| 1 | { |
| 2 | "v": 1, |
| 3 | "id": "36cc5ea6-7755-4e4d-896f-5749df3a4cb3", |
| 4 | "rev": 1, |
| 5 | "name": "SOCFORTRESS_SONICWALL_PROCESSING_PIPELINE", |
| 6 | "summary": "SOCFORTRESS_SONICWALL_PROCESSING_PIPELINE", |
| 7 | "description": "", |
| 8 | "vendor": "SOCFortress", |
| 9 | "url": "", |
| 10 | "parameters": [], |
| 11 | "entities": [ |
| 12 | { |
| 13 | "v": "1", |
| 14 | "type": { |
| 15 | "name": "pipeline_rule", |
| 16 | "version": "1" |
| 17 | }, |
| 18 | "id": "69453bf6-cb99-4b47-9475-45a6ca364542", |
| 19 | "data": { |
| 20 | "title": { |
| 21 | "@type": "string", |
| 22 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Warning" |
| 23 | }, |
| 24 | "description": { |
| 25 | "@type": "string", |
| 26 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Warning" |
| 27 | }, |
| 28 | "source": { |
| 29 | "@type": "string", |
| 30 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Warning\"\nwhen to_long($message.level) == 4\nthen\nset_field(\"syslog_level\", \"Warning\");\nend" |
| 31 | } |
| 32 | }, |
| 33 | "constraints": [ |
| 34 | { |
| 35 | "type": "server-version", |
| 36 | "version": ">=5.0.13+083613e" |
| 37 | } |
| 38 | ] |
| 39 | }, |
| 40 | { |
| 41 | "v": "1", |
| 42 | "type": { |
| 43 | "name": "pipeline_rule", |
| 44 | "version": "1" |
| 45 | }, |
| 46 | "id": "81b553f2-7e54-4305-ba49-b1e44ac2960a", |
| 47 | "data": { |
| 48 | "title": { |
| 49 | "@type": "string", |
| 50 | "@value": "DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA" |
| 51 | }, |
| 52 | "description": { |
| 53 | "@type": "string", |
| 54 | "@value": "DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA" |
| 55 | }, |
| 56 | "source": { |
| 57 | "@type": "string", |
| 58 | "@value": "rule \"DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA\"\nwhen\n to_long($message.level) == 1 AND $message.fw_action == \"NA\" AND $message.msg_cat != \"IPS Detection Alert\"\nthen\n drop_message();\nend" |
| 59 | } |
| 60 | }, |
| 61 | "constraints": [ |
| 62 | { |
| 63 | "type": "server-version", |
| 64 | "version": ">=5.0.13+083613e" |
| 65 | } |
| 66 | ] |
| 67 | }, |
| 68 | { |
| 69 | "v": "1", |
| 70 | "type": { |
| 71 | "name": "pipeline_rule", |
| 72 | "version": "1" |
| 73 | }, |
| 74 | "id": "b15ef1f4-a91b-441f-bbec-6cf80860d434", |
| 75 | "data": { |
| 76 | "title": { |
| 77 | "@type": "string", |
| 78 | "@value": "SONICWALL SRC IP - THREAT INTEL" |
| 79 | }, |
| 80 | "description": { |
| 81 | "@type": "string", |
| 82 | "@value": "SONICWALL SRC IP - THREAT INTEL" |
| 83 | }, |
| 84 | "source": { |
| 85 | "@type": "string", |
| 86 | "@value": "rule \"SONICWALL SRC IP - THREAT INTEL\"\nwhen\n ! has_field(\"src_ip_reserved_ip\")\nthen\nlet ip_and_ampersand = concat(to_string($message.src_ip), \"&customer_code=\");\nlet new_key = concat(ip_and_ampersand, to_string($message.syslog_customer));\n let ldata = lookup(\n lookup_table: \"threatintellookup\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend" |
| 87 | } |
| 88 | }, |
| 89 | "constraints": [ |
| 90 | { |
| 91 | "type": "server-version", |
| 92 | "version": ">=5.0.13+083613e" |
| 93 | } |
| 94 | ] |
| 95 | }, |
| 96 | { |
| 97 | "v": "1", |
| 98 | "type": { |
| 99 | "name": "pipeline_rule", |
| 100 | "version": "1" |
| 101 | }, |
| 102 | "id": "253ee75a-97a8-44c4-b0aa-7b27e3bafee9", |
| 103 | "data": { |
| 104 | "title": { |
| 105 | "@type": "string", |
| 106 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency" |
