificate'
- where: safe("log.eventCode", 0.0)==double(4887)
+ where: equals("log.eventCode", 4887)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services denied a certificate request'
- where: safe("log.eventCode", 0.0)==double(4888)
+ where: equals("log.eventCode", 4888)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services set the status of a certificate request to pending'
- where: safe("log.eventCode", 0.0)==double(4889)
+ where: equals("log.eventCode", 4889)
- add:
function: 'string'
params:
key: log.eventName
value: 'The certificate manager settings for Certificate Services changed.'
- where: safe("log.eventCode", 0.0)==double(4890)
+ where: equals("log.eventCode", 4890)
- add:
function: 'string'
params:
key: log.eventName
value: 'A configuration entry changed in Certificate Services'
- where: safe("log.eventCode", 0.0)==double(4891)
+ where: equals("log.eventCode", 4891)
- add:
function: 'string'
params:
key: log.eventName
value: 'A property of Certificate Services changed'
- where: safe("log.eventCode", 0.0)==double(4892)
+ where: equals("log.eventCode", 4892)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services archived a key'
- where: safe("log.eventCode", 0.0)==double(4893)
+ where: equals("log.eventCode", 4893)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services imported and archived a key'
- where: safe("log.eventCode", 0.0)==double(4894)
+ where: equals("log.eventCode", 4894)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services published the CA certificate to Active Directory Domain Services'
- where: safe("log.eventCode", 0.0)==double(4895)
+ where: equals("log.eventCode", 4895)
- add:
function: 'string'
params:
key: log.eventName
value: 'One or more rows have been deleted from the certificate database'
- where: safe("log.eventCode", 0.0)==double(4896)
+ where: equals("log.eventCode", 4896)
- add:
function: 'string'
params:
key: log.eventName
value: 'Role separation enabled'
- where: safe("log.eventCode", 0.0)==double(4897)
+ where: equals("log.eventCode", 4897)
- add:
function: 'string'
params:
key: log.eventName
value: 'Certificate Services template security was updated'
- where: safe("log.eventCode", 0.0)==double(4900)
+ where: equals("log.eventCode", 4900)
- add:
function: 'string'
params:
key: log.eventName
value: 'Auditing settings on object were changed'
- where: safe("log.eventCode", 0.0)==double(4907)
+ where: equals("log.eventCode", 4907)
- add:
function: 'string'
params:
key: log.eventName
value: 'Special Groups Logon table modified'
- where: safe("log.eventCode", 0.0)==double(4908)
+ where: equals("log.eventCode", 4908)
- add:
function: 'string'
params:
key: log.eventName
value: 'Per User Audit Policy was changed'
- where: safe("log.eventCode", 0.0)==double(4912)
+ where: equals("log.eventCode", 4912)
- add:
function: 'string'
params:
key: log.eventName
value: 'Central Access Policy on the object was changed'
- where: safe("log.eventCode", 0.0)==double(4913)
+ where: equals("log.eventCode", 4913)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to Windows Firewall exception list. A rule was added'
- where: safe("log.eventCode", 0.0)==double(4946)
+ where: equals("log.eventCode", 4946)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to Windows Firewall exception list. A rule was modified'
- where: safe("log.eventCode", 0.0)==double(4947)
+ where: equals("log.eventCode", 4947)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to Windows Firewall exception list. A rule was deleted'
- where: safe("log.eventCode", 0.0)==double(4948)
+ where: equals("log.eventCode", 4948)
- add:
function: 'string'
params:
key: log.eventName
value: 'Windows Firewall settings were restored to the default values'
