| 1 | { |
| 2 | "v": 1, |
| 3 | "id": "e8336a90-fc5d-40b5-9988-6f2d31997964", |
| 4 | "rev": 1, |
| 5 | "name": "SOCFORTRESS_CROWDSTRIKE_PROCESSING_PIPELINE", |
| 6 | "summary": "SOCFORTRESS_CROWDSTRIKE_PROCESSING_PIPELINE", |
| 7 | "description": "", |
| 8 | "vendor": "SOCFortress", |
| 9 | "url": "", |
| 10 | "parameters": [], |
| 11 | "entities": [ |
| 12 | { |
| 13 | "v": "1", |
| 14 | "type": { |
| 15 | "name": "pipeline_rule", |
| 16 | "version": "1" |
| 17 | }, |
| 18 | "id": "96fd8f92-220f-4b1b-b919-0a3673dda620", |
| 19 | "data": { |
| 20 | "title": { |
| 21 | "@type": "string", |
| 22 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Info" |
| 23 | }, |
| 24 | "description": { |
| 25 | "@type": "string", |
| 26 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Info" |
| 27 | }, |
| 28 | "source": { |
| 29 | "@type": "string", |
| 30 | "@value": "rule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Info\"\nwhen has_field(\"severity\") AND to_long($message.severity) == 1\nthen\nset_field(\"syslog_level\", \"Info\");\nend" |
| 31 | } |
| 32 | }, |
| 33 | "constraints": [ |
| 34 | { |
| 35 | "type": "server-version", |
| 36 | "version": ">=5.0.13+083613e" |
| 37 | } |
| 38 | ] |
| 39 | }, |
| 40 | { |
| 41 | "v": "1", |
| 42 | "type": { |
| 43 | "name": "pipeline_rule", |
| 44 | "version": "1" |
| 45 | }, |
| 46 | "id": "c90a44d2-c749-440b-936d-6f647f4ecb12", |
| 47 | "data": { |
| 48 | "title": { |
| 49 | "@type": "string", |
| 50 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Warning" |
| 51 | }, |
| 52 | "description": { |
| 53 | "@type": "string", |
| 54 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Warning" |
| 55 | }, |
| 56 | "source": { |
| 57 | "@type": "string", |
| 58 | "@value": "rule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Warning\"\nwhen has_field(\"severity\") AND to_long($message.severity) == 3\nthen\nset_field(\"syslog_level\", \"Warning\");\nend" |
| 59 | } |
| 60 | }, |
| 61 | "constraints": [ |
| 62 | { |
| 63 | "type": "server-version", |
| 64 | "version": ">=5.0.13+083613e" |
| 65 | } |
| 66 | ] |
| 67 | }, |
| 68 | { |
| 69 | "v": "1", |
| 70 | "type": { |
| 71 | "name": "pipeline_rule", |
| 72 | "version": "1" |
| 73 | }, |
| 74 | "id": "88be1e03-b6d4-4ab7-8d3e-4107ab05e702", |
| 75 | "data": { |
| 76 | "title": { |
| 77 | "@type": "string", |
| 78 | "@value": "Crowdstrike Timestamp Failsafe - UTC" |
| 79 | }, |
| 80 | "description": { |
| 81 | "@type": "string", |
| 82 | "@value": "Set Timestamp based upon `rt` field which is the time Crowdstrike ingested the message. This is a failsafe to catch if no other field names have been detected in the log that provide the timestamp value that the host assigned with the raw alert." |
| 83 | }, |
| 84 | "source": { |
| 85 | "@type": "string", |
| 86 | "@value": "rule \"Crowdstrike Timestamp Failsafe - UTC\"\nwhen\n ! has_field(\"timestamp_utc\")\nthen\n let msg_timestamp = $message.rt;\n set_field(\"timestamp_utc\", msg_timestamp);\nend" |
| 87 | } |
| 88 | }, |
| 89 | "constraints": [ |
| 90 | { |
| 91 | "type": "server-version", |
| 92 | "version": ">=5.0.13+083613e" |
| 93 | } |
| 94 | ] |
| 95 | }, |
| 96 | { |
| 97 | "v": "1", |
| 98 | "type": { |
| 99 | "name": "pipeline_rule", |
| 100 | "version": "1" |
| 101 | }, |
| 102 | "id": "b540613b-ba8a-4a7a-ad4f-70385df0880d", |
| 103 | "data": { |
| 104 | "title": { |
| 105 | "@type": "string", |
| 106 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Notice" |
| 107 | }, |
| 108 | "description": { |
| 109 | "@type": "string", |
| 110 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Notice" |
| 111 | }, |
| 112 | "source": { |
| 113 | "@type": "string", |
| 114 | "@value": "rule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Notice\"\nwhen has_field(\"severity\") AND to_long($message.severity) == 2\nthen\nset_field(\"syslog_level\", \"Notice\");\nend" |
| 115 | } |
| 116 | }, |
| 117 | "constraints": [ |
| 118 | { |
| 119 | "type": "server-version", |
| 120 | "version": ">=5.0.13+083613e" |
| 121 | } |
| 122 | ] |
| 123 | }, |
| 124 | { |
| 125 | "v": "1", |
| 126 | "type": { |
| 127 | "name": "pipeline", |
| 128 | "version": "1" |
| 129 | }, |
| 130 | "id": "aea01b0b-c5ab-4429-9104-2f735c68bf2a", |
| 131 | "data": { |
| 132 | "title": { |
| 133 | "@type": "string", |
| 134 | "@value": "CROWDSTRIKE PROCESSING PIPELINE" |
| 135 | }, |
| 136 | "description": { |
| 137 | "@type": "string", |
| 138 | "@value": "CROWDSTRIKE PROCESSING PIPELINE" |
| 139 | }, |
| 140 | "source": { |
| 141 | "@type": "string", |
| 142 | "@value": "pipeline \"CROWDSTRIKE PROCESSING PIPELINE\"\nstage 0 match either\nrule \"Crowdstrike Timestamp Failsafe - UTC\"\nrule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Alert\"\nrule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Info\"\nrule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Notice\"\nrule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Warning\"\nend" |
| 143 | }, |
| 144 | "connected_streams": [] |
| 145 | }, |
| 146 | "constraints": [ |
| 147 | { |
| 148 | "type": "server-version", |
| 149 | "version": ">=5.0.13+083613e" |
| 150 | } |
| 151 | ] |
| 152 | }, |
| 153 | { |
| 154 | "v": "1", |
| 155 | "type": { |
| 156 | "name": "pipeline_rule", |
| 157 | "version": "1" |
| 158 | }, |
| 159 | "id": "f0ebe352-2211-453f-959b-6267016b147e", |
| 160 | "data": { |
| 161 | "title": { |
| 162 | "@type": "string", |
| 163 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Alert" |
| 164 | }, |
| 165 | "description": { |
| 166 | "@type": "string", |
| 167 | "@value": "CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Alert" |
| 168 | }, |
| 169 | "source": { |
| 170 | "@type": "string", |
| 171 | "@value": "rule \"CROWDSTRIKE CREATE FIELD SYSLOG LEVEL - Alert\"\nwhen has_field(\"severity\") AND to_long($message.severity) == 4\nthen\nset_field(\"syslog_level\", \"Alert\");\nend" |
| 172 | } |
| 173 | }, |
| 174 | "constraints": [ |
| 175 | { |
| 176 | "type": "server-version", |
| 177 | "version": ">=5.0.13+083613e" |
| 178 | } |
| 179 | ] |
| 180 | } |
| 181 | ] |
| 182 | } |