@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
json 4,276 lines 127 KB
Raw
1 {
2 "v": "1",
3 "id": "261577fe-d9a2-4141-af74-635f085eee54",
4 "rev": 3,
5 "name": "SOCFORTRESS_WAZUH_CONTENT_PACK",
6 "summary": "Content Pack for Wazuh",
7 "description": "",
8 "vendor": "SOCFortress - info@socfortress.co",
9 "url": "https://github.com/socfortress/CoPilot/tree/main/backend/app/stack_provisioning/graylog/templates/wazuh_content_pack.json",
10 "parameters": [],
11 "entities": [
12 {
13 "v": "1",
14 "type": {
15 "name": "input",
16 "version": "1"
17 },
18 "id": "4fbce4a8-897e-4c2f-8030-8fa884c34fd8",
19 "data": {
20 "title": {
21 "@type": "string",
22 "@value": "WAZUH EVENTS FLUENT BIT - TCP"
23 },
24 "configuration": {
25 "tls_key_file": {
26 "@type": "string",
27 "@value": "soc-syslog-manager"
28 },
29 "port": {
30 "@type": "integer",
31 "@value": 5555
32 },
33 "tls_enable": {
34 "@type": "boolean",
35 "@value": false
36 },
37 "use_null_delimiter": {
38 "@type": "boolean",
39 "@value": false
40 },
41 "recv_buffer_size": {
42 "@type": "integer",
43 "@value": 1048576
44 },
45 "tcp_keepalive": {
46 "@type": "boolean",
47 "@value": false
48 },
49 "tls_client_auth_cert_file": {
50 "@type": "string",
51 "@value": ""
52 },
53 "bind_address": {
54 "@type": "string",
55 "@value": "0.0.0.0"
56 },
57 "tls_cert_file": {
58 "@type": "string",
59 "@value": ""
60 },
61 "max_message_size": {
62 "@type": "integer",
63 "@value": 2097152
64 },
65 "tls_client_auth": {
66 "@type": "string",
67 "@value": "disabled"
68 },
69 "number_worker_threads": {
70 "@type": "integer",
71 "@value": 8
72 },
73 "tls_key_password": {
74 "@type": "string",
75 "@value": "na"
76 }
77 },
78 "static_fields": {
79 "syslog_type": {
80 "@type": "string",
81 "@value": "wazuh"
82 }
83 },
84 "type": {
85 "@type": "string",
86 "@value": "org.graylog2.inputs.raw.tcp.RawTCPInput"
87 },
88 "global": {
89 "@type": "boolean",
90 "@value": false
91 },
92 "extractors": [
93 {
94 "target_field": {
95 "@type": "string",
96 "@value": ""
97 },
98 "condition_value": {
99 "@type": "string",
100 "@value": ""
101 },
102 "order": {
103 "@type": "integer",
104 "@value": 0
105 },
106 "converters": [],
107 "configuration": {
108 "list_separator": {
109 "@type": "string",
110 "@value": ", "
111 },
112 "kv_separator": {
113 "@type": "string",
114 "@value": ":"
115 },
116 "key_prefix": {
117 "@type": "string",
118 "@value": ""
119 },
120 "key_separator": {
121 "@type": "string",
122 "@value": "_"
123 },
124 "replace_key_whitespace": {
125 "@type": "boolean",
126 "@value": false
127 },
128 "key_whitespace_replacement": {
129 "@type": "string",
130 "@value": "_"
131 }
132 },
133 "source_field": {
134 "@type": "string",
135 "@value": "message"
136 },
137 "title": {
138 "@type": "string",
139 "@value": "FLUENTD - JSON EXTRACTOR"
140 },
141 "type": {
142 "@type": "string",
143 "@value": "JSON"
144 },
145 "cursor_strategy": {
146 "@type": "string",
147 "@value": "COPY"
148 },
149 "condition_type": {
150 "@type": "string",
151 "@value": "NONE"
152 }
153 },
154 {
155 "target_field": {
156 "@type": "string",
157 "@value": "hash_sha256"
158 },
159 "condition_value": {
160 "@type": "string",
161 "@value": "SHA256"
162 },
163 "order": {
164 "@type": "integer",
165 "@value": 10
166 },
167 "converters": [],
168 "configuration": {
169 "index": {
170 "@type": "integer",
171 "@value": 3
172 },
173 "split_by": {
174 "@type": "string",
175 "@value": ","
176 }
177 },
178 "source_field": {
179 "@type": "string",
180 "@value": "data_win_eventdata_hashes"
181 },
182 "title": {
183 "@type": "string",
184 "@value": "FILE HASHES 1 - SHA256"
185 },
186 "type": {
187 "@type": "string",
188 "@value": "SPLIT_AND_INDEX"
189 },
190 "cursor_strategy": {
191 "@type": "string",
192 "@value": "COPY"
193 },
194 "condition_type": {
195 "@type": "string",
196 "@value": "STRING"
197 }
198 },
199 {
200 "target_field": {
201 "@type": "string",
202 "@value": "sha256"
203 },
204 "condition_value": {
205 "@type": "string",
206 "@value": "SHA256"
207 },
208 "order": {
209 "@type": "integer",
210 "@value": 12
211 },
212 "converters": [],
213 "configuration": {
214 "index": {
215 "@type": "integer",
216 "@value": 2
217 },
218 "split_by": {
219 "@type": "string",
220 "@value": "="
221 }
222 },
223 "source_field": {
224 "@type": "string",
225 "@value": "hash_sha256"
226 },
227 "title": {
228 "@type": "string",
229 "@value": "SHA256 FILE HASH EXTRACTOR"
230 },
231 "type": {
232 "@type": "string",
233 "@value": "SPLIT_AND_INDEX"
234 },
235 "cursor_strategy": {
236 "@type": "string",
237 "@value": "COPY"
238 },
239 "condition_type": {
240 "@type": "string",
241 "@value": "STRING"
242 }
243 },
244 {
245 "target_field": {
246 "@type": "string",
247 "@value": "hash_sha256"
248 },
249 "condition_value": {
250 "@type": "string",
251 "@value": "SHA256"
252 },
253 "order": {
254 "@type": "integer",
255 "@value": 11
256 },
257 "converters": [],
258 "configuration": {
259 "index": {
260 "@type": "integer",
261 "@value": 3
262 },
263 "split_by": {
264 "@type": "string",
265 "@value": ","
266 }
267 },
268 "source_field": {
269 "@type": "string",
270 "@value": "data_win_eventdata_hash"
271 },
272 "title": {
273 "@type": "string",
274 "@value": "FILE HASHES 2 - SHA256"
275 },
276 "type": {
277 "@type": "string",
278 "@value": "SPLIT_AND_INDEX"
279 },
280 "cursor_strategy": {
281 "@type": "string",
282 "@value": "COPY"
283 },
284 "condition_type": {
285 "@type": "string",
286 "@value": "STRING"
287 }
288 },
289 {
290 "target_field": {
291 "@type": "string",
292 "@value": "rule_group3"
293 },
294 "condition_value": {
295 "@type": "string",
296 "@value": ""
297 },
298 "order": {
299 "@type": "integer",
300 "@value": 7
301 },
302 "converters": [],
303 "configuration": {
304 "index": {
305 "@type": "integer",
306 "@value": 3
307 },
308 "split_by": {
309 "@type": "string",
310 "@value": ","
311 }
312 },
313 "source_field": {
314 "@type": "string",
315 "@value": "rule_groups"
316 },
317 "title": {
318 "@type": "string",
319 "@value": "WAZUH RULE GROUPS SPLIT 3"
320 },
321 "type": {
322 "@type": "string",
323 "@value": "SPLIT_AND_INDEX"
324 },
325 "cursor_strategy": {
326 "@type": "string",
327 "@value": "COPY"
328 },
329 "condition_type": {
330 "@type": "string",
331 "@value": "NONE"
332 }
333 },
334 {
335 "target_field": {
336 "@type": "string",
337 "@value": "rule_group2"
338 },
339 "condition_value": {
340 "@type": "string",
341 "@value": ""
342 },
343 "order": {
344 "@type": "integer",
345 "@value": 6
346 },
347 "converters": [],
348 "configuration": {
349 "index": {
350 "@type": "integer",
351 "@value": 2
352 },
353 "split_by": {
354 "@type": "string",
355 "@value": ","
356 }
357 },
358 "source_field": {
359 "@type": "string",
360 "@value": "rule_groups"
361 },
362 "title": {
363 "@type": "string",
364 "@value": "WAZUH RULE GROUPS SPLIT 2"
365 },
366 "type": {
367 "@type": "string",
368 "@value": "SPLIT_AND_INDEX"
369 },
370 "cursor_strategy": {
371 "@type": "string",
372 "@value": "COPY"
373 },
374 "condition_type": {
375 "@type": "string",
376 "@value": "NONE"
377 }
378 },
379 {
380 "target_field": {
381 "@type": "string",
382 "@value": "rule_group1"
383 },
384 "condition_value": {
385 "@type": "string",
386 "@value": ""
387 },
388 "order": {
389 "@type": "integer",
390 "@value": 5
391 },
392 "converters": [],
393 "configuration": {
394 "index": {
395 "@type": "integer",
396 "@value": 1
397 },
398 "split_by": {
399 "@type": "string",
400 "@value": ","
401 }
402 },
403 "source_field": {
404 "@type": "string",
405 "@value": "rule_groups"
406 },
407 "title": {
408 "@type": "string",
409 "@value": "WAZUH RULE GROUPS SPLIT"
410 },
411 "type": {
412 "@type": "string",
413 "@value": "SPLIT_AND_INDEX"
414 },
415 "cursor_strategy": {
416 "@type": "string",
417 "@value": "COPY"
418 },
419 "condition_type": {
420 "@type": "string",
421 "@value": "NONE"
422 }
423 },
424 {
425 "target_field": {
426 "@type": "string",
427 "@value": "powershell_host_version"
428 },
429 "condition_value": {
430 "@type": "string",
431 "@value": ""
432 },
433 "order": {
434 "@type": "integer",
435 "@value": 2
436 },
437 "converters": [],
438 "configuration": {
439 "regex_value": {
440 "@type": "string",
441 "@value": "HostVersion=(\\d+.\\d+.\\d+.\\d+)"
442 }
443 },
444 "source_field": {
445 "@type": "string",
446 "@value": "data_win_eventdata_data"
447 },
448 "title": {
449 "@type": "string",
450 "@value": "Powershell Host Version"
451 },
452 "type": {
453 "@type": "string",
454 "@value": "REGEX"
455 },
456 "cursor_strategy": {
457 "@type": "string",
458 "@value": "COPY"
459 },
460 "condition_type": {
461 "@type": "string",
462 "@value": "NONE"
463 }
464 },
465 {
466 "target_field": {
467 "@type": "string",
468 "@value": "data_win_eventdata_rv_json"
469 },
470 "condition_value": {
471 "@type": "string",
472 "@value": ""
473 },
474 "order": {
475 "@type": "integer",
476 "@value": 8
477 },
478 "converters": [],
479 "configuration": {
480 "regex": {
481 "@type": "string",
482 "@value": "\\\\\\\""
483 },
484 "replacement": {
485 "@type": "string",
486 "@value": "\\\""
487 },
488 "replace_all": {
489 "@type": "boolean",
490 "@value": true
491 }
492 },
493 "source_field": {
494 "@type": "string",
495 "@value": "data_win_eventdata_rv"
496 },
497 "title": {
498 "@type": "string",
499 "@value": "EXTRACT JSON FROM F-SECURE MESSAGE"
500 },
501 "type": {
502 "@type": "string",
503 "@value": "REGEX_REPLACE"
504 },
505 "cursor_strategy": {