- where: safe("log.eventCode", 0.0)==double(4949)
+ where: equals("log.eventCode", 4949)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Windows Firewall setting has changed'
- where: safe("log.eventCode", 0.0)==double(4950)
+ where: equals("log.eventCode", 4950)
- add:
function: 'string'
params:
key: log.eventName
value: 'Windows Firewall Group Policy settings has changed. The new settings have been applied'
- where: safe("log.eventCode", 0.0)==double(4954)
+ where: equals("log.eventCode", 4954)
- add:
function: 'string'
params:
key: log.eventName
value: 'Windows Firewall has changed the active profile'
- where: safe("log.eventCode", 0.0)==double(4956)
+ where: equals("log.eventCode", 4956)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec dropped an inbound packet that failed an integrity check'
- where: safe("log.eventCode", 0.0)==double(4960)
+ where: equals("log.eventCode", 4960)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec dropped an inbound packet that failed a replay check'
- where: safe("log.eventCode", 0.0)==double(4961)
+ where: equals("log.eventCode", 4961)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec dropped an inbound packet that failed a replay check'
- where: safe("log.eventCode", 0.0)==double(4962)
+ where: equals("log.eventCode", 4962)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec dropped an inbound clear text packet that should have been secured'
- where: safe("log.eventCode", 0.0)==double(4963)
+ where: equals("log.eventCode", 4963)
- add:
function: 'string'
params:
key: log.eventName
value: 'Special groups have been assigned to a new logon'
- where: safe("log.eventCode", 0.0)==double(4964)
+ where: equals("log.eventCode", 4964)
- add:
function: 'string'
params:
key: log.eventName
value: 'During Main Mode negotiation: IPsec received an invalid negotiation packet.'
- where: safe("log.eventCode", 0.0)==double(4976)
+ where: equals("log.eventCode", 4976)
- add:
function: 'string'
params:
key: log.eventName
value: 'During Quick Mode negotiation: IPsec received an invalid negotiation packet.'
- where: safe("log.eventCode", 0.0)==double(4977)
+ where: equals("log.eventCode", 4977)
- add:
function: 'string'
params:
key: log.eventName
value: 'During Extended Mode negotiation: IPsec received an invalid negotiation packet.'
- where: safe("log.eventCode", 0.0)==double(4978)
+ where: equals("log.eventCode", 4978)
- add:
function: 'string'
params:
key: log.eventName
value: 'Antimalware engine encountered an error and failed'
- where: safe("log.eventCode", 0.0)==double(5008)
+ where: equals("log.eventCode", 5008)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Firewall Service has been stopped'
- where: safe("log.eventCode", 0.0)==double(5025)
+ where: equals("log.eventCode", 5025)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Firewall Service failed to start'
- where: safe("log.eventCode", 0.0)==double(5030)
+ where: equals("log.eventCode", 5030)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Firewall Service blocked an application from accepting incoming connections on the network.'
- where: safe("log.eventCode", 0.0)==double(5031)
+ where: equals("log.eventCode", 5031)
- add:
function: 'string'
params:
key: log.eventName
value: 'Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network'
- where: safe("log.eventCode", 0.0)==double(5032)
+ where: equals("log.eventCode", 5032)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Firewall Driver detected critical runtime error. Terminating'
- where: safe("log.eventCode", 0.0)==double(5037)
+ where: equals("log.eventCode", 5037)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. An Authentication Set was added.'
