| 1 | { |
| 2 | "v": 1, |
| 3 | "id": "368ca3ae-4418-4bbb-b3b0-054d68a01751", |
| 4 | "rev": 1, |
| 5 | "name": "SOCFORTRESS_FORTINET_PROCESSING_PIPELINE", |
| 6 | "summary": "SOCFORTRESS_FORTINET_PROCESSING_PIPELINE", |
| 7 | "description": "", |
| 8 | "vendor": "SOCFortress", |
| 9 | "url": "", |
| 10 | "parameters": [], |
| 11 | "entities": [ |
| 12 | { |
| 13 | "v": "1", |
| 14 | "type": { |
| 15 | "name": "pipeline", |
| 16 | "version": "1" |
| 17 | }, |
| 18 | "id": "65608435-50d7-4652-8865-54787dfe5f0d", |
| 19 | "data": { |
| 20 | "title": { |
| 21 | "@type": "string", |
| 22 | "@value": "FORTINET PROCESSING PIPELINE" |
| 23 | }, |
| 24 | "description": { |
| 25 | "@type": "string", |
| 26 | "@value": "FORTINET PROCESSING PIPELINE" |
| 27 | }, |
| 28 | "source": { |
| 29 | "@type": "string", |
| 30 | "@value": "pipeline \"FORTINET PROCESSING PIPELINE\"\nstage 0 match pass\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - Alert\"\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - Critical\"\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - Debug\"\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - Emergency\"\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - Error\"\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - Informational\"\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - NOTICE\"\nrule \"FORTINET CREATE FIELD SYSLOG LEVEL - Warning\"\nstage 1 match pass\nrule \"DROP FORTINET SYSTEM WIRELESS LOGS - NOTICE\"\nrule \"DROP FORTINET TRAFFIC LOGS\"\nrule \"DROP FORTINET UTM APPCONTROL LOGS - INFORMATION\"\nend" |
| 31 | }, |
| 32 | "connected_streams": [] |
| 33 | }, |
| 34 | "constraints": [ |
| 35 | { |
| 36 | "type": "server-version", |
| 37 | "version": ">=5.0.13+083613e" |
| 38 | } |
| 39 | ] |
| 40 | }, |
| 41 | { |
| 42 | "v": "1", |
| 43 | "type": { |
| 44 | "name": "pipeline_rule", |
| 45 | "version": "1" |
| 46 | }, |
| 47 | "id": "90379b8d-82e2-4ea9-905d-6ddc65fb9a64", |
| 48 | "data": { |
| 49 | "title": { |
| 50 | "@type": "string", |
| 51 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Emergency" |
| 52 | }, |
| 53 | "description": { |
| 54 | "@type": "string", |
| 55 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Emergency" |
| 56 | }, |
| 57 | "source": { |
| 58 | "@type": "string", |
| 59 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - Emergency\"\nwhen has_field(\"level\") AND to_long($message.level) == 0\nthen\nset_field(\"syslog_level\", \"Emergency\");\nend" |
| 60 | } |
| 61 | }, |
| 62 | "constraints": [ |
| 63 | { |
| 64 | "type": "server-version", |
| 65 | "version": ">=5.0.13+083613e" |
| 66 | } |
| 67 | ] |
| 68 | }, |
| 69 | { |
| 70 | "v": "1", |
| 71 | "type": { |
| 72 | "name": "pipeline_rule", |
| 73 | "version": "1" |
| 74 | }, |
| 75 | "id": "c53d3fc9-88bd-4c49-8543-c658867304d6", |
| 76 | "data": { |
| 77 | "title": { |
| 78 | "@type": "string", |
| 79 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Informational" |
| 80 | }, |
| 81 | "description": { |
| 82 | "@type": "string", |
| 83 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Informational" |
| 84 | }, |
| 85 | "source": { |
| 86 | "@type": "string", |
| 87 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - Informational\"\nwhen has_field(\"level\") AND to_long($message.level) == 6\nthen\nset_field(\"syslog_level\", \"Informational\");\nend" |
| 88 | } |
| 89 | }, |
| 90 | "constraints": [ |
| 91 | { |
| 92 | "type": "server-version", |
| 93 | "version": ">=5.0.13+083613e" |
| 94 | } |
| 95 | ] |
| 96 | }, |
| 97 | { |
| 98 | "v": "1", |
| 99 | "type": { |
| 100 | "name": "pipeline_rule", |
| 101 | "version": "1" |
| 102 | }, |
| 103 | "id": "d8041d5a-5064-43db-bbbf-5d5806e7f42d", |
| 104 | "data": { |
| 105 | "title": { |
| 106 | "@type": "string", |
| 107 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - NOTICE" |