506 "@type": "string",
507 "@value": "CUT"
508 },
509 "condition_type": {
510 "@type": "string",
511 "@value": "NONE"
512 }
513 },
514 {
515 "target_field": {
516 "@type": "string",
517 "@value": ""
518 },
519 "condition_value": {
520 "@type": "string",
521 "@value": ""
522 },
523 "order": {
524 "@type": "integer",
525 "@value": 13
526 },
527 "converters": [],
528 "configuration": {
529 "list_separator": {
530 "@type": "string",
531 "@value": ", "
532 },
533 "kv_separator": {
534 "@type": "string",
535 "@value": ":"
536 },
537 "key_prefix": {
538 "@type": "string",
539 "@value": "misp_"
540 },
541 "key_separator": {
542 "@type": "string",
543 "@value": "_"
544 },
545 "replace_key_whitespace": {
546 "@type": "boolean",
547 "@value": false
548 },
549 "key_whitespace_replacement": {
550 "@type": "string",
551 "@value": "_"
552 }
553 },
554 "source_field": {
555 "@type": "string",
556 "@value": "misp_Event"
557 },
558 "title": {
559 "@type": "string",
560 "@value": "MISP EVENT JSON EXTRACTOR"
561 },
562 "type": {
563 "@type": "string",
564 "@value": "JSON"
565 },
566 "cursor_strategy": {
567 "@type": "string",
568 "@value": "COPY"
569 },
570 "condition_type": {
571 "@type": "string",
572 "@value": "NONE"
573 }
574 },
575 {
576 "target_field": {
577 "@type": "string",
578 "@value": ""
579 },
580 "condition_value": {
581 "@type": "string",
582 "@value": ""
583 },
584 "order": {
585 "@type": "integer",
586 "@value": 9
587 },
588 "converters": [],
589 "configuration": {
590 "list_separator": {
591 "@type": "string",
592 "@value": ", "
593 },
594 "kv_separator": {
595 "@type": "string",
596 "@value": ":"
597 },
598 "key_prefix": {
599 "@type": "string",
600 "@value": ""
601 },
602 "key_separator": {
603 "@type": "string",
604 "@value": "_"
605 },
606 "replace_key_whitespace": {
607 "@type": "boolean",
608 "@value": false
609 },
610 "key_whitespace_replacement": {
611 "@type": "string",
612 "@value": "_"
613 }
614 },
615 "source_field": {
616 "@type": "string",
617 "@value": "data_win_eventdata_rv_json"
618 },
619 "title": {
620 "@type": "string",
621 "@value": "EXTRACT KEY VALUE PAIRS FROM JSON F-SECURE MESSAGE"
622 },
623 "type": {
624 "@type": "string",
625 "@value": "JSON"
626 },
627 "cursor_strategy": {
628 "@type": "string",
629 "@value": "CUT"
630 },
631 "condition_type": {
632 "@type": "string",
633 "@value": "NONE"
634 }
635 },
636 {
637 "target_field": {
638 "@type": "string",
639 "@value": "imphash"
640 },
641 "condition_value": {
642 "@type": "string",
643 "@value": ""
644 },
645 "order": {
646 "@type": "integer",
647 "@value": 4
648 },
649 "converters": [
650 {
651 "type": {
652 "@type": "string",
653 "@value": "TOKENIZER"
654 },
655 "configuration": {}
656 }
657 ],
658 "configuration": {
659 "index": {
660 "@type": "integer",
661 "@value": 4
662 },
663 "split_by": {
664 "@type": "string",
665 "@value": ","
666 }
667 },
668 "source_field": {
669 "@type": "string",
670 "@value": "data_win_eventdata_hash"
671 },
672 "title": {
673 "@type": "string",
674 "@value": "Extracted IMPHASH"
675 },
676 "type": {
677 "@type": "string",
678 "@value": "SPLIT_AND_INDEX"
679 },
680 "cursor_strategy": {
681 "@type": "string",
682 "@value": "COPY"
683 },
684 "condition_type": {
685 "@type": "string",
686 "@value": "NONE"
687 }
688 },
689 {
690 "target_field": {
691 "@type": "string",
692 "@value": "powershell_engine_version"
693 },
694 "condition_value": {
695 "@type": "string",
696 "@value": ""
697 },
698 "order": {
699 "@type": "integer",
700 "@value": 3
701 },
702 "converters": [],
703 "configuration": {
704 "regex_value": {
705 "@type": "string",
706 "@value": "EngineVersion=(\\d+.\\d+.\\d+.\\d+)"
707 }
708 },
709 "source_field": {
710 "@type": "string",
711 "@value": "data_win_eventdata_data"
712 },
713 "title": {
714 "@type": "string",
715 "@value": "Powershell Engine Version"
716 },
717 "type": {
718 "@type": "string",
719 "@value": "REGEX"
720 },
721 "cursor_strategy": {
722 "@type": "string",
723 "@value": "COPY"
724 },
725 "condition_type": {
726 "@type": "string",
727 "@value": "NONE"
728 }
729 },
730 {
731 "target_field": {
732 "@type": "string",
733 "@value": ""
734 },
735 "condition_value": {
736 "@type": "string",
737 "@value": ""
738 },
739 "order": {
740 "@type": "integer",
741 "@value": 14
742 },
743 "converters": [],
744 "configuration": {
745 "list_separator": {
746 "@type": "string",
747 "@value": ", "
748 },
749 "kv_separator": {
750 "@type": "string",
751 "@value": ":"
752 },
753 "key_prefix": {
754 "@type": "string",
755 "@value": "opencti_json_"
756 },
757 "key_separator": {
758 "@type": "string",
759 "@value": "_"
760 },
761 "replace_key_whitespace": {
762 "@type": "boolean",
763 "@value": false
764 },
765 "key_whitespace_replacement": {
766 "@type": "string",
767 "@value": "_"
768 }
769 },
770 "source_field": {
771 "@type": "string",
772 "@value": "opencti_source"
773 },
774 "title": {
775 "@type": "string",
776 "@value": "OPENCTI JSON EXTRACTOR I"
777 },
778 "type": {
779 "@type": "string",
780 "@value": "JSON"
781 },
782 "cursor_strategy": {
783 "@type": "string",
784 "@value": "COPY"
785 },
786 "condition_type": {
787 "@type": "string",
788 "@value": "NONE"
789 }
790 },
791 {
792 "target_field": {
793 "@type": "string",
794 "@value": "msg_timestamp"
795 },
796 "condition_value": {
797 "@type": "string",
798 "@value": ""
799 },
800 "order": {
801 "@type": "integer",
802 "@value": 1
803 },
804 "converters": [
805 {
806 "type": {
807 "@type": "string",
808 "@value": "DATE"
809 },
810 "configuration": {
811 "date_format": {
812 "@type": "string",
813 "@value": "yyyy-MM-dd'T'HH:mm:ss.SSS"
814 },
815 "time_zone": {
816 "@type": "string",
817 "@value": "Etc/UTC"
818 }
819 }
820 }
821 ],
822 "configuration": {
823 "regex_value": {
824 "@type": "string",
825 "@value": "\"timestamp\":\"([^\"]*)\\+0000\""
826 }
827 },
828 "source_field": {
829 "@type": "string",
830 "@value": "message"
831 },
832 "title": {
833 "@type": "string",
834 "@value": "MSG_TIMESTAMP"
835 },
836 "type": {
837 "@type": "string",
838 "@value": "REGEX"
839 },
840 "cursor_strategy": {
841 "@type": "string",
842 "@value": "COPY"
843 },
844 "condition_type": {
845 "@type": "string",
846 "@value": "NONE"
847 }
848 }
849 ]
850 },
851 "constraints": [
852 {
853 "type": "server-version",
854 "version": ">=5.0.13+083613e"
855 }
856 ]
857 },
858 {
859 "v": "1",
860 "type": {
861 "name": "lookup_adapter",
862 "version": "1"
863 },
864 "id": "9b317b42-770d-46fb-b740-96c679c38f73",
865 "data": {
866 "_scope": {
867 "@type": "string",
868 "@value": "DEFAULT"
869 },
870 "name": {
871 "@type": "string",
872 "@value": "software-vendors"
873 },
874 "title": {
875 "@type": "string",
876 "@value": "Software Vendors"
877 },
878 "description": {
879 "@type": "string",
880 "@value": "List of Approved Software Vendors"
881 },
882 "configuration": {
883 "type": {
884 "@type": "string",
885 "@value": "csvfile"
886 },
887 "path": {
888 "@type": "string",
889 "@value": "/etc/graylog/software_vendors.csv"
890 },
891 "separator": {
892 "@type": "string",
893 "@value": ","
894 },
895 "quotechar": {
896 "@type": "string",
897 "@value": "\""
898 },
899 "key_column": {
900 "@type": "string",
901 "@value": "vendor"
902 },
903 "value_column": {
904 "@type": "string",
905 "@value": "approved"
906 },
907 "check_interval": {
908 "@type": "long",
909 "@value": 60
910 },
911 "case_insensitive_lookup": {
912 "@type": "boolean",
913 "@value": true
914 }
915 }
916 },
917 "constraints": [
918 {
919 "type": "server-version",
920 "version": ">=5.0.13+083613e"
921 }
922 ]
923 },
924 {
925 "v": "1",
926 "type": {
927 "name": "lookup_adapter",
928 "version": "1"
929 },
930 "id": "41437203-db84-46a2-9ea1-0db7ed2c699e",
931 "data": {
932 "_scope": {
933 "@type": "string",
934 "@value": "DEFAULT"
935 },
936 "name": {
937 "@type": "string",
938 "@value": "nist-800-53-to-cui-controls"
939 },
940 "title": {
941 "@type": "string",
942 "@value": "NIST 800-53 TO CUI CONTROLS"
943 },
944 "description": {
945 "@type": "string",
946 "@value": "NIST 800-53 TO CUI CONTROLS"
947 },
948 "configuration": {
949 "type": {
950 "@type": "string",
951 "@value": "csvfile"
952 },
953 "path": {
954 "@type": "string",
955 "@value": "/etc/graylog/nist_800_53_to_cui.csv"
956 },
957 "separator": {
958 "@type": "string",
959 "@value": ","
960 },
961 "quotechar": {
962 "@type": "string",
963 "@value": "\""
964 },
965 "key_column": {
966 "@type": "string",
967 "@value": "nist_800_53"
968 },
969 "value_column": {
970 "@type": "string",
971 "@value": "cui"
972 },
973 "check_interval": {
974 "@type": "long",
975 "@value": 60
976 },
977 "case_insensitive_lookup": {
978 "@type": "boolean",
979 "@value": false
980 }
981 }
982 },
983 "constraints": [
984 {
985 "type": "server-version",
986 "version": ">=5.0.13+083613e"
987 }
988 ]
989 },
990 {
991 "v": "1",
992 "type": {
993 "name": "lookup_adapter",
994 "version": "1"
995 },
996 "id": "5f2980e7-a0ea-46f1-99aa-da8b93365663",
997 "data": {
998 "_scope": {
999 "@type": "string",
1000 "@value": "DEFAULT"
1001 },
1002 "name": {
1003 "@type": "string",
1004 "@value": "epss"
1005 },
1006 "title": {
1007 "@type": "string",
1008 "@value": "EPSS"
1009 },
1010 "description": {
1011 "@type": "string",
1012 "@value": "https://www.first.org/epss/api - Get CVE Score"
1013 },
1014 "configuration": {
1015 "type": {
1016 "@type": "string",
1017 "@value": "httpjsonpath"
1018 },
1019 "url": {
1020 "@type": "string",