| 107 | }, |
| 108 | "description": { |
| 109 | "@type": "string", |
| 110 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency" |
| 111 | }, |
| 112 | "source": { |
| 113 | "@type": "string", |
| 114 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency\"\nwhen to_long($message.level) == 0\nthen\nset_field(\"syslog_level\", \"Emergency\");\nend" |
| 115 | } |
| 116 | }, |
| 117 | "constraints": [ |
| 118 | { |
| 119 | "type": "server-version", |
| 120 | "version": ">=5.0.13+083613e" |
| 121 | } |
| 122 | ] |
| 123 | }, |
| 124 | { |
| 125 | "v": "1", |
| 126 | "type": { |
| 127 | "name": "pipeline_rule", |
| 128 | "version": "1" |
| 129 | }, |
| 130 | "id": "fcbd228d-3b3d-4746-82d9-f8b54a54377a", |
| 131 | "data": { |
| 132 | "title": { |
| 133 | "@type": "string", |
| 134 | "@value": "SonicWall dst - Extract IP, Port and Interface" |
| 135 | }, |
| 136 | "description": { |
| 137 | "@type": "string", |
| 138 | "@value": "SonicWall dst - Extract IP, Port and Interface" |
| 139 | }, |
| 140 | "source": { |
| 141 | "@type": "string", |
| 142 | "@value": "rule \"SonicWall dst - Extract IP, Port and Interface\"\nwhen\nhas_field(\"dst\")\nthen\n let result1 = regex(\"^([0-9,\\\\.]+)\",to_string($message.dst));\n set_field(\"dst_ip\", result1[\"0\"]);\n let result2 = regex(\"^[0-9,\\\\.]+\\\\:([0-9]+)\",to_string($message.dst));\n set_field(\"dst_port\", result2[\"0\"]); \n let result3 = regex(\"^[0-9,\\\\.]+\\\\:[0-9]+\\\\:([A-Z,0-9]+)\",to_string($message.dst));\n set_field(\"dst_interface\", result3[\"0\"]);\n let result4 = regex(\"^[0-9,\\\\.]+\\\\:([A-Z,0-9]+)$\",to_string($message.dst));\n set_field(\"dst_interface\", result4[\"0\"]); \nend" |
| 143 | } |
| 144 | }, |
| 145 | "constraints": [ |
| 146 | { |
| 147 | "type": "server-version", |
| 148 | "version": ">=5.0.13+083613e" |
| 149 | } |
| 150 | ] |
| 151 | }, |
| 152 | { |
| 153 | "v": "1", |
| 154 | "type": { |
| 155 | "name": "pipeline_rule", |
| 156 | "version": "1" |
| 157 | }, |
| 158 | "id": "4717aa45-7ede-45db-8130-5702924969f6", |
| 159 | "data": { |
| 160 | "title": { |
| 161 | "@type": "string", |
| 162 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Debug" |
| 163 | }, |
| 164 | "description": { |
| 165 | "@type": "string", |
| 166 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Debug" |
| 167 | }, |
| 168 | "source": { |
| 169 | "@type": "string", |
| 170 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Debug\"\nwhen to_long($message.level) == 7\nthen\nset_field(\"syslog_level\", \"Debug\");\nend" |
| 171 | } |
| 172 | }, |
| 173 | "constraints": [ |
| 174 | { |
| 175 | "type": "server-version", |
| 176 | "version": ">=5.0.13+083613e" |
| 177 | } |
| 178 | ] |
| 179 | }, |
| 180 | { |
| 181 | "v": "1", |
| 182 | "type": { |
| 183 | "name": "pipeline_rule", |
| 184 | "version": "1" |
| 185 | }, |
| 186 | "id": "8e894827-c82d-4480-9750-920fb10bd0c4", |
| 187 | "data": { |
| 188 | "title": { |
| 189 | "@type": "string", |
| 190 | "@value": "DROP SONICWALL LOGS - LEVEL 6, CONNS" |
| 191 | }, |
| 192 | "description": { |
| 193 | "@type": "string", |
| 194 | "@value": "DROP SONICWALL LOGS - LEVEL 6, CONNS" |
| 195 | }, |
| 196 | "source": { |
| 197 | "@type": "string", |
| 198 | "@value": "rule \"DROP SONICWALL LOGS - LEVEL 6, CONNS\"\nwhen\n to_long($message.level) == 6 AND ($message.msg == \"Connection Closed\" OR $message.msg == \"Connection Opened\")\nthen\n drop_message();\nend" |