| 108 | }, |
| 109 | "description": { |
| 110 | "@type": "string", |
| 111 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - NOTICE" |
| 112 | }, |
| 113 | "source": { |
| 114 | "@type": "string", |
| 115 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - NOTICE\"\nwhen has_field(\"level\") AND to_long($message.level) == 5\nthen\nset_field(\"syslog_level\", \"Notice\");\nend" |
| 116 | } |
| 117 | }, |
| 118 | "constraints": [ |
| 119 | { |
| 120 | "type": "server-version", |
| 121 | "version": ">=5.0.13+083613e" |
| 122 | } |
| 123 | ] |
| 124 | }, |
| 125 | { |
| 126 | "v": "1", |
| 127 | "type": { |
| 128 | "name": "pipeline_rule", |
| 129 | "version": "1" |
| 130 | }, |
| 131 | "id": "3a10b7c6-58e0-4445-8785-ec6f52700e74", |
| 132 | "data": { |
| 133 | "title": { |
| 134 | "@type": "string", |
| 135 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Warning" |
| 136 | }, |
| 137 | "description": { |
| 138 | "@type": "string", |
| 139 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Warning" |
| 140 | }, |
| 141 | "source": { |
| 142 | "@type": "string", |
| 143 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - Warning\"\nwhen has_field(\"level\") AND to_long($message.level) == 4\nthen\nset_field(\"syslog_level\", \"Warning\");\nend" |
| 144 | } |
| 145 | }, |
| 146 | "constraints": [ |
| 147 | { |
| 148 | "type": "server-version", |
| 149 | "version": ">=5.0.13+083613e" |
| 150 | } |
| 151 | ] |
| 152 | }, |
| 153 | { |
| 154 | "v": "1", |
| 155 | "type": { |
| 156 | "name": "pipeline_rule", |
| 157 | "version": "1" |
| 158 | }, |
| 159 | "id": "fe239c28-c37b-4d0a-b08b-945c988bb052", |
| 160 | "data": { |
| 161 | "title": { |
| 162 | "@type": "string", |
| 163 | "@value": "DROP FORTINET SYSTEM WIRELESS LOGS - NOTICE" |
| 164 | }, |
| 165 | "description": { |
| 166 | "@type": "string", |
| 167 | "@value": "DROP FORTINET SYSTEM WIRELESS LOGS - NOTICE" |
| 168 | }, |
| 169 | "source": { |
| 170 | "@type": "string", |
| 171 | "@value": "rule \"DROP FORTINET SYSTEM WIRELESS LOGS - NOTICE\"\nwhen\n $message.type == \"event\" AND $message.subtype == \"wireless\" AND $message.syslog_level == \"Notice\"\nthen\n drop_message();\nend" |
| 172 | } |
| 173 | }, |
| 174 | "constraints": [ |
| 175 | { |
| 176 | "type": "server-version", |
| 177 | "version": ">=5.0.13+083613e" |
| 178 | } |
| 179 | ] |
| 180 | }, |
| 181 | { |
| 182 | "v": "1", |
| 183 | "type": { |
| 184 | "name": "pipeline_rule", |
| 185 | "version": "1" |
| 186 | }, |
| 187 | "id": "a7b13aff-50b7-4280-b612-0a4436aaccbc", |
| 188 | "data": { |
| 189 | "title": { |
| 190 | "@type": "string", |
| 191 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Error" |
| 192 | }, |
| 193 | "description": { |
| 194 | "@type": "string", |
| 195 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Error" |
| 196 | }, |
| 197 | "source": { |
| 198 | "@type": "string", |
| 199 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - Error\"\nwhen has_field(\"level\") AND to_long($message.level) == 3\nthen\nset_field(\"syslog_level\", \"Error\");\nend" |
| 200 | } |
| 201 | }, |
| 202 | "constraints": [ |
| 203 | { |
| 204 | "type": "server-version", |
| 205 | "version": ">=5.0.13+083613e" |
| 206 | } |
| 207 | ] |
| 208 | }, |
| 209 | { |
| 210 | "v": "1", |
| 211 | "type": { |
| 212 | "name": "pipeline_rule", |
| 213 | "version": "1" |
| 214 | }, |
| 215 | "id": "ad4297a5-4e50-4780-9a23-cd59f560adeb", |
| 216 | "data": { |
| 217 | "title": { |
| 218 | "@type": "string", |
| 219 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Alert" |
| 220 | }, |
| 221 | "description": { |
| 222 | "@type": "string", |
| 223 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Alert" |
| 224 | }, |
| 225 | "source": { |
| 226 | "@type": "string", |