1021 "@value": "https://api.first.org/data/v1/epss?cve=${key}"
1022 },
1023 "single_value_jsonpath": {
1024 "@type": "string",
1025 "@value": "$.status"
1026 },
1027 "multi_value_jsonpath": {
1028 "@type": "string",
1029 "@value": "$.data[0]"
1030 },
1031 "user_agent": {
1032 "@type": "string",
1033 "@value": "Graylog Lookup - https://www.graylog.org/"
1034 }
1035 }
1036 },
1037 "constraints": [
1038 {
1039 "type": "server-version",
1040 "version": ">=5.0.13+083613e"
1041 }
1042 ]
1043 },
1044 {
1045 "v": "1",
1046 "type": {
1047 "name": "lookup_adapter",
1048 "version": "1"
1049 },
1050 "id": "1405cf60-dda4-43d4-bb60-53ceb06e1bf1",
1051 "data": {
1052 "_scope": {
1053 "@type": "string",
1054 "@value": "DEFAULT"
1055 },
1056 "name": {
1057 "@type": "string",
1058 "@value": "socfortress-threat-intel"
1059 },
1060 "title": {
1061 "@type": "string",
1062 "@value": "SOCFortress Threat Intel"
1063 },
1064 "description": {
1065 "@type": "string",
1066 "@value": "SOCFortress Threat Intel"
1067 },
1068 "configuration": {
1069 "type": {
1070 "@type": "string",
1071 "@value": "httpjsonpath"
1072 },
1073 "url": {
1074 "@type": "string",
1075 "@value": "https://intel.socfortress.co/search?value=${key}"
1076 },
1077 "single_value_jsonpath": {
1078 "@type": "string",
1079 "@value": "$.success"
1080 },
1081 "multi_value_jsonpath": {
1082 "@type": "string",
1083 "@value": "$.data"
1084 },
1085 "user_agent": {
1086 "@type": "string",
1087 "@value": "curl/7.74.0"
1088 },
1089 "headers": {
1090 "Content-Type": {
1091 "@type": "string",
1092 "@value": "application/json"
1093 },
1094 "module-version": {
1095 "@type": "string",
1096 "@value": "1.0"
1097 },
1098 "x-api-key": {
1099 "@type": "string",
1100 "@value": "REPLACE_ME"
1101 }
1102 }
1103 }
1104 },
1105 "constraints": [
1106 {
1107 "type": "server-version",
1108 "version": ">=5.0.13+083613e"
1109 }
1110 ]
1111 },
1112 {
1113 "v": "1",
1114 "type": {
1115 "name": "lookup_adapter",
1116 "version": "1"
1117 },
1118 "id": "731af176-a847-4a28-bf32-bd5ba4462d79",
1119 "data": {
1120 "_scope": {
1121 "@type": "string",
1122 "@value": "DEFAULT"
1123 },
1124 "name": {
1125 "@type": "string",
1126 "@value": "network-ports"
1127 },
1128 "title": {
1129 "@type": "string",
1130 "@value": "Network Ports"
1131 },
1132 "description": {
1133 "@type": "string",
1134 "@value": "List of Common Network Ports"
1135 },
1136 "configuration": {
1137 "type": {
1138 "@type": "string",
1139 "@value": "csvfile"
1140 },
1141 "path": {
1142 "@type": "string",
1143 "@value": "/etc/graylog/network_ports.csv"
1144 },
1145 "separator": {
1146 "@type": "string",
1147 "@value": ","
1148 },
1149 "quotechar": {
1150 "@type": "string",
1151 "@value": "\""
1152 },
1153 "key_column": {
1154 "@type": "string",
1155 "@value": "port"
1156 },
1157 "value_column": {
1158 "@type": "string",
1159 "@value": "common"
1160 },
1161 "check_interval": {
1162 "@type": "long",
1163 "@value": 60
1164 },
1165 "case_insensitive_lookup": {
1166 "@type": "boolean",
1167 "@value": true
1168 }
1169 }
1170 },
1171 "constraints": [
1172 {
1173 "type": "server-version",
1174 "version": ">=5.0.13+083613e"
1175 }
1176 ]
1177 },
1178 {
1179 "v": "1",
1180 "type": {
1181 "name": "lookup_cache",
1182 "version": "1"
1183 },
1184 "id": "009f38c0-0cf3-4010-8c8c-e4ea87e6f4f5",
1185 "data": {
1186 "_scope": {
1187 "@type": "string",
1188 "@value": "DEFAULT"
1189 },
1190 "name": {
1191 "@type": "string",
1192 "@value": "epss-cache"
1193 },
1194 "title": {
1195 "@type": "string",
1196 "@value": "EPSS Cache"
1197 },
1198 "description": {
1199 "@type": "string",
1200 "@value": "EPSS Cache"
1201 },
1202 "configuration": {
1203 "type": {
1204 "@type": "string",
1205 "@value": "guava_cache"
1206 },
1207 "max_size": {
1208 "@type": "integer",
1209 "@value": 1000
1210 },
1211 "expire_after_access": {
1212 "@type": "long",
1213 "@value": 60
1214 },
1215 "expire_after_access_unit": {
1216 "@type": "string",
1217 "@value": "MINUTES"
1218 },
1219 "expire_after_write": {
1220 "@type": "long",
1221 "@value": 0
1222 }
1223 }
1224 },
1225 "constraints": [
1226 {
1227 "type": "server-version",
1228 "version": ">=5.0.13+083613e"
1229 }
1230 ]
1231 },
1232 {
1233 "v": "1",
1234 "type": {
1235 "name": "lookup_cache",
1236 "version": "1"
1237 },
1238 "id": "d8301ead-3d48-46bf-875f-7994a5dbe558",
1239 "data": {
1240 "_scope": {
1241 "@type": "string",
1242 "@value": "DEFAULT"
1243 },
1244 "name": {
1245 "@type": "string",
1246 "@value": "software-vendors"
1247 },
1248 "title": {
1249 "@type": "string",
1250 "@value": "Software Vendors"
1251 },
1252 "description": {
1253 "@type": "string",
1254 "@value": "Cache of approved software vendors"
1255 },
1256 "configuration": {
1257 "type": {
1258 "@type": "string",
1259 "@value": "guava_cache"
1260 },
1261 "max_size": {
1262 "@type": "integer",
1263 "@value": 1000
1264 },
1265 "expire_after_access": {
1266 "@type": "long",
1267 "@value": 60
1268 },
1269 "expire_after_access_unit": {
1270 "@type": "string",
1271 "@value": "SECONDS"
1272 },
1273 "expire_after_write": {
1274 "@type": "long",
1275 "@value": 0
1276 }
1277 }
1278 },
1279 "constraints": [
1280 {
1281 "type": "server-version",
1282 "version": ">=5.0.13+083613e"
1283 }
1284 ]
1285 },
1286 {
1287 "v": "1",
1288 "type": {
1289 "name": "lookup_cache",
1290 "version": "1"
1291 },
1292 "id": "55ff2d16-b318-4717-893f-fed63ca005fc",
1293 "data": {
1294 "_scope": {
1295 "@type": "string",
1296 "@value": "DEFAULT"
1297 },
1298 "name": {
1299 "@type": "string",
1300 "@value": "socfortress-threat-intel-cache"
1301 },
1302 "title": {
1303 "@type": "string",
1304 "@value": "SOCFortress Threat Intel Lookup Table"
1305 },
1306 "description": {
1307 "@type": "string",
1308 "@value": "SOCFortress Threat Intel Lookup Table"
1309 },
1310 "configuration": {
1311 "type": {
1312 "@type": "string",
1313 "@value": "guava_cache"
1314 },
1315 "max_size": {
1316 "@type": "integer",
1317 "@value": 1000
1318 },
1319 "expire_after_access": {
1320 "@type": "long",
1321 "@value": 60
1322 },
1323 "expire_after_access_unit": {
1324 "@type": "string",
1325 "@value": "MINUTES"
1326 },
1327 "expire_after_write": {
1328 "@type": "long",
1329 "@value": 0
1330 }
1331 }
1332 },
1333 "constraints": [
1334 {
1335 "type": "server-version",
1336 "version": ">=5.0.13+083613e"
1337 }
1338 ]
1339 },
1340 {
1341 "v": "1",
1342 "type": {
1343 "name": "lookup_cache",
1344 "version": "1"
1345 },
1346 "id": "2a2edc22-1d0b-4ebb-adc6-068d0017a602",
1347 "data": {
1348 "_scope": {
1349 "@type": "string",
1350 "@value": "DEFAULT"
1351 },
1352 "name": {
1353 "@type": "string",
1354 "@value": "network-ports"
1355 },
1356 "title": {
1357 "@type": "string",
1358 "@value": "Network Ports"
1359 },
1360 "description": {
1361 "@type": "string",
1362 "@value": "Cache of common network ports"
1363 },
1364 "configuration": {
1365 "type": {
1366 "@type": "string",
1367 "@value": "guava_cache"
1368 },
1369 "max_size": {
1370 "@type": "integer",
1371 "@value": 1000
1372 },
1373 "expire_after_access": {
1374 "@type": "long",
1375 "@value": 60
1376 },
1377 "expire_after_access_unit": {
1378 "@type": "string",
1379 "@value": "SECONDS"
1380 },
1381 "expire_after_write": {
1382 "@type": "long",
1383 "@value": 0
1384 }
1385 }
1386 },
1387 "constraints": [
1388 {
1389 "type": "server-version",
1390 "version": ">=5.0.13+083613e"
1391 }
1392 ]
1393 },
1394 {
1395 "v": "1",
1396 "type": {
1397 "name": "lookup_cache",
1398 "version": "1"
1399 },
1400 "id": "bf37d686-3cb7-4eeb-9eb9-e08c0adc724b",
1401 "data": {
1402 "_scope": {
1403 "@type": "string",
1404 "@value": "DEFAULT"
1405 },
1406 "name": {
1407 "@type": "string",
1408 "@value": "nist-800-53-to-cui-controls"
1409 },
1410 "title": {
1411 "@type": "string",
1412 "@value": "NIST 800-53 TO CUI CONTROLS"
1413 },
1414 "description": {
1415 "@type": "string",
1416 "@value": "NIST 800-53 TO CUI CONTROLS"
1417 },
1418 "configuration": {
1419 "type": {
1420 "@type": "string",
1421 "@value": "guava_cache"
1422 },
1423 "max_size": {
1424 "@type": "integer",
1425 "@value": 1000
1426 },
1427 "expire_after_access": {
1428 "@type": "long",
1429 "@value": 60
1430 },
1431 "expire_after_access_unit": {
1432 "@type": "string",
1433 "@value": "SECONDS"
1434 },
1435 "expire_after_write": {
1436 "@type": "long",
1437 "@value": 0
1438 }
1439 }
1440 },
1441 "constraints": [
1442 {
1443 "type": "server-version",
1444 "version": ">=5.0.13+083613e"
1445 }
1446 ]
1447 },
1448 {
1449 "v": "1",
1450 "type": {
1451 "name": "lookup_table",
1452 "version": "1"
1453 },
1454 "id": "5d81905e-723d-4e57-9b2b-e088ffb5241d",
1455 "data": {
1456 "default_single_value_type": {
1457 "@type": "string",
1458 "@value": "NULL"
1459 },
1460 "cache_name": {
1461 "@type": "string",
1462 "@value": "2a2edc22-1d0b-4ebb-adc6-068d0017a602"
1463 },
1464 "name": {
1465 "@type": "string",
1466 "@value": "network-ports"
1467 },
1468 "default_multi_value_type": {
1469 "@type": "string",
1470 "@value": "NULL"
1471 },
1472 "default_multi_value": {
1473 "@type": "string",
1474 "@value": ""
1475 },
1476 "data_adapter_name": {
1477 "@type": "string",
1478 "@value": "731af176-a847-4a28-bf32-bd5ba4462d79"
1479 },
1480 "_scope": {
1481 "@type": "string",
1482 "@value": "DEFAULT"
1483 },
1484 "title": {
1485 "@type": "string",
1486 "@value": "Network Ports"
1487 },
1488 "default_single_value": {
1489 "@type": "string",
1490 "@value": ""
1491 },
1492 "description": {
1493 "@type": "string",
1494 "@value": "Lookup table for network ports"