- where: safe("log.eventCode", 0.0)==double(5040)
+ where: equals("log.eventCode", 5040)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. An Authentication Set was modified'
- where: safe("log.eventCode", 0.0)==double(5041)
+ where: equals("log.eventCode", 5041)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. An Authentication Set was deleted'
- where: safe("log.eventCode", 0.0)==double(5042)
+ where: equals("log.eventCode", 5042)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. A Connection Security Rule was added'
- where: safe("log.eventCode", 0.0)==double(5043)
+ where: equals("log.eventCode", 5043)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. A Connection Security Rule was modified'
- where: safe("log.eventCode", 0.0)==double(5044)
+ where: equals("log.eventCode", 5044)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. A Connection Security Rule was deleted'
- where: safe("log.eventCode", 0.0)==double(5045)
+ where: equals("log.eventCode", 5045)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. A Crypto Set was added'
- where: safe("log.eventCode", 0.0)==double(5046)
+ where: equals("log.eventCode", 5046)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. A Crypto Set was modified'
- where: safe("log.eventCode", 0.0)==double(5047)
+ where: equals("log.eventCode", 5047)
- add:
function: 'string'
params:
key: log.eventName
value: 'A change has been made to IPsec settings. A Crypto Set was deleted'
- where: safe("log.eventCode", 0.0)==double(5048)
+ where: equals("log.eventCode", 5048)
- add:
function: 'string'
params:
key: log.eventName
value: 'An IPsec Security Association was deleted'
- where: safe("log.eventCode", 0.0)==double(5049)
+ where: equals("log.eventCode", 5049)
- add:
function: 'string'
params:
key: log.eventName
value: 'An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE)'
- where: safe("log.eventCode", 0.0)==double(5050)
+ where: equals("log.eventCode", 5050)
- add:
function: 'string'
params:
key: log.eventName
value: 'A security setting was updated on OCSP Responder Service'
- where: safe("log.eventCode", 0.0)==double(5124)
+ where: equals("log.eventCode", 5124)
- add:
function: 'string'
params:
key: log.eventName
value: 'A directory service object was modified'
- where: safe("log.eventCode", 0.0)==double(5136)
+ where: equals("log.eventCode", 5136)
- add:
function: 'string'
params:
key: log.eventName
value: 'A network share object was accessed'
- where: safe("log.eventCode", 0.0)==double(5140)
+ where: equals("log.eventCode", 5140)
- add:
function: 'string'
params:
key: log.eventName
value: 'A network share object was added.'
- where: safe("log.eventCode", 0.0)==double(5142)
+ where: equals("log.eventCode", 5142)
- add:
function: 'string'
params:
key: log.eventName
value: 'A network share object was modified'
- where: safe("log.eventCode", 0.0)==double(5143)
+ where: equals("log.eventCode", 5143)
- add:
function: 'string'
params:
key: log.eventName
value: 'A network share object was deleted.'
- where: safe("log.eventCode", 0.0)==double(5144)
+ where: equals("log.eventCode", 5144)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has blocked a packet'
- where: safe("log.eventCode", 0.0)==double(5146)
+ where: equals("log.eventCode", 5146)
- add:
function: 'string'
params:
key: log.eventName
value: 'A more restrictive Windows Filtering Platform filter has blocked a packet'
- where: safe("log.eventCode", 0.0)==double(5147)
+ where: equals("log.eventCode", 5147)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.'
- where: safe("log.eventCode", 0.0)==double(5148)
+ where: equals("log.eventCode", 5148)
- add:
function: 'string'
params:
key: log.eventName
value: 'The DoS attack has subsided and normal processing is being resumed.'
- where: safe("log.eventCode", 0.0)==double(5149)
+ where: equals("log.eventCode", 5149)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has blocked a packet.'
- where: safe("log.eventCode", 0.0)==double(5150)
+ where: equals("log.eventCode", 5150)
- add:
function: 'string'
params:
key: log.eventName
value: 'A more restrictive Windows Filtering Platform filter has blocked a packet.'