| 227 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - Alert\"\nwhen has_field(\"level\") AND to_long($message.level) == 1\nthen\nset_field(\"syslog_level\", \"Alert\");\nend" |
| 228 | } |
| 229 | }, |
| 230 | "constraints": [ |
| 231 | { |
| 232 | "type": "server-version", |
| 233 | "version": ">=5.0.13+083613e" |
| 234 | } |
| 235 | ] |
| 236 | }, |
| 237 | { |
| 238 | "v": "1", |
| 239 | "type": { |
| 240 | "name": "pipeline_rule", |
| 241 | "version": "1" |
| 242 | }, |
| 243 | "id": "ed3c5523-1b06-4b2f-8be2-68077545ddca", |
| 244 | "data": { |
| 245 | "title": { |
| 246 | "@type": "string", |
| 247 | "@value": "DROP FORTINET TRAFFIC LOGS" |
| 248 | }, |
| 249 | "description": { |
| 250 | "@type": "string", |
| 251 | "@value": "DROP FORTINET TRAFFIC LOGS" |
| 252 | }, |
| 253 | "source": { |
| 254 | "@type": "string", |
| 255 | "@value": "rule \"DROP FORTINET TRAFFIC LOGS\"\nwhen\n $message.type == \"traffic\"\nthen\n drop_message();\nend" |
| 256 | } |
| 257 | }, |
| 258 | "constraints": [ |
| 259 | { |
| 260 | "type": "server-version", |
| 261 | "version": ">=5.0.13+083613e" |
| 262 | } |
| 263 | ] |
| 264 | }, |
| 265 | { |
| 266 | "v": "1", |
| 267 | "type": { |
| 268 | "name": "pipeline_rule", |
| 269 | "version": "1" |
| 270 | }, |
| 271 | "id": "73150f91-f0cc-4d9e-9e85-670f03f2d203", |
| 272 | "data": { |
| 273 | "title": { |
| 274 | "@type": "string", |
| 275 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Debug" |
| 276 | }, |
| 277 | "description": { |
| 278 | "@type": "string", |
| 279 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Debug" |
| 280 | }, |
| 281 | "source": { |
| 282 | "@type": "string", |
| 283 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - Debug\"\nwhen has_field(\"level\") AND to_long($message.level) == 7\nthen\nset_field(\"syslog_level\", \"Debug\");\nend" |
| 284 | } |
| 285 | }, |
| 286 | "constraints": [ |
| 287 | { |
| 288 | "type": "server-version", |
| 289 | "version": ">=5.0.13+083613e" |
| 290 | } |
| 291 | ] |
| 292 | }, |
| 293 | { |
| 294 | "v": "1", |
| 295 | "type": { |
| 296 | "name": "pipeline_rule", |
| 297 | "version": "1" |
| 298 | }, |
| 299 | "id": "f361e1f9-c18c-43e7-bcb7-8e9ecd4e15af", |
| 300 | "data": { |
| 301 | "title": { |
| 302 | "@type": "string", |
| 303 | "@value": "DROP FORTINET UTM APPCONTROL LOGS - INFORMATION" |
| 304 | }, |
| 305 | "description": { |
| 306 | "@type": "string", |
| 307 | "@value": "DROP FORTINET UTM APPCONTROL LOGS - INFORMATION" |
| 308 | }, |
| 309 | "source": { |
| 310 | "@type": "string", |
| 311 | "@value": "rule \"DROP FORTINET UTM APPCONTROL LOGS - INFORMATION\"\nwhen\n $message.type == \"utm\" AND $message.subtype == \"app\" AND $message.syslog_level == \"information\"\nthen\n drop_message();\nend" |
| 312 | } |
| 313 | }, |
| 314 | "constraints": [ |
| 315 | { |
| 316 | "type": "server-version", |
| 317 | "version": ">=5.0.13+083613e" |
| 318 | } |
| 319 | ] |
| 320 | }, |
| 321 | { |
| 322 | "v": "1", |
| 323 | "type": { |
| 324 | "name": "pipeline_rule", |
| 325 | "version": "1" |
| 326 | }, |
| 327 | "id": "1642ba73-fc24-4613-bb3b-12f41a3a5e94", |
| 328 | "data": { |
| 329 | "title": { |
| 330 | "@type": "string", |
| 331 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Critical" |
| 332 | }, |
| 333 | "description": { |
| 334 | "@type": "string", |
| 335 | "@value": "FORTINET CREATE FIELD SYSLOG LEVEL - Critical" |
| 336 | }, |
| 337 | "source": { |
| 338 | "@type": "string", |
| 339 | "@value": "rule \"FORTINET CREATE FIELD SYSLOG LEVEL - Critical\"\nwhen has_field(\"level\") AND to_long($message.level) == 2\nthen\nset_field(\"syslog_level\", \"Critical\");\nend" |
| 340 | } |
| 341 | }, |
| 342 | "constraints": [ |
| 343 | { |
| 344 | "type": "server-version", |
| 345 | "version": ">=5.0.13+083613e" |
| 346 | } |
| 347 | ] |
| 348 | } |
| 349 | ] |
| 350 | } |