1495 }
1496 },
1497 "constraints": [
1498 {
1499 "type": "server-version",
1500 "version": ">=5.0.13+083613e"
1501 }
1502 ]
1503 },
1504 {
1505 "v": "1",
1506 "type": {
1507 "name": "lookup_table",
1508 "version": "1"
1509 },
1510 "id": "55c75b17-7e24-4859-b230-a4122fc8ec19",
1511 "data": {
1512 "default_single_value_type": {
1513 "@type": "string",
1514 "@value": "NULL"
1515 },
1516 "cache_name": {
1517 "@type": "string",
1518 "@value": "bf37d686-3cb7-4eeb-9eb9-e08c0adc724b"
1519 },
1520 "name": {
1521 "@type": "string",
1522 "@value": "nist_800_53_to_cui"
1523 },
1524 "default_multi_value_type": {
1525 "@type": "string",
1526 "@value": "NULL"
1527 },
1528 "default_multi_value": {
1529 "@type": "string",
1530 "@value": ""
1531 },
1532 "data_adapter_name": {
1533 "@type": "string",
1534 "@value": "41437203-db84-46a2-9ea1-0db7ed2c699e"
1535 },
1536 "_scope": {
1537 "@type": "string",
1538 "@value": "DEFAULT"
1539 },
1540 "title": {
1541 "@type": "string",
1542 "@value": "NIST 800-53 TO CUI CONTROLS"
1543 },
1544 "default_single_value": {
1545 "@type": "string",
1546 "@value": ""
1547 },
1548 "description": {
1549 "@type": "string",
1550 "@value": "NIST 800-53 TO CUI CONTROLS"
1551 }
1552 },
1553 "constraints": [
1554 {
1555 "type": "server-version",
1556 "version": ">=5.0.13+083613e"
1557 }
1558 ]
1559 },
1560 {
1561 "v": "1",
1562 "type": {
1563 "name": "lookup_table",
1564 "version": "1"
1565 },
1566 "id": "d1b3ac8a-ac53-4e8b-be76-abc431a5a80f",
1567 "data": {
1568 "default_single_value_type": {
1569 "@type": "string",
1570 "@value": "NULL"
1571 },
1572 "cache_name": {
1573 "@type": "string",
1574 "@value": "009f38c0-0cf3-4010-8c8c-e4ea87e6f4f5"
1575 },
1576 "name": {
1577 "@type": "string",
1578 "@value": "epss"
1579 },
1580 "default_multi_value_type": {
1581 "@type": "string",
1582 "@value": "NULL"
1583 },
1584 "default_multi_value": {
1585 "@type": "string",
1586 "@value": ""
1587 },
1588 "data_adapter_name": {
1589 "@type": "string",
1590 "@value": "5f2980e7-a0ea-46f1-99aa-da8b93365663"
1591 },
1592 "_scope": {
1593 "@type": "string",
1594 "@value": "DEFAULT"
1595 },
1596 "title": {
1597 "@type": "string",
1598 "@value": "EPSS Lookup Table"
1599 },
1600 "default_single_value": {
1601 "@type": "string",
1602 "@value": ""
1603 },
1604 "description": {
1605 "@type": "string",
1606 "@value": "https://www.first.org/epss/api"
1607 }
1608 },
1609 "constraints": [
1610 {
1611 "type": "server-version",
1612 "version": ">=5.0.13+083613e"
1613 }
1614 ]
1615 },
1616 {
1617 "v": "1",
1618 "type": {
1619 "name": "lookup_table",
1620 "version": "1"
1621 },
1622 "id": "37164c4c-c986-4c7c-a5e3-d9a8f1ddc337",
1623 "data": {
1624 "default_single_value_type": {
1625 "@type": "string",
1626 "@value": "NULL"
1627 },
1628 "cache_name": {
1629 "@type": "string",
1630 "@value": "d8301ead-3d48-46bf-875f-7994a5dbe558"
1631 },
1632 "name": {
1633 "@type": "string",
1634 "@value": "software-vendors"
1635 },
1636 "default_multi_value_type": {
1637 "@type": "string",
1638 "@value": "NULL"
1639 },
1640 "default_multi_value": {
1641 "@type": "string",
1642 "@value": ""
1643 },
1644 "data_adapter_name": {
1645 "@type": "string",
1646 "@value": "9b317b42-770d-46fb-b740-96c679c38f73"
1647 },
1648 "_scope": {
1649 "@type": "string",
1650 "@value": "DEFAULT"
1651 },
1652 "title": {
1653 "@type": "string",
1654 "@value": "Software Vendors"
1655 },
1656 "default_single_value": {
1657 "@type": "string",
1658 "@value": ""
1659 },
1660 "description": {
1661 "@type": "string",
1662 "@value": "Lookup table for Software Vendors"
1663 }
1664 },
1665 "constraints": [
1666 {
1667 "type": "server-version",
1668 "version": ">=5.0.13+083613e"
1669 }
1670 ]
1671 },
1672 {
1673 "v": "1",
1674 "type": {
1675 "name": "lookup_table",
1676 "version": "1"
1677 },
1678 "id": "0d0105b5-0256-4a15-8f26-eff5b18ae614",
1679 "data": {
1680 "default_single_value_type": {
1681 "@type": "string",
1682 "@value": "NULL"
1683 },
1684 "cache_name": {
1685 "@type": "string",
1686 "@value": "55ff2d16-b318-4717-893f-fed63ca005fc"
1687 },
1688 "name": {
1689 "@type": "string",
1690 "@value": "socfortress_threat_intel"
1691 },
1692 "default_multi_value_type": {
1693 "@type": "string",
1694 "@value": "NULL"
1695 },
1696 "default_multi_value": {
1697 "@type": "string",
1698 "@value": ""
1699 },
1700 "data_adapter_name": {
1701 "@type": "string",
1702 "@value": "1405cf60-dda4-43d4-bb60-53ceb06e1bf1"
1703 },
1704 "_scope": {
1705 "@type": "string",
1706 "@value": "DEFAULT"
1707 },
1708 "title": {
1709 "@type": "string",
1710 "@value": "SOCFortress Threat Intel Lookup Table"
1711 },
1712 "default_single_value": {
1713 "@type": "string",
1714 "@value": ""
1715 },
1716 "description": {
1717 "@type": "string",
1718 "@value": "SOCFortress Threat Intel Lookup Table"
1719 }
1720 },
1721 "constraints": [
1722 {
1723 "type": "server-version",
1724 "version": ">=5.0.13+083613e"
1725 }
1726 ]
1727 },
1728 {
1729 "v": "1",
1730 "type": {
1731 "name": "pipeline",
1732 "version": "1"
1733 },
1734 "id": "aa38e373-4bad-4bed-b6fe-fe707d749fdb",
1735 "data": {
1736 "title": {
1737 "@type": "string",
1738 "@value": "WAZUH PROCESSING PIPELINES"
1739 },
1740 "description": {
1741 "@type": "string",
1742 "@value": "WAZUH PROCESSING PIPELINES"
1743 },
1744 "source": {
1745 "@type": "string",
1746 "@value": "pipeline \"WAZUH PROCESSING PIPELINES\"\nstage 0 match pass\nrule \"DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE\"\nstage 1 match either\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nrule \"Linux Sysmon Timestamp - UTC\"\nrule \"Office365 Timestamp - UTC\"\nrule \"Osquery Epoch Timestamp - UTC\"\nrule \"Packetbeat Timestamp - UTC\"\nrule \"Windows Timestamp - UTC\"\nrule \"URL Encode data_name field for ASK SOCFortress API\"\nrule \"NIST 800-53 TO CUI MAPPING\"\nrule \"SYSLOG TYPE OFFICE365\"\nrule \"SYSLOG TYPE SURICATA\"\nstage 2 match pass\nrule \"USER ADDED TO PRIVILEGE ADMIN GROUP\"\nrule \"ASK SOCFORTRESS WINDOWS - CHAINSAW\"\nstage 3 match either\nrule \"Tetragon - Set process_id from exec_id\"\nrule \"Tetragon - Set process_id from parent\"\nrule \"LINUX SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT DNS LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 2 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 22 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 7 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 10 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 12 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 13 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 17 LOG NORMALIZATION\"\nrule \"LINUX OSQUERY PROCESS LIST LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT NETWORK LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 15 LOG NORMALIZATION\"\nrule \"OSSEC SYSCHECK ADDED EVENT NORMALIZATION\"\nrule \"EPSS CVE Criticality\"\nrule \"EPSS CVE Criticality - NMAP\"\nrule \"WINDOWS PROCESS ID - No EventData Field\"\nrule \"WINDOWS PROCESS ID - Non SOCFortress Sysmon\"\nrule \"Timestamp Failsafe - UTC\"\nrule \"LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_ProcessId\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId\"\nrule \"LINUX OSQUERY PROCESS ID - GENERIC\"\nrule \"MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION\"\nrule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained\"\nrule \"OpenAudit Remove field - data_system_software_item_install_date\"\nrule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_expires\"\nstage 4 match pass\nrule \"WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - NETWORK PORTS\"\nstage 5 match pass\nrule \"WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - UNCOMMON PORT\"\nstage 7 match either\nrule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nstage 6 match either\nrule \"LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL\"\nend"
1747 },
1748 "connected_streams": [
1749 {
1750 "@type": "string",
1751 "@value": "feb9e1d7-9346-4a2a-9566-59ed483c1b83"
1752 }
1753 ]
1754 },
1755 "constraints": [
1756 {
1757 "type": "server-version",
1758 "version": ">=5.0.13+083613e"
1759 }
1760 ]
1761 },
1762 {
1763 "v": "1",
1764 "type": {
1765 "name": "pipeline_rule",
1766 "version": "1"
1767 },
1768 "id": "5a6fdec9-fa76-41f2-be92-158fa380db42",
1769 "data": {
1770 "title": {
1771 "@type": "string",
1772 "@value": "NIST 800-53 TO CUI MAPPING"
1773 },
1774 "description": {
1775 "@type": "string",
1776 "@value": "NIST 800-53 TO CUI MAPPING"
1777 },
1778 "source": {
1779 "@type": "string",
1780 "@value": "rule \"NIST 800-53 TO CUI MAPPING\"\nwhen\n has_field(\"rule_nist_800_53\")\nthen\n let ldata = lookup(\n lookup_table: \"nist_800_53_to_cui\",\n key: to_string($message.rule_nist_800_53)\n );\n set_fields(\n fields: ldata,\n prefix: \"cui_\"\n );\nend"
1781 }
1782 },
1783 "constraints": [
1784 {
1785 "type": "server-version",
1786 "version": ">=5.0.13+083613e"
1787 }
1788 ]
1789 },
1790 {
1791 "v": "1",
1792 "type": {
1793 "name": "pipeline_rule",
1794 "version": "1"
1795 },
1796 "id": "1d4217e1-28ab-4950-b8be-a25fc8e9555c",
1797 "data": {
1798 "title": {
1799 "@type": "string",
1800 "@value": "LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
1801 },
1802 "description": {
1803 "@type": "string",
1804 "@value": "LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
1805 },
1806 "source": {
1807 "@type": "string",