- where: safe("log.eventCode", 0.0)==double(5151)
+ where: equals("log.eventCode", 5151)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform blocked a packet'
- where: safe("log.eventCode", 0.0)==double(5152)
+ where: equals("log.eventCode", 5152)
- add:
function: 'string'
params:
key: log.eventName
value: 'A more restrictive Windows Filtering Platform filter has blocked a packet'
- where: safe("log.eventCode", 0.0)==double(5153)
+ where: equals("log.eventCode", 5153)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections'
- where: safe("log.eventCode", 0.0)==double(5154)
+ where: equals("log.eventCode", 5154)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections'
- where: safe("log.eventCode", 0.0)==double(5155)
+ where: equals("log.eventCode", 5155)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has allowed a connection'
- where: safe("log.eventCode", 0.0)==double(5156)
+ where: equals("log.eventCode", 5156)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has blocked a connection'
- where: safe("log.eventCode", 0.0)==double(5157)
+ where: equals("log.eventCode", 5157)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has permitted a bind to a local port'
- where: safe("log.eventCode", 0.0)==double(5158)
+ where: equals("log.eventCode", 5158)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Windows Filtering Platform has blocked a bind to a local port'
- where: safe("log.eventCode", 0.0)==double(5159)
+ where: equals("log.eventCode", 5159)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Windows Filtering Platform filter has been changed'
- where: safe("log.eventCode", 0.0)==double(5447)
+ where: equals("log.eventCode", 5447)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Windows Filtering Platform provider has been changed'
- where: safe("log.eventCode", 0.0)==double(5448)
+ where: equals("log.eventCode", 5448)
- add:
function: 'string'
params:
key: log.eventName
value: 'A Windows Filtering Platform provider context has been changed'
- where: safe("log.eventCode", 0.0)==double(5449)
+ where: equals("log.eventCode", 5449)
- add:
function: 'string'
params:
key: log.eventName
value: 'An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started'
- where: safe("log.eventCode", 0.0)==double(5453)
+ where: equals("log.eventCode", 5453)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec Services has been shut down successfully'
- where: safe("log.eventCode", 0.0)==double(5479)
+ where: equals("log.eventCode", 5479)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec Services failed to get the complete list of network interfaces on the computer'
- where: safe("log.eventCode", 0.0)==double(5480)
+ where: equals("log.eventCode", 5480)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec Services failed to initialize RPC server. IPsec Services could not be started'
- where: safe("log.eventCode", 0.0)==double(5483)
+ where: equals("log.eventCode", 5483)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec Services has experienced a critical failure and has been shut down'
- where: safe("log.eventCode", 0.0)==double(5484)
+ where: equals("log.eventCode", 5484)
- add:
function: 'string'
params:
key: log.eventName
value: 'IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces'
- where: safe("log.eventCode", 0.0)==double(5485)
+ where: equals("log.eventCode", 5485)
- add:
function: 'string'
params:
key: log.eventName
value: 'A request was made to authenticate to a wireless network'
- where: safe("log.eventCode", 0.0)==double(5632)
+ where: equals("log.eventCode", 5632)
- add:
function: 'string'
params:
key: log.eventName
value: 'A request was made to authenticate to a wired network'
- where: safe("log.eventCode", 0.0)==double(5633)
+ where: equals("log.eventCode", 5633)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Netlogon service denied a vulnerable Netlogon secure channel connection from a machine account.'
- where: safe("log.eventCode", 0.0)==double(5827)
+ where: equals("log.eventCode", 5827)
- add:
function: 'string'
params:
key: log.eventName
value: 'The Netlogon service denied a vulnerable Netlogon secure channel connection using a trust account.'
- where: safe("log.eventCode", 0.0)==double(5828)
+ where: equals("log.eventCode", 5828)
- add:
function: 'string'
params:
key: log.eventName
value: 'Security policy in the group policy objects has been applied successfully'
- where: safe("log.eventCode", 0.0)==double(6144)
+ where: equals("log.eventCode", 6144)
- add:
function: 'string'
params:
key: log.eventName
value: 'Network Policy Server granted access to a user'
- where: safe("log.eventCode", 0.0)==double(6272)
+ where: equals("log.eventCode", 6272)
- add:
function: 'string'
params:
key: log.eventName
value: 'Network Policy Server denied access to a user'
- where: safe("log.eventCode", 0.0)==double(6273)
+ where: equals("log.eventCode", 6273)
- add:
function: 'string'
params:
key: log.eventName
value: 'Network Policy Server quarantined a user'
- where: safe("log.eventCode", 0.0)==double(6276)
+ where: equals("log.eventCode", 6276)
- add:
function: 'string'
params:
key: log.eventName
value: 'Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy'
- where: safe("log.eventCode", 0.0)==double(6277)
+ where: equals("log.eventCode", 6277)
- add:
function: 'string'
params:
key: log.eventName
value: 'Network Policy Server granted full access to a user because the host met the defined health policy'
- where: safe("log.eventCode", 0.0)==double(6278)
+ where: equals("log.eventCode", 6278)
- add:
function: 'string'
params:
key: log.eventName
value: 'Network Policy Server locked the user account due to repeated failed authentication attempts'
- where: safe("log.eventCode", 0.0)==double(6279)
+ where: equals("log.eventCode", 6279)
- add:
function: 'string'
params:
key: log.eventName
value: 'Network Policy Server unlocked the user account'
- where: safe("log.eventCode", 0.0)==double(6280)
+ where: equals("log.eventCode", 6280)
- add:
function: 'string'
params:
key: log.eventName
value: 'BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.'