| 199 | } |
| 200 | }, |
| 201 | "constraints": [ |
| 202 | { |
| 203 | "type": "server-version", |
| 204 | "version": ">=5.0.13+083613e" |
| 205 | } |
| 206 | ] |
| 207 | }, |
| 208 | { |
| 209 | "v": "1", |
| 210 | "type": { |
| 211 | "name": "pipeline_rule", |
| 212 | "version": "1" |
| 213 | }, |
| 214 | "id": "58c692b4-7f2f-465d-ba44-59d8a1f13312", |
| 215 | "data": { |
| 216 | "title": { |
| 217 | "@type": "string", |
| 218 | "@value": "SONICWALL DST IP - THREAT INTEL" |
| 219 | }, |
| 220 | "description": { |
| 221 | "@type": "string", |
| 222 | "@value": "SONICWALL DST IP - THREAT INTEL" |
| 223 | }, |
| 224 | "source": { |
| 225 | "@type": "string", |
| 226 | "@value": "rule \"SONICWALL DST IP - THREAT INTEL\"\nwhen\n ! has_field(\"dst_ip_reserved_ip\")\nthen\nlet ip_and_ampersand = concat(to_string($message.dst_ip), \"&customer_code=\");\nlet new_key = concat(ip_and_ampersand, to_string($message.syslog_customer));\n let ldata = lookup(\n lookup_table: \"threatintellookup\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend" |
| 227 | } |
| 228 | }, |
| 229 | "constraints": [ |
| 230 | { |
| 231 | "type": "server-version", |
| 232 | "version": ">=5.0.13+083613e" |
| 233 | } |
| 234 | ] |
| 235 | }, |
| 236 | { |
| 237 | "v": "1", |
| 238 | "type": { |
| 239 | "name": "pipeline_rule", |
| 240 | "version": "1" |
| 241 | }, |
| 242 | "id": "9773b642-8a13-43e7-b4f7-84e29fb61dd6", |
| 243 | "data": { |
| 244 | "title": { |
| 245 | "@type": "string", |
| 246 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Critical" |
| 247 | }, |
| 248 | "description": { |
| 249 | "@type": "string", |
| 250 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Critical" |
| 251 | }, |
| 252 | "source": { |
| 253 | "@type": "string", |
| 254 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Critical\"\nwhen to_long($message.level) == 2\nthen\nset_field(\"syslog_level\", \"Critical\");\nend" |
| 255 | } |
| 256 | }, |
| 257 | "constraints": [ |
| 258 | { |
| 259 | "type": "server-version", |
| 260 | "version": ">=5.0.13+083613e" |
| 261 | } |
| 262 | ] |
| 263 | }, |
| 264 | { |
| 265 | "v": "1", |
| 266 | "type": { |
| 267 | "name": "pipeline_rule", |
| 268 | "version": "1" |
| 269 | }, |
| 270 | "id": "6bec12f2-dbc8-446c-b0a0-066938cda27a", |
| 271 | "data": { |
| 272 | "title": { |
| 273 | "@type": "string", |
| 274 | "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND" |
| 275 | }, |
| 276 | "description": { |
| 277 | "@type": "string", |
| 278 | "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND" |
| 279 | }, |
| 280 | "source": { |
| 281 | "@type": "string", |
| 282 | "@value": "rule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nwhen\n has_field(\"threat_intel_value\")\nthen\n set_field(\"syslog_level\", \"ALERT\");\nend" |
| 283 | } |
| 284 | }, |
| 285 | "constraints": [ |
| 286 | { |
| 287 | "type": "server-version", |
| 288 | "version": ">=5.0.13+083613e" |
| 289 | } |
| 290 | ] |
| 291 | }, |
| 292 | { |
| 293 | "v": "1", |
| 294 | "type": { |
| 295 | "name": "pipeline_rule", |
| 296 | "version": "1" |
| 297 | }, |
| 298 | "id": "3d3f27de-7806-4184-b909-63885f7b1391", |
| 299 | "data": { |
| 300 | "title": { |
| 301 | "@type": "string", |
| 302 | "@value": "SONICWALL - key_value_parser" |
| 303 | }, |
| 304 | "description": { |
| 305 | "@type": "string", |
| 306 | "@value": "SONICWALL - key_value_parser" |
| 307 | }, |
| 308 | "source": { |