1808 "@value": "rule \"LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_eventdata_DestinationIp != \"127.0.0.1\" AND $message.data_eventdata_DestinationIp != \"255.255.255.255\" AND $message.data_eventdata_DestinationIp != \"0.0.0.0\" AND $message.data_eventdata_destinationIsIpv6 == \"false\" AND ! in_private_net(to_string($message.data_eventdata_DestinationIp))\nthen\n let ip_and_ampersand = concat(to_string($message.data_eventdata_DestinationIp), \"&customer_code=\");\n let new_key = concat(ip_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
1809 }
1810 },
1811 "constraints": [
1812 {
1813 "type": "server-version",
1814 "version": ">=5.0.13+083613e"
1815 }
1816 ]
1817 },
1818 {
1819 "v": "1",
1820 "type": {
1821 "name": "pipeline_rule",
1822 "version": "1"
1823 },
1824 "id": "5745b55a-7958-45d6-bdbf-67b8feca5b3a",
1825 "data": {
1826 "title": {
1827 "@type": "string",
1828 "@value": "WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID"
1829 },
1830 "description": {
1831 "@type": "string",
1832 "@value": "WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID"
1833 },
1834 "source": {
1835 "@type": "string",
1836 "@value": "rule \"WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID\"\nwhen\n has_field(\"data_system_Execution_attributes_ProcessID\") AND $message.rule_group1 == \"windows\" AND $message.rule_group2 == \"chainsaw\"\nthen\n set_field(\"process_id\", $message.data_system_Execution_attributes_ProcessID);\nend"
1837 }
1838 },
1839 "constraints": [
1840 {
1841 "type": "server-version",
1842 "version": ">=5.0.13+083613e"
1843 }
1844 ]
1845 },
1846 {
1847 "v": "1",
1848 "type": {
1849 "name": "pipeline_rule",
1850 "version": "1"
1851 },
1852 "id": "cf069904-64d8-4b2f-b57a-25fbc07dd47e",
1853 "data": {
1854 "title": {
1855 "@type": "string",
1856 "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND"
1857 },
1858 "description": {
1859 "@type": "string",
1860 "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND"
1861 },
1862 "source": {
1863 "@type": "string",
1864 "@value": "rule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nwhen\n has_field(\"threat_intel_value\")\nthen\n set_field(\"syslog_level\", \"ALERT\");\nend"
1865 }
1866 },
1867 "constraints": [
1868 {
1869 "type": "server-version",
1870 "version": ">=5.0.13+083613e"
1871 }
1872 ]
1873 },
1874 {
1875 "v": "1",
1876 "type": {
1877 "name": "pipeline_rule",
1878 "version": "1"
1879 },
1880 "id": "fcf8bf1f-5280-474a-88bd-0ef50f2049db",
1881 "data": {
1882 "title": {
1883 "@type": "string",
1884 "@value": "LINUX SYSMON EVENT 9 LOG NORMALIZATION"
1885 },
1886 "description": {
1887 "@type": "string",
1888 "@value": "LINUX SYSMON EVENT 9 LOG NORMALIZATION"
1889 },
1890 "source": {
1891 "@type": "string",
1892 "@value": "rule \"LINUX SYSMON EVENT 9 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event9\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"device\", $message.data_eventdata_device);\nend"
1893 }
1894 },
1895 "constraints": [
1896 {
1897 "type": "server-version",
1898 "version": ">=5.0.13+083613e"
1899 }
1900 ]
1901 },
1902 {
1903 "v": "1",
1904 "type": {
1905 "name": "pipeline_rule",
1906 "version": "1"
1907 },
1908 "id": "81633691-fa79-4ca8-a5ff-c67fc55ede49",
1909 "data": {
1910 "title": {
1911 "@type": "string",
1912 "@value": "WINDOWS SYSMON EVENT 22 LOG NORMALIZATION"
1913 },
1914 "description": {
1915 "@type": "string",
1916 "@value": "WINDOWS SYSMON EVENT 22 LOG NORMALIZATION"
1917 },
1918 "source": {
1919 "@type": "string",
1920 "@value": "rule \"WINDOWS SYSMON EVENT 22 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_22\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"dns_query\", $message.data_win_eventdata_queryName);\n set_field(\"dns_answer\", $message.data_win_eventdata_queryResults);\n set_field(\"dns_response_code\", $message.data_win_eventdata_queryStatus);\nend"
1921 }
1922 },
1923 "constraints": [
1924 {
1925 "type": "server-version",
1926 "version": ">=5.0.13+083613e"
1927 }
1928 ]
1929 },
1930 {
1931 "v": "1",
1932 "type": {
1933 "name": "pipeline_rule",
1934 "version": "1"
1935 },
1936 "id": "ed57ba97-b339-41cf-91c1-1837feecf032",
1937 "data": {
1938 "title": {
1939 "@type": "string",
1940 "@value": "DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE"
1941 },
1942 "description": {
1943 "@type": "string",
1944 "@value": "DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE"
1945 },
1946 "source": {
1947 "@type": "string",
1948 "@value": "rule \"DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event_12\" AND ($message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageHeartbeat\\\\\\\\AgentPackageHeartbeat.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\windows\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\svchost.exe\")\nthen\n drop_message();\nend"
1949 }
1950 },
1951 "constraints": [
1952 {
1953 "type": "server-version",
1954 "version": ">=5.0.13+083613e"
1955 }
1956 ]
1957 },
1958 {
1959 "v": "1",
1960 "type": {
1961 "name": "pipeline_rule",
1962 "version": "1"
1963 },
1964 "id": "a711be64-131f-494f-9068-9dcd56da1b02",
1965 "data": {
1966 "title": {
1967 "@type": "string",
1968 "@value": "WINDOWS SYSMON EVENT 15 LOG NORMALIZATION"
1969 },
1970 "description": {
1971 "@type": "string",
1972 "@value": "WINDOWS SYSMON EVENT 15 LOG NORMALIZATION"
1973 },
1974 "source": {
1975 "@type": "string",
1976 "@value": "rule \"WINDOWS SYSMON EVENT 15 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_15\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\nend"
1977 }
1978 },
1979 "constraints": [
1980 {
1981 "type": "server-version",
1982 "version": ">=5.0.13+083613e"
1983 }
1984 ]
1985 },
1986 {
1987 "v": "1",
1988 "type": {
1989 "name": "pipeline_rule",
1990 "version": "1"
1991 },
1992 "id": "de7d8e04-ad04-4185-8811-569f0cc17bd5",
1993 "data": {
1994 "title": {
1995 "@type": "string",
1996 "@value": "PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL"
1997 },
1998 "description": {
1999 "@type": "string",
2000 "@value": "PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL"
2001 },
2002 "source": {
2003 "@type": "string",
2004 "@value": "rule \"PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"dns\"\nthen\n let dns_question_name_and_ampersand = concat(to_string($message.data_dns_question_name), \"&customer_code=\");\n let new_key = concat(dns_question_name_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2005 }
2006 },
2007 "constraints": [
2008 {
2009 "type": "server-version",
2010 "version": ">=5.0.13+083613e"
2011 }
2012 ]
2013 },
2014 {
2015 "v": "1",
2016 "type": {
2017 "name": "pipeline_rule",
2018 "version": "1"
2019 },
2020 "id": "73af67a1-87a4-4e61-bd96-f68557603a92",
2021 "data": {
2022 "title": {
2023 "@type": "string",
2024 "@value": "OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL"
2025 },
2026 "description": {
2027 "@type": "string",
2028 "@value": "OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL"
2029 },
2030 "source": {
2031 "@type": "string",
2032 "@value": "rule \"OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"ossec\" AND $message.rule_group2 == \"syscheck\" AND $message.syscheck_event == \"added\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend\n"
2033 }
2034 },
2035 "constraints": [
2036 {
2037 "type": "server-version",
2038 "version": ">=5.0.13+083613e"
2039 }
2040 ]
2041 },
2042 {
2043 "v": "1",
2044 "type": {
2045 "name": "pipeline_rule",
2046 "version": "1"
2047 },
2048 "id": "4105240a-13b3-4cf0-b62f-566227d522cb",
2049 "data": {
2050 "title": {
2051 "@type": "string",
2052 "@value": "Osquery Epoch Timestamp - UTC"
2053 },
2054 "description": {
2055 "@type": "string",
2056 "@value": "Osquery Epoch Timestamp - UTC"
2057 },
2058 "source": {
2059 "@type": "string",
2060 "@value": "rule \"Osquery Epoch Timestamp - UTC\"\nwhen\n has_field(\"data_unixTime\")\nthen\n let ts_millis = to_long($message.data_unixTime) * 1000;\n let new_date = parse_unix_milliseconds(ts_millis);\n set_field(\"timestamp_utc\", new_date);\nend"
2061 }
2062 },
2063 "constraints": [
2064 {
2065 "type": "server-version",
2066 "version": ">=5.0.13+083613e"
2067 }
2068 ]
2069 },
2070 {
2071 "v": "1",
2072 "type": {
2073 "name": "pipeline_rule",
2074 "version": "1"
2075 },
2076 "id": "546e667e-b3c4-482f-9f43-a836097290ed",
2077 "data": {
2078 "title": {
2079 "@type": "string",
2080 "@value": "WINDOWS SYSMON EVENT 2 LOG NORMALIZATION"
2081 },
2082 "description": {
2083 "@type": "string",
2084 "@value": "WINDOWS SYSMON EVENT 2 LOG NORMALIZATION"
2085 },
2086 "source": {
2087 "@type": "string",
2088 "@value": "rule \"WINDOWS SYSMON EVENT 2 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event2\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\nend"
2089 }
2090 },
2091 "constraints": [
2092 {
2093 "type": "server-version",
2094 "version": ">=5.0.13+083613e"
2095 }
2096 ]
2097 },
2098 {
2099 "v": "1",
2100 "type": {
2101 "name": "pipeline_rule",
2102 "version": "1"
2103 },
2104 "id": "5452ff04-d03a-4876-8417-63b00ecdd2ed",
2105 "data": {
2106 "title": {
2107 "@type": "string",
2108 "@value": "DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES"
2109 },
2110 "description": {
2111 "@type": "string",
2112 "@value": "DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES"
2113 },
2114 "source": {
2115 "@type": "string",