- where: safe("log.eventCode", 0.0)==double(6404)
+ where: equals("log.eventCode", 6404)
- add:
function: 'string'
params:
key: log.eventName
value: 'A new external device was recognized by the system.'
- where: safe("log.eventCode", 0.0)==double(6416)
+ where: equals("log.eventCode", 6416)
- add:
function: 'string'
params:
key: log.eventName
value: 'A request was made to disable a device'
- where: safe("log.eventCode", 0.0)==double(6419)
+ where: equals("log.eventCode", 6419)
- add:
function: 'string'
params:
key: log.eventName
value: 'A device was disabled'
- where: safe("log.eventCode", 0.0)==double(6420)
+ where: equals("log.eventCode", 6420)
- add:
function: 'string'
params:
key: log.eventName
value: 'A request was made to enable a device'
- where: safe("log.eventCode", 0.0)==double(6421)
+ where: equals("log.eventCode", 6421)
- add:
function: 'string'
params:
key: log.eventName
value: 'A device was enabled'
- where: safe("log.eventCode", 0.0)==double(6422)
+ where: equals("log.eventCode", 6422)
- add:
function: 'string'
params:
key: log.eventName
value: 'An application or service has attempted to use DCOM without having the necessary permissions.'
- where: safe("log.eventCode", 0.0)==double(10016)
+ where: equals("log.eventCode", 10016)
- add:
function: 'string'
params:
key: log.eventName
value: 'Encryption of volume started.'
- where: safe("log.eventCode", 0.0)==double(24577)
+ where: equals("log.eventCode", 24577)
- add:
function: 'string'
params:
key: log.eventName
value: 'Decryption of volume started.'
- where: safe("log.eventCode", 0.0)==double(24580)
+ where: equals("log.eventCode", 24580)
# Decoding the "failureReason" field when the event code is 4625 and adding the "failureReasonDescription" field
- add:
@@ -2293,49 +2293,49 @@ pipeline:
params:
key: log.failureReasonDescription
value: 'The specified user account has expired.'
- where: safe("log.winlogEventDataFailureReason", "") == "%%2305" && safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.winlogEventDataFailureReason", "%%2305") && equals("log.eventCode", 4625)
- add:
function: 'string'
params:
key: log.failureReasonDescription
value: 'The password for the specified account has expired'
- where: safe("log.winlogEventDataFailureReason", "") == "%%2309" && safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.winlogEventDataFailureReason", "%%2309") && equals("log.eventCode", 4625)
- add:
function: 'string'
params:
key: log.failureReasonDescription
value: 'Account currently disabled'
- where: safe("log.winlogEventDataFailureReason", "") == "%%2310" && safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.winlogEventDataFailureReason", "%%2310") && equals("log.eventCode", 4625)
- add:
function: 'string'
params:
key: log.failureReasonDescription
value: 'Account logon time restriction violation'
- where: safe("log.winlogEventDataFailureReason", "") == "%%2311" && safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.winlogEventDataFailureReason", "%%2311") && equals("log.eventCode", 4625)
- add:
function: 'string'
params:
key: log.failureReasonDescription
value: 'User not allowed to logon at this computer'
- where: safe("log.winlogEventDataFailureReason", "") == "%%2312" && safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.winlogEventDataFailureReason", "%%2312") && equals("log.eventCode", 4625)
- add:
function: 'string'
params:
key: log.failureReasonDescription
value: 'Unknown user name or bad password'
- where: safe("log.winlogEventDataFailureReason", "") == "%%2313" && safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.winlogEventDataFailureReason", "%%2313") && equals("log.eventCode", 4625)
- add:
function: 'string'
params:
key: log.failureReasonDescription
value: 'An Error occurred during Logon'
- where: safe("log.winlogEventDataFailureReason", "") == "%%2304" && safe("log.eventCode", 0.0)==double(4625)
+ where: equals("log.winlogEventDataFailureReason", "%%2304") && equals("log.eventCode", 4625)
# Decoding the "AccessMask" field when the event code is 4663 and adding the "accessType" and "accessDescription" field
- add:
@@ -2343,210 +2343,210 @@ pipeline:
params:
key: log.accessType
value: 'read'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x1" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x1") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'For a file object, the right to read the corresponding file data. For a directory object, the right to read the corresponding directory data.\n For a directory, the right to list the contents of the directory.\n For registry objects, this is, Query key value.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x1" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x1") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'write'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x2" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x2") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'For a file object, the right to write data to the file.\n For a directory object, the right to create a file in the directory.\n For registry objects, this is, Set key value.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x2" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x2") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'append'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x4" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x4") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'For a file object, the right to append data to the file. (For local files, write operations will not overwrite existing data if this flag is specified without FILE_WRITE_DATA.)