| 309 | "@type": "string", |
| 310 | "@value": "rule \"SONICWALL - key_value_parser\"\nwhen\n has_field(\"message\")\nthen\n set_fields(\n fields:\n key_value(\n value: to_string($message.message),\n trim_value_chars: \"\\\"\",\n delimiters: \" \",\n kv_delimiters: \"=\"\n )\n );\nend" |
| 311 | } |
| 312 | }, |
| 313 | "constraints": [ |
| 314 | { |
| 315 | "type": "server-version", |
| 316 | "version": ">=5.0.13+083613e" |
| 317 | } |
| 318 | ] |
| 319 | }, |
| 320 | { |
| 321 | "v": "1", |
| 322 | "type": { |
| 323 | "name": "pipeline_rule", |
| 324 | "version": "1" |
| 325 | }, |
| 326 | "id": "5d9310c5-3dea-48a3-ab91-0a14618074b3", |
| 327 | "data": { |
| 328 | "title": { |
| 329 | "@type": "string", |
| 330 | "@value": "SonicWall src - Extract IP, Port and Interface" |
| 331 | }, |
| 332 | "description": { |
| 333 | "@type": "string", |
| 334 | "@value": "SonicWall src - Extract IP, Port and Interface" |
| 335 | }, |
| 336 | "source": { |
| 337 | "@type": "string", |
| 338 | "@value": "rule \"SonicWall src - Extract IP, Port and Interface\"\nwhen\nhas_field(\"src\")\nthen\n let result1 = regex(\"^([0-9,\\\\.]+)\",to_string($message.src));\n set_field(\"src_ip\", result1[\"0\"]);\n let result2 = regex(\"^[0-9,\\\\.]+\\\\:([0-9]+)\",to_string($message.src));\n set_field(\"src_port\", result2[\"0\"]); \n let result3 = regex(\"^[0-9,\\\\.]+\\\\:[0-9]+\\\\:([A-Z,0-9]+)\",to_string($message.src));\n set_field(\"src_interface\", result3[\"0\"]);\n let result4 = regex(\"^[0-9,\\\\.]+\\\\:([A-Z,0-9]+)$\",to_string($message.src));\n set_field(\"src_interface\", result4[\"0\"]); \nend" |
| 339 | } |
| 340 | }, |
| 341 | "constraints": [ |
| 342 | { |
| 343 | "type": "server-version", |
| 344 | "version": ">=5.0.13+083613e" |
| 345 | } |
| 346 | ] |
| 347 | }, |
| 348 | { |
| 349 | "v": "1", |
| 350 | "type": { |
| 351 | "name": "pipeline_rule", |
| 352 | "version": "1" |
| 353 | }, |
| 354 | "id": "353eaac6-15e4-4bb5-8e3d-71e04b5115e5", |
| 355 | "data": { |
| 356 | "title": { |
| 357 | "@type": "string", |
| 358 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Notice" |
| 359 | }, |
| 360 | "description": { |
| 361 | "@type": "string", |
| 362 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Notice" |
| 363 | }, |
| 364 | "source": { |
| 365 | "@type": "string", |
| 366 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Notice\"\nwhen to_long($message.level) == 5\nthen\nset_field(\"syslog_level\", \"Notice\");\nend" |
| 367 | } |
| 368 | }, |
| 369 | "constraints": [ |
| 370 | { |
| 371 | "type": "server-version", |
| 372 | "version": ">=5.0.13+083613e" |
| 373 | } |
| 374 | ] |
| 375 | }, |
| 376 | { |
| 377 | "v": "1", |
| 378 | "type": { |
| 379 | "name": "pipeline_rule", |
| 380 | "version": "1" |
| 381 | }, |
| 382 | "id": "d0335e13-f48c-4601-bd1e-2a945585ca96", |
| 383 | "data": { |
| 384 | "title": { |
| 385 | "@type": "string", |
| 386 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Alert" |
| 387 | }, |
| 388 | "description": { |
| 389 | "@type": "string", |
| 390 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Alert" |
| 391 | }, |
| 392 | "source": { |
| 393 | "@type": "string", |
| 394 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Alert\"\nwhen to_long($message.level) == 1\nthen\nset_field(\"syslog_level\", \"Alert\");\nend" |
| 395 | } |
| 396 | }, |
| 397 | "constraints": [ |
| 398 | { |
| 399 | "type": "server-version", |