2116 "@value": "rule \"DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES\"\nwhen\n$message.rule_group2 == \"process_events\" AND ($message.data_columns_path == \"/usr/bin/ls\" OR $message.data_columns_path == \"/usr/bin/ps\" OR $message.data_columns_path == \"/usr/bin/sleep\" OR $message.data_columns_path == \"/usr/bin/awk\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-control\" OR $message.data_columns_path == \"/usr/bin/runc\" OR $message.data_columns_path == \"/usr/libexec/docker/docker-init\")\nthen\n drop_message();\nend"
2117 }
2118 },
2119 "constraints": [
2120 {
2121 "type": "server-version",
2122 "version": ">=5.0.13+083613e"
2123 }
2124 ]
2125 },
2126 {
2127 "v": "1",
2128 "type": {
2129 "name": "pipeline_rule",
2130 "version": "1"
2131 },
2132 "id": "04371a3b-aaaf-4440-8cb4-4f53d0a74508",
2133 "data": {
2134 "title": {
2135 "@type": "string",
2136 "@value": "MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION"
2137 },
2138 "description": {
2139 "@type": "string",
2140 "@value": "MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION"
2141 },
2142 "source": {
2143 "@type": "string",
2144 "@value": "rule \"MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"osquery\" AND $message.rule_group2 == \"process_events\"\nthen\n set_field(\"process_name\", $message.data_columns_path);\n set_field(\"process_image\", $message.data_columns_path);\n set_field(\"process_id\", $message.data_columns_pid);\n set_field(\"user_name\", $message.data_columns_username);\n set_field(\"software_vendor\", $message.data_columns_signing_id);\n set_field(\"software_product\", $message.data_columns_signing_id);\n set_field(\"process_image_hashes\", $message.data_columns_cdhash);\n set_field(\"parent_process_id\", $message.data_columns_parent);\n set_field(\"parent_process_image\", $message.data_columns_parent);\n set_field(\"parent_process_user\", $message.data_win_eventdata_parentUser);\nend"
2145 }
2146 },
2147 "constraints": [
2148 {
2149 "type": "server-version",
2150 "version": ">=5.0.13+083613e"
2151 }
2152 ]
2153 },
2154 {
2155 "v": "1",
2156 "type": {
2157 "name": "pipeline_rule",
2158 "version": "1"
2159 },
2160 "id": "d501207b-5195-4a20-be79-342b824e36fa",
2161 "data": {
2162 "title": {
2163 "@type": "string",
2164 "@value": "Linux Sysmon Timestamp - UTC"
2165 },
2166 "description": {
2167 "@type": "string",
2168 "@value": "Linux Sysmon Timestamp - UTC"
2169 },
2170 "source": {
2171 "@type": "string",
2172 "@value": "rule \"Linux Sysmon Timestamp - UTC\"\nwhen\n has_field(\"data_system_systemTime\")\nthen\n let time = parse_date(to_string($message.data_system_systemTime), \"yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSS'Z'\", \"Etc/UTC\");\n set_field(\"timestamp_utc\", time);\nend"
2173 }
2174 },
2175 "constraints": [
2176 {
2177 "type": "server-version",
2178 "version": ">=5.0.13+083613e"
2179 }
2180 ]
2181 },
2182 {
2183 "v": "1",
2184 "type": {
2185 "name": "pipeline_rule",
2186 "version": "1"
2187 },
2188 "id": "ba83edb5-a196-42b8-9367-04d44e9c2402",
2189 "data": {
2190 "title": {
2191 "@type": "string",
2192 "@value": "LINUX SYSMON EVENT 3 LOG NORMALIZATION"
2193 },
2194 "description": {
2195 "@type": "string",
2196 "@value": "LINUX SYSMON EVENT 3 LOG NORMALIZATION"
2197 },
2198 "source": {
2199 "@type": "string",
2200 "@value": "rule \"LINUX SYSMON EVENT 3 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"protocol\", $message.data_eventdata_protocol);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"dst_ip\", $message.data_eventdata_DestinationIp);\n set_field(\"dst_port\", $message.data_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_eventdata_sourcePort);\nend"
2201 }
2202 },
2203 "constraints": [
2204 {
2205 "type": "server-version",
2206 "version": ">=5.0.13+083613e"
2207 }
2208 ]
2209 },
2210 {
2211 "v": "1",
2212 "type": {
2213 "name": "pipeline_rule",
2214 "version": "1"
2215 },
2216 "id": "f19ebc4f-2a74-4e0e-844c-4b86087ff753",
2217 "data": {
2218 "title": {
2219 "@type": "string",
2220 "@value": "WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL"
2221 },
2222 "description": {
2223 "@type": "string",
2224 "@value": "WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL"
2225 },
2226 "source": {
2227 "@type": "string",
2228 "@value": "rule \"WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_22\"\nthen\n let query_name_and_ampersand = concat(to_string($message.data_win_eventdata_queryName), \"&customer_code=\");\n let new_key = concat(query_name_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2229 }
2230 },
2231 "constraints": [
2232 {
2233 "type": "server-version",
2234 "version": ">=5.0.13+083613e"
2235 }
2236 ]
2237 },
2238 {
2239 "v": "1",
2240 "type": {
2241 "name": "pipeline_rule",
2242 "version": "1"
2243 },
2244 "id": "90ec68d3-bf43-477d-8b1e-a9accf50b60e",
2245 "data": {
2246 "title": {
2247 "@type": "string",
2248 "@value": "DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES"
2249 },
2250 "description": {
2251 "@type": "string",
2252 "@value": "DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES"
2253 },
2254 "source": {
2255 "@type": "string",
2256 "@value": "rule \"DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES\"\nwhen\n$message.rule_group2 == \"bpf_socket_events\" AND ($message.data_columns_path == \"/var/ossec/bin/wazuh-syscheckd\" OR $message.data_columns_path == \"/usr/bin/telegraf\" OR $message.data_columns_path == \"/usr/sbin/haproxy\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-control\" OR $message.data_columns_path == \"/opt/fluent-bit/bin/fluent-bit\" OR $message.data_columns_path == \"/var/ossec/framework/python/bin/python3.9\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-remoted\" OR $message.data_columns_path == \"/usr/share/filebeat/bin/filebeat\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-modulesd\" OR $message.data_columns_path == \"/worker\" OR $message.data_columns_path == \"/usr/bin/python3.9\" OR $message.data_columns_path == \"/usr/local/bin/python3.10\" OR $message.data_columns_path == \"/usr/local/sbin/haproxy\" OR $message.data_columns_path == \"/usr/bin/systemctl\" OR $message.data_columns_path == \"/usr/local/bin/python3.9\" OR $message.data_columns_path == \"/app/webapp\" OR $message.data_columns_path == \"/usr/share/graylog-server/jvm/bin/java\" OR $message.data_columns_path == \"/usr/share/grafana/bin/grafana\" OR $message.data_columns_path == \"/usr/bin/dockerd\" OR $message.data_columns_path == \"/usr/local/bin/velociraptor.bin\")\nthen\n drop_message();\nend"
2257 }
2258 },
2259 "constraints": [
2260 {
2261 "type": "server-version",
2262 "version": ">=5.0.13+083613e"
2263 }
2264 ]
2265 },
2266 {
2267 "v": "1",
2268 "type": {
2269 "name": "pipeline_rule",
2270 "version": "1"
2271 },
2272 "id": "7a45ad2d-e6f1-4d2b-8f9f-1f8b44a73f0b",
2273 "data": {
2274 "title": {
2275 "@type": "string",
2276 "@value": "WINDOWS SYSMON EVENT 23 LOG NORMALIZATION"
2277 },
2278 "description": {
2279 "@type": "string",
2280 "@value": "WINDOWS SYSMON EVENT 23 LOG NORMALIZATION"
2281 },
2282 "source": {
2283 "@type": "string",
2284 "@value": "rule \"WINDOWS SYSMON EVENT 23 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_23\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\n set_field(\"is_executable\", $message.data_win_eventdata_isExecutable);\n set_field(\"file_hashes\", $message.data_win_eventdata_hashes);\nend"
2285 }
2286 },
2287 "constraints": [
2288 {
2289 "type": "server-version",
2290 "version": ">=5.0.13+083613e"
2291 }
2292 ]
2293 },
2294 {
2295 "v": "1",
2296 "type": {
2297 "name": "pipeline_rule",
2298 "version": "1"
2299 },
2300 "id": "b807c042-0124-4a55-a92c-230c13fc1ca9",
2301 "data": {
2302 "title": {
2303 "@type": "string",
2304 "@value": "WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS"
2305 },
2306 "description": {
2307 "@type": "string",
2308 "@value": "WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS"
2309 },
2310 "source": {
2311 "@type": "string",
2312 "@value": "rule \"WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND has_field(\"data_win_eventdata_company\")\nthen\n let ldata = lookup_value(\n lookup_table: \"software-vendors\",\n key: to_string($message.data_win_eventdata_company,\"no\")\n );\n set_field(\"software_approved\", ldata);\nend"
2313 }
2314 },
2315 "constraints": [
2316 {
2317 "type": "server-version",
2318 "version": ">=5.0.13+083613e"
2319 }
2320 ]
2321 },
2322 {
2323 "v": "1",
2324 "type": {
2325 "name": "pipeline_rule",
2326 "version": "1"
2327 },
2328 "id": "b3d62cc1-de49-4e29-a39a-88d19ac6da02",
2329 "data": {
2330 "title": {
2331 "@type": "string",
2332 "@value": "WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL"
2333 },
2334 "description": {
2335 "@type": "string",
2336 "@value": "WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL"
2337 },
2338 "source": {
2339 "@type": "string",
2340 "@value": "rule \"WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND $message.data_win_eventdata_signed == \"false\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2341 }
2342 },
2343 "constraints": [
2344 {
2345 "type": "server-version",
2346 "version": ">=5.0.13+083613e"
2347 }
2348 ]
2349 },
2350 {
2351 "v": "1",
2352 "type": {
2353 "name": "pipeline_rule",
2354 "version": "1"
2355 },
2356 "id": "f709c6a9-8e24-4a37-a86d-3507ffb67010",
2357 "data": {
2358 "title": {
2359 "@type": "string",
2360 "@value": "DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE"
2361 },
2362 "description": {
2363 "@type": "string",
2364 "@value": "DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE"
2365 },
2366 "source": {
2367 "@type": "string",