\n For a directory object, the right to create a subdirectory.\n For a named pipe, the right to create a pipe.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x4" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x4") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'read_extended_attributes'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x8" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x8") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to read extended file attributes.\n For registry objects, this is, Enumerate sub-keys.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x8" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x8") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'write_extended_attributes'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x10" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x10") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to write extended file attributes.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x10" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x10") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'execute'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x20" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x20") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'For a native code file, the right to execute the file. This access right given to scripts may cause the script to be executable, depending on the script interpreter.\n For a directory, the right to traverse the directory. By default, users are assigned the BYPASS_TRAVERSE_CHECKING privilege, which ignores the FILE_TRAVERSE access right.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x20" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x20") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'delete_child'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x40" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x40") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'For a directory, the right to delete a directory and all the files it contains, including read-only files.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x40" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x40") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'read_attributes'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x80" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x80") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to read file attributes.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x80" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x80") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'write_attributes'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x100" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x100") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to write file attributes.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x100" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x100") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'delete'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x10000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x10000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to delete the object.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x10000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x10000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'read_control'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x20000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x20000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to read information in the security descriptor object, without including the information in the system access control list (SACL).'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x20000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x20000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'write_dac'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x40000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x40000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to modify the discretionary access control list (DACL) in the security descriptor object.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x40000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x40000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'write_owner'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x80000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x80000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to change the owner in the security descriptor object'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x80000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x80000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'synchronize'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x100000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x100000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x100000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x100000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessType
value: 'access_sys_sec'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x1000000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x1000000") && equals("log.eventCode", 4663)
- add:
function: 'string'
params:
key: log.accessDescription
value: 'The ACCESS_SYS_SEC access right controls the ability to get or set the SACL in an security descriptor object.'