| 400 | "version": ">=5.0.13+083613e" |
| 401 | } |
| 402 | ] |
| 403 | }, |
| 404 | { |
| 405 | "v": "1", |
| 406 | "type": { |
| 407 | "name": "pipeline_rule", |
| 408 | "version": "1" |
| 409 | }, |
| 410 | "id": "5ee057f5-290e-4549-86e4-8f384b3a5112", |
| 411 | "data": { |
| 412 | "title": { |
| 413 | "@type": "string", |
| 414 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Error" |
| 415 | }, |
| 416 | "description": { |
| 417 | "@type": "string", |
| 418 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Error" |
| 419 | }, |
| 420 | "source": { |
| 421 | "@type": "string", |
| 422 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Error\"\nwhen to_long($message.level) == 3\nthen\nset_field(\"syslog_level\", \"Error\");\nend" |
| 423 | } |
| 424 | }, |
| 425 | "constraints": [ |
| 426 | { |
| 427 | "type": "server-version", |
| 428 | "version": ">=5.0.13+083613e" |
| 429 | } |
| 430 | ] |
| 431 | }, |
| 432 | { |
| 433 | "v": "1", |
| 434 | "type": { |
| 435 | "name": "pipeline_rule", |
| 436 | "version": "1" |
| 437 | }, |
| 438 | "id": "93adfd3a-6cd2-4335-875a-38970729a6c8", |
| 439 | "data": { |
| 440 | "title": { |
| 441 | "@type": "string", |
| 442 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - INFO" |
| 443 | }, |
| 444 | "description": { |
| 445 | "@type": "string", |
| 446 | "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - INFO" |
| 447 | }, |
| 448 | "source": { |
| 449 | "@type": "string", |
| 450 | "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - INFO\"\nwhen to_long($message.level) == 6\nthen\nset_field(\"syslog_level\", \"INFO\");\nend" |
| 451 | } |
| 452 | }, |
| 453 | "constraints": [ |
| 454 | { |
| 455 | "type": "server-version", |
| 456 | "version": ">=5.0.13+083613e" |
| 457 | } |
| 458 | ] |
| 459 | }, |
| 460 | { |
| 461 | "v": "1", |
| 462 | "type": { |
| 463 | "name": "pipeline", |
| 464 | "version": "1" |
| 465 | }, |
| 466 | "id": "37a1065a-77e2-4a3f-b63d-0053200ec995", |
| 467 | "data": { |
| 468 | "title": { |
| 469 | "@type": "string", |
| 470 | "@value": "SONICWALL PROCESSING PIPELINE" |
| 471 | }, |
| 472 | "description": { |
| 473 | "@type": "string", |
| 474 | "@value": "SONICWALL PROCESSING PIPELINE" |
| 475 | }, |
| 476 | "source": { |
| 477 | "@type": "string", |
| 478 | "@value": "pipeline \"SONICWALL PROCESSING PIPELINE\"\nstage 0 match either\nrule \"SONICWALL - key_value_parser\"\nstage 1 match pass\nrule \"DROP SONICWALL LOGS - LEVEL 6, CONNS\"\nrule \"DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA\"\nstage 2 match pass\nrule \"SonicWall dst - Extract IP, Port and Interface\"\nrule \"SonicWall src - Extract IP, Port and Interface\"\nstage 3 match pass\nrule \"SONICWALL DST IP - THREAT INTEL\"\nrule \"SONICWALL SRC IP - THREAT INTEL\"\nstage 4 match either\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Warning\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Debug\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Alert\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Critical\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Notice\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Error\"\nstage 5 match either\nrule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nend" |
| 479 | } |
| 480 | }, |
| 481 | "constraints": [ |
| 482 | { |
| 483 | "type": "server-version", |
| 484 | "version": ">=5.0.13+083613e" |
| 485 | } |
| 486 | ] |
| 487 | } |
| 488 | ] |
| 489 | } |