2368 "@value": "rule \"DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event_13\" AND ($message.data_win_eventdata_image == \"C:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\windows\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\Google\\\\\\\\Chrome\\\\\\\\Application\\\\\\\\chrome.exe\")\nthen\n drop_message();\nend"
2369 }
2370 },
2371 "constraints": [
2372 {
2373 "type": "server-version",
2374 "version": ">=5.0.13+083613e"
2375 }
2376 ]
2377 },
2378 {
2379 "v": "1",
2380 "type": {
2381 "name": "pipeline_rule",
2382 "version": "1"
2383 },
2384 "id": "dbad257a-932d-48e5-8a70-ac3313857a9c",
2385 "data": {
2386 "title": {
2387 "@type": "string",
2388 "@value": "LINUX SYSMON EVENT 23 LOG NORMALIZATION"
2389 },
2390 "description": {
2391 "@type": "string",
2392 "@value": "LINUX SYSMON EVENT 23 LOG NORMALIZATION"
2393 },
2394 "source": {
2395 "@type": "string",
2396 "@value": "rule \"LINUX SYSMON EVENT 23 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event_23\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"target_file\", $message.data_eventdata_targetFilename);\n set_field(\"is_executable\", $message.data_eventdata_isExecutable);\n set_field(\"file_hashes\", $message.data_eventdata_hashes);\nend"
2397 }
2398 },
2399 "constraints": [
2400 {
2401 "type": "server-version",
2402 "version": ">=5.0.13+083613e"
2403 }
2404 ]
2405 },
2406 {
2407 "v": "1",
2408 "type": {
2409 "name": "pipeline_rule",
2410 "version": "1"
2411 },
2412 "id": "31918fde-a64c-4ad6-b3c2-5a4407236ee4",
2413 "data": {
2414 "title": {
2415 "@type": "string",
2416 "@value": "LINUX OSQUERY PROCESS LIST LOG NORMALIZATION"
2417 },
2418 "description": {
2419 "@type": "string",
2420 "@value": "LINUX OSQUERY PROCESS LIST LOG NORMALIZATION"
2421 },
2422 "source": {
2423 "@type": "string",
2424 "@value": "rule \"LINUX OSQUERY PROCESS LIST LOG NORMALIZATION\"\nwhen\n$message.rule_group1 == \"osquery\" AND $message.rule_group2 == \"list_processes\"\nthen\n set_field(\"process_name\", $message.data_osquery_columns_name);\n set_field(\"process_image\", $message.data_osquery_columns_path);\n set_field(\"process_id\", $message.data_osquery_columns_pid);\n set_field(\"process_cmd_line\", $message.data_osquery_columns_cmdline);\n set_field(\"user_name\", $message.data_osquery_columns_username);\n set_field(\"parent_process_id\", $message.data_osquery_columns_parent);\nend"
2425 }
2426 },
2427 "constraints": [
2428 {
2429 "type": "server-version",
2430 "version": ">=5.0.13+083613e"
2431 }
2432 ]
2433 },
2434 {
2435 "v": "1",
2436 "type": {
2437 "name": "pipeline_rule",
2438 "version": "1"
2439 },
2440 "id": "2596c531-6959-4955-bfef-b32c5ce296fd",
2441 "data": {
2442 "title": {
2443 "@type": "string",
2444 "@value": "WINDOWS SYSMON EVENT 3 LOG NORMALIZATION"
2445 },
2446 "description": {
2447 "@type": "string",
2448 "@value": "WINDOWS SYSMON EVENT 3 LOG NORMALIZATION"
2449 },
2450 "source": {
2451 "@type": "string",
2452 "@value": "rule \"WINDOWS SYSMON EVENT 3 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"protocol\", $message.data_win_eventdata_protocol);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"dst_ip\", $message.data_win_eventdata_destinationIp);\n set_field(\"dst_port\", $message.data_win_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_win_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_win_eventdata_sourcePort);\nend"
2453 }
2454 },
2455 "constraints": [
2456 {
2457 "type": "server-version",
2458 "version": ">=5.0.13+083613e"
2459 }
2460 ]
2461 },
2462 {
2463 "v": "1",
2464 "type": {
2465 "name": "pipeline_rule",
2466 "version": "1"
2467 },
2468 "id": "3a47b63b-504a-4884-aac3-7c782988fa52",
2469 "data": {
2470 "title": {
2471 "@type": "string",
2472 "@value": "LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2473 },
2474 "description": {
2475 "@type": "string",
2476 "@value": "LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2477 },
2478 "source": {
2479 "@type": "string",
2480 "@value": "rule \"LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_eventdata_initiated == \"false\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"protocol\", $message.data_eventdata_protocol);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"dst_ip\", $message.data_eventdata_DestinationIp);\n set_field(\"dst_port\", $message.data_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"ingress\"); \nend"
2481 }
2482 },
2483 "constraints": [
2484 {
2485 "type": "server-version",
2486 "version": ">=5.0.13+083613e"
2487 }
2488 ]
2489 },
2490 {
2491 "v": "1",
2492 "type": {
2493 "name": "pipeline_rule",
2494 "version": "1"
2495 },
2496 "id": "731ca120-24f1-4d56-ab8c-6706d4592ac8",
2497 "data": {
2498 "title": {
2499 "@type": "string",
2500 "@value": "PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL"
2501 },
2502 "description": {
2503 "@type": "string",
2504 "@value": "PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL"
2505 },
2506 "source": {
2507 "@type": "string",
2508 "@value": "rule \"PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"tls\" OR $message.rule_group3 == \"http\"\nthen\n let ip_and_ampersand = concat(to_string($message.data_destination_ip), \"&customer_code=\");\n let new_key = concat(ip_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2509 }
2510 },
2511 "constraints": [
2512 {
2513 "type": "server-version",
2514 "version": ">=5.0.13+083613e"
2515 }
2516 ]
2517 },
2518 {
2519 "v": "1",
2520 "type": {
2521 "name": "pipeline_rule",
2522 "version": "1"
2523 },
2524 "id": "794068e2-fc89-41e8-a390-5f947695ba28",
2525 "data": {
2526 "title": {
2527 "@type": "string",
2528 "@value": "WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS"
2529 },
2530 "description": {
2531 "@type": "string",
2532 "@value": "WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS"
2533 },
2534 "source": {
2535 "@type": "string",
2536 "@value": "rule \"WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND ! has_field(\"software_approved\")\nthen\nset_field(\"software_approved\", \"no\");\nset_field(\"syslog_level\", \"WARNING\");\nlet build_message_0 = to_string(\" Sysmon - Event 1: Process creation Unapproved Software \");\nlet build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_company));\nset_field(\"rule_description\", build_message_1);\nend"
2537 }
2538 },
2539 "constraints": [
2540 {
2541 "type": "server-version",
2542 "version": ">=5.0.13+083613e"
2543 }
2544 ]
2545 },
2546 {
2547 "v": "1",
2548 "type": {
2549 "name": "pipeline_rule",
2550 "version": "1"
2551 },
2552 "id": "b4de7d44-01b1-4ec6-b4e4-92e991dcf6be",
2553 "data": {
2554 "title": {
2555 "@type": "string",
2556 "@value": "WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2557 },
2558 "description": {
2559 "@type": "string",
2560 "@value": "WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2561 },
2562 "source": {
2563 "@type": "string",
2564 "@value": "rule \"WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_win_eventdata_initiated == \"false\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"protocol\", $message.data_win_eventdata_protocol);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"dst_ip\", $message.data_win_eventdata_destinationIp);\n set_field(\"dst_port\", $message.data_win_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_win_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_win_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"ingress\"); \nend"
2565 }
2566 },
2567 "constraints": [
2568 {
2569 "type": "server-version",
2570 "version": ">=5.0.13+083613e"
2571 }
2572 ]
2573 },
2574 {
2575 "v": "1",
2576 "type": {
2577 "name": "pipeline_rule",
2578 "version": "1"
2579 },
2580 "id": "0f3bd968-508b-4fd4-9662-953b5a34e1e9",
2581 "data": {
2582 "title": {
2583 "@type": "string",
2584 "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - WARNING"
2585 },
2586 "description": {
2587 "@type": "string",
2588 "@value": "CREATE FIELD SYSLOG LEVEL - WARNING"
2589 },
2590 "source": {
2591 "@type": "string",
2592 "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nwhen to_long($message.rule_level) > 7 AND to_long($message.rule_level) < 12\nthen\nset_field(\"syslog_level\", \"WARNING\");\nend"
2593 }
2594 },
2595 "constraints": [
2596 {
2597 "type": "server-version",
2598 "version": ">=5.0.13+083613e"
2599 }
2600 ]
2601 },
2602 {
2603 "v": "1",
2604 "type": {
2605 "name": "pipeline_rule",
2606 "version": "1"
2607 },
2608 "id": "f663f3fd-955e-4b78-85f4-93571a64c252",
2609 "data": {
2610 "title": {
2611 "@type": "string",
2612 "@value": "WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2613 },
2614 "description": {
2615 "@type": "string",
2616 "@value": "WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2617 },
2618 "source": {
2619 "@type": "string",
2620 "@value": "rule \"WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_win_eventdata_initiated == \"true\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"protocol\", $message.data_win_eventdata_protocol);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"dst_ip\", $message.data_win_eventdata_destinationIp);\n set_field(\"dst_port\", $message.data_win_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_win_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_win_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"external\"); \nend"
2621 }
2622 },
2623 "constraints": [
2624 {
2625 "type": "server-version",
2626 "version": ">=5.0.13+083613e"
2627 }
2628 ]
2629 },
2630 {
2631 "v": "1",
2632 "type": {