- where: safe("log.winlogEeventDataAccessMask", "") == "0x1000000" && safe("log.eventCode", 0.0)==double(4663)
+ where: equals("log.winlogEeventDataAccessMask", "0x1000000") && equals("log.eventCode", 4663)
# Decoding the "eventStatus" field
- add:
@@ -2554,91 +2554,91 @@ pipeline:
params:
key: log.statusDescription
value: 'Account locked out'
- where: safe("log.winlogEventDataStatus", "") == "0xC0000234"
+ where: equals("log.winlogEventDataStatus", "0xC0000234")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Account expired'
- where: safe("log.winlogEventDataStatus", "") == "0xC0000193"
+ where: equals("log.winlogEventDataStatus", "0xC0000193")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Clocks out of sync'
- where: safe("log.winlogEventDataStatus", "") == "0xC0000133"
+ where: equals("log.winlogEventDataStatus", "0xC0000133")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Password change required'
- where: safe("log.winlogEventDataStatus", "") == "0xC0000224"
+ where: equals("log.winlogEventDataStatus", "0xC0000224")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'User does not have logon right'
- where: safe("log.winlogEventDataStatus", "") == "0xc000015b"
+ where: equals("log.winlogEventDataStatus", "0xc000015b")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Logon failure'
- where: safe("log.winlogEventDataStatus", "") == "0xc000006d"
+ where: equals("log.winlogEventDataStatus", "0xc000006d")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Account restriction'
- where: safe("log.winlogEventDataStatus", "") == "0xc000006e"
+ where: equals("log.winlogEventDataStatus", "0xc000006e")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'An error occurred during logon'
- where: safe("log.winlogEventDataStatus", "") == "0xc00002ee"
+ where: equals("log.winlogEventDataStatus", "0xc00002ee")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Password expired'
- where: safe("log.winlogEventDataStatus", "") == "0xC0000071"
+ where: equals("log.winlogEventDataStatus", "0xC0000071")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Account disabled'
- where: safe("log.winlogEventDataStatus", "") == "0xC0000072"
+ where: equals("log.winlogEventDataStatus", "0xC0000072")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Authentication firewall prohibits logon'
- where: safe("log.winlogEventDataStatus", "") == "0xC0000413"
+ where: equals("log.winlogEventDataStatus", "0xC0000413")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Incorrect password'
- where: safe("log.winlogEventDataStatus", "") == "0xc000006a"
+ where: equals("log.winlogEventDataStatus", "0xc000006a")
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Account does not exist'
- where: safe("log.winlogEventDataStatus", "") == "0xc0000064"
+ where: equals("log.winlogEventDataStatus", "0xc0000064")
# Decoding the "eventStatus" field when the event code is 4771 and adding the "statusDescription"
- add:
@@ -2646,322 +2646,322 @@ pipeline:
params:
key: log.statusDescription
value: 'Customer database entry has expired'
- where: safe("log.winlogEventDataStatus", "") == "0x1" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x1") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'The server database entry has expired'
- where: safe("log.winlogEventDataStatus", "") =="0x2" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x2") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Requested protocol version not supported'
- where: safe("log.winlogEventDataStatus", "") == "0x3" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x3") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Customer key encrypted in old master key'
- where: safe("log.winlogEventDataStatus", "") == "0x4" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x4") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Server key encrypted with old master key'
- where: safe("log.winlogEventDataStatus", "") == "0x5" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x5") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Client not found in Kerberos database'
- where: safe("log.winlogEventDataStatus", "") == "0x6" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x6") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Server not found in Kerberos database'
- where: safe("log.winlogEventDataStatus", "") == "0x7" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x7") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Multiple principal entries in database'
- where: safe("log.winlogEventDataStatus", "") == "0x8" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x8") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'The client or server has a null key'
- where: safe("log.winlogEventDataStatus", "") == "0x9" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x9") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Ticket not eligible for postdating'
- where: safe("log.winlogEventDataStatus", "") == "0xA" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0xA") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Requested start time is later than end time'
- where: safe("log.winlogEventDataStatus", "") == "0xB" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0xB") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'KDC policy rejects request'
- where: safe("log.winlogEventDataStatus", "") == "0xC" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0xC") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'KDC cannot accommodate requested option'
- where: safe("log.winlogEventDataStatus", "") == "0xD" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0xD") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'KDC has no support for encryption type'
- where: safe("log.winlogEventDataStatus", "") == "0xE" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0xE") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'KDC has no support for checksum type'
- where: safe("log.winlogEventDataStatus", "") == "0xF" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0xF") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'KDC has no support for padata type'
- where: safe("log.winlogEventDataStatus", "") == "0x10" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x10") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'KDC has no support for transited type'
- where: safe("log.winlogEventDataStatus", "") == "0x11" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x11") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Clients credentials have been revoked'
- where: safe("log.winlogEventDataStatus", "") == "0x12" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x12") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Credentials for server have been revoked'
- where: safe("log.winlogEventDataStatus", "") == "0x13" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x13") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'TGT has been revoked'
- where: safe("log.winlogEventDataStatus", "") == "0x14" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x14") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Client not yet valid - try again later'
- where: safe("log.winlogEventDataStatus", "") == "0x15" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x15") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Server not yet valid - try again later'
- where: safe("log.winlogEventDataStatus", "") == "0x16" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x16") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Password has expired'
- where: safe("log.winlogEventDataStatus", "") == "0x17" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x17") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Pre-authentication information was invalid'
- where: safe("log.winlogEventDataStatus", "") == "0x18" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x18") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Additional pre-authentication required'
- where: safe("log.winlogEventDataStatus", "") == "0x19" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x19") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Integrity check on decrypted field failed'
- where: safe("log.winlogEventDataStatus", "") == "0x1F" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x1F") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Ticket expired'
- where: safe("log.winlogEventDataStatus", "") == "0x20" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x20") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Ticket not yet valid'
- where: safe("log.winlogEventDataStatus", "") == "0x21" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x21") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Request is a replay'
- where: safe("log.winlogEventDataStatus", "") == "0x22" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x22") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'The ticket is not for us'
- where: safe("log.winlogEventDataStatus", "") == "0x23" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x23") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Ticket and authenticator is not match'
- where: safe("log.winlogEventDataStatus", "") == "0x24" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x24") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Clock skew too great'
- where: safe("log.winlogEventDataStatus", "") == "0x25" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x25") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Incorrect net address'
- where: safe("log.winlogEventDataStatus", "") == "0x26" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x26") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Protocol version mismatch'
- where: safe("log.winlogEventDataStatus", "") == "0x27" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x27") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Invalid msg type'
- where: safe("log.winlogEventDataStatus", "") == "0x28" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x28") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Message stream modified'
- where: safe("log.winlogEventDataStatus", "") == "0x29" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x29") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Message out of order'
- where: safe("log.winlogEventDataStatus", "") == "0x2A" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x2A") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Specified version of key is not available'
- where: safe("log.winlogEventDataStatus", "") == "0x2C" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x2C") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Service key not available'
- where: safe("log.winlogEventDataStatus", "") == "0x2D" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x2D") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Mutual authentication failed'
- where: safe("log.winlogEventDataStatus", "") == "0x2E" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x2E") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Incorrect message direction'
- where: safe("log.winlogEventDataStatus", "") == "0x2F" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x2F") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Alternative authentication method required'
- where: safe("log.winlogEventDataStatus", "") == "0x30" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x30") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Incorrect sequence number in message'
- where: safe("log.winlogEventDataStatus", "") == "0x31" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x31") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Inappropriate type of checksum in message'
- where: safe("log.winlogEventDataStatus", "") == "0x32" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x32") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Generic error (description in e-text)'
- where: safe("log.winlogEventDataStatus", "") == "0x3C" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x3C") && equals("log.eventCode", 4771)
- add:
function: 'string'
params:
key: log.statusDescription
value: 'Field is too long for this implementation'
- where: safe("log.winlogEventDataStatus", "") == "0x3D" && safe("log.eventCode", 0.0)==double(4771)
+ where: equals("log.winlogEventDataStatus", "0x3D") && equals("log.eventCode", 4771)
- delete:
fields:
diff --git a/frontend/src/app/app-management/utm-api-doc/utm-api-doc.component.html b/frontend/src/app/app-management/utm-api-doc/utm-api-doc.component.html
index d21f11edd..a9d639a76 100644
--- a/frontend/src/app/app-management/utm-api-doc/utm-api-doc.component.html
+++ b/frontend/src/app/app-management/utm-api-doc/utm-api-doc.component.html
@@ -6,7 +6,7 @@