2633 "name": "pipeline_rule",
2634 "version": "1"
2635 },
2636 "id": "694f2402-bb3e-4d24-b892-bcbcc73fecfb",
2637 "data": {
2638 "title": {
2639 "@type": "string",
2640 "@value": "LINUX SYSMON EVENT 11 LOG NORMALIZATION"
2641 },
2642 "description": {
2643 "@type": "string",
2644 "@value": "LINUX SYSMON EVENT 11 LOG NORMALIZATION"
2645 },
2646 "source": {
2647 "@type": "string",
2648 "@value": "rule \"LINUX SYSMON EVENT 11 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event_11\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"target_file\", $message.data_eventdata_targetFilename);\nend"
2649 }
2650 },
2651 "constraints": [
2652 {
2653 "type": "server-version",
2654 "version": ">=5.0.13+083613e"
2655 }
2656 ]
2657 },
2658 {
2659 "v": "1",
2660 "type": {
2661 "name": "pipeline_rule",
2662 "version": "1"
2663 },
2664 "id": "bf6d21ee-ab54-465f-a786-44ac833d3416",
2665 "data": {
2666 "title": {
2667 "@type": "string",
2668 "@value": "WINDOWS PROCESS ID - SIGMA - data_event_ProcessId"
2669 },
2670 "description": {
2671 "@type": "string",
2672 "@value": "WINDOWS PROCESS ID - SIGMA - data_event_ProcessId"
2673 },
2674 "source": {
2675 "@type": "string",
2676 "@value": "rule \"WINDOWS PROCESS ID - SIGMA - data_event_ProcessId\"\nwhen\n has_field(\"data_event_ProcessId\") AND $message.rule_group1 == \"windows\" AND $message.rule_group2 == \"chainsaw\"\nthen\n set_field(\"process_id\", $message.data_event_ProcessId);\nend"
2677 }
2678 },
2679 "constraints": [
2680 {
2681 "type": "server-version",
2682 "version": ">=5.0.13+083613e"
2683 }
2684 ]
2685 },
2686 {
2687 "v": "1",
2688 "type": {
2689 "name": "pipeline_rule",
2690 "version": "1"
2691 },
2692 "id": "76aec17e-8048-46ce-9bd3-6dad333b66e5",
2693 "data": {
2694 "title": {
2695 "@type": "string",
2696 "@value": "WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId"
2697 },
2698 "description": {
2699 "@type": "string",
2700 "@value": "WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId"
2701 },
2702 "source": {
2703 "@type": "string",
2704 "@value": "rule \"WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId\"\nwhen\n has_field(\"data_event_SourceProcessId\") AND $message.rule_group1 == \"windows\" AND $message.rule_group2 == \"chainsaw\"\nthen\n set_field(\"process_id\", $message.data_event_SourceProcessId);\nend"
2705 }
2706 },
2707 "constraints": [
2708 {
2709 "type": "server-version",
2710 "version": ">=5.0.13+083613e"
2711 }
2712 ]
2713 },
2714 {
2715 "v": "1",
2716 "type": {
2717 "name": "pipeline_rule",
2718 "version": "1"
2719 },
2720 "id": "96a20a8a-1da1-48d4-81f0-0ef51a2c9e8e",
2721 "data": {
2722 "title": {
2723 "@type": "string",
2724 "@value": "WINDOWS SYSMON EVENT 13 LOG NORMALIZATION"
2725 },
2726 "description": {
2727 "@type": "string",
2728 "@value": "WINDOWS SYSMON EVENT 13 LOG NORMALIZATION"
2729 },
2730 "source": {
2731 "@type": "string",
2732 "@value": "rule \"WINDOWS SYSMON EVENT 13 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_13\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"target_object\", $message.data_win_eventdata_targetObject);\n set_field(\"event_type\", $message.data_win_eventdata_eventType);\nend"
2733 }
2734 },
2735 "constraints": [
2736 {
2737 "type": "server-version",
2738 "version": ">=5.0.13+083613e"
2739 }
2740 ]
2741 },
2742 {
2743 "v": "1",
2744 "type": {
2745 "name": "pipeline_rule",
2746 "version": "1"
2747 },
2748 "id": "a47cbbda-bf0f-4b22-85c2-4ca03472c8dc",
2749 "data": {
2750 "title": {
2751 "@type": "string",
2752 "@value": "WINDOWS SYSMON EVENT 11 LOG NORMALIZATION"
2753 },
2754 "description": {
2755 "@type": "string",
2756 "@value": "WINDOWS SYSMON EVENT 11 LOG NORMALIZATION"
2757 },
2758 "source": {
2759 "@type": "string",
2760 "@value": "rule \"WINDOWS SYSMON EVENT 11 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_11\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\nend"
2761 }
2762 },
2763 "constraints": [
2764 {
2765 "type": "server-version",
2766 "version": ">=5.0.13+083613e"
2767 }
2768 ]
2769 },
2770 {
2771 "v": "1",
2772 "type": {
2773 "name": "pipeline_rule",
2774 "version": "1"
2775 },
2776 "id": "cae472b1-4e92-43d1-9433-4f29eca82916",
2777 "data": {
2778 "title": {
2779 "@type": "string",
2780 "@value": "LINUX PACKETBEAT NETWORK LOG NORMALIZATION"
2781 },
2782 "description": {
2783 "@type": "string",
2784 "@value": "LINUX PACKETBEAT NETWORK LOG NORMALIZATION"
2785 },
2786 "source": {
2787 "@type": "string",
2788 "@value": "rule \"LINUX PACKETBEAT NETWORK LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group2 == \"packetbeat\"\nthen\n set_field(\"protocol\", $message.data_network_transport);\n set_field(\"dst_ip\", $message.data_destination_ip);\n set_field(\"dst_port\", $message.data_destination_port);\n set_field(\"src_ip\", $message.data_source_ip);\n set_field(\"src_port\", $message.data_source_port);\n set_field(\"traffic_direction\", $message.data_network_direction); \n remove_field(\"$message.data_@metadata_beat\");\n remove_field(\"$message.data_@metadata_type\");\n remove_field(\"$message.data_@metadata_version\");\n remove_field(\"$message.data_agent_ephemeral_id\");\n remove_field(\"$message.data_host_architecture\");\n remove_field(\"$message.data_host_containerized\");\n remove_field(\"$message.data_host_hostname\");\n remove_field(\"$message.data_host_id\");\n remove_field(\"$message.data_host_ip\");\n remove_field(\"$message.data_host_mac\");\n remove_field(\"$message.data_host_name\");\n remove_field(\"$message.data_host_os_codename\");\n remove_field(\"$message.data_host_os_family\");\n remove_field(\"$message.data_host_os_kernel\");\n remove_field(\"$message.data_host_os_name\");\n remove_field(\"$message.data_host_os_platform\");\n remove_field(\"$message.data_host_os_type\");\n remove_field(\"$message.data_host_os_version\");\nend"
2789 }
2790 },
2791 "constraints": [
2792 {
2793 "type": "server-version",
2794 "version": ">=5.0.13+083613e"
2795 }
2796 ]
2797 },
2798 {
2799 "v": "1",
2800 "type": {
2801 "name": "pipeline_rule",
2802 "version": "1"
2803 },
2804 "id": "b709bcd4-70e1-4bf0-9a9c-c09ed9b5b09e",
2805 "data": {
2806 "title": {
2807 "@type": "string",
2808 "@value": "WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS"
2809 },
2810 "description": {
2811 "@type": "string",
2812 "@value": ""
2813 },
2814 "source": {
2815 "@type": "string",
2816 "@value": "rule \"WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND ! has_field(\"software_approved\")\nthen\nset_field(\"software_approved\", \"no\");\nlet build_message_0 = to_string(\" Sysmon - Event 7: Image Loaded by Unapproved Software \");\nlet build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_company));\nset_field(\"rule_description\", build_message_1);\nset_field(\"syslog_level\", \"WARNING\");\nend"
2817 }
2818 },
2819 "constraints": [
2820 {
2821 "type": "server-version",
2822 "version": ">=5.0.13+083613e"
2823 }
2824 ]
2825 },
2826 {
2827 "v": "1",
2828 "type": {
2829 "name": "pipeline_rule",
2830 "version": "1"
2831 },
2832 "id": "891d4cde-6e67-4b9d-98a7-52e9e73c5f4d",
2833 "data": {
2834 "title": {
2835 "@type": "string",
2836 "@value": "WINDOWS SYSMON EVENT 9 LOG NORMALIZATION"
2837 },
2838 "description": {
2839 "@type": "string",
2840 "@value": "WINDOWS SYSMON EVENT 9 LOG NORMALIZATION"
2841 },
2842 "source": {
2843 "@type": "string",
2844 "@value": "rule \"WINDOWS SYSMON EVENT 9 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event9\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"device\", $message.data_win_eventdata_device);\nend"
2845 }
2846 },
2847 "constraints": [
2848 {
2849 "type": "server-version",
2850 "version": ">=5.0.13+083613e"
2851 }
2852 ]
2853 },
2854 {
2855 "v": "1",
2856 "type": {
2857 "name": "pipeline_rule",
2858 "version": "1"
2859 },
2860 "id": "286ba66f-f2c2-49c3-a1c4-e7360db4fb11",
2861 "data": {
2862 "title": {
2863 "@type": "string",
2864 "@value": "EPSS CVE Criticality - NMAP"
2865 },
2866 "description": {
2867 "@type": "string",
2868 "@value": "EPSS CVE Criticality - NMAP"
2869 },
2870 "source": {
2871 "@type": "string",
2872 "@value": "rule \"EPSS CVE Criticality - NMAP\"\nwhen\n $message.rule_group3 == \"network_scan\"\nthen\n let ldata = lookup(\n lookup_table: \"epss\",\n key: to_string($message.data_nmap_port_cve_id)\n );\n set_fields(\n fields: ldata,\n prefix: \"epss_\"\n );\nend"
2873 }
2874 },
2875 "constraints": [
2876 {
2877 "type": "server-version",
2878 "version": ">=5.0.13+083613e"
2879 }
2880 ]
2881 },
2882 {
2883 "v": "1",
2884 "type": {
2885 "name": "pipeline_rule",
2886 "version": "1"
2887 },
2888 "id": "c18f97ef-48f9-47b8-ac56-9c7d870bbe6a",
2889 "data": {
2890 "title": {
2891 "@type": "string",
2892 "@value": "LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2893 },
2894 "description": {
2895 "@type": "string",
2896 "@value": "LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2897 },
2898 "source": {
2899 "@type": "string",
2900 "@value": "rule \"LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_eventdata_initiated == \"true\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"protocol\", $message.data_eventdata_protocol);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"dst_ip\", $message.data_eventdata_DestinationIp);\n set_field(\"dst_port\", $message.data_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"external\"); \nend"
2901 }
2902 },
2903 "constraints": [
2904 {
2905 "type": "server-version",
2906 "version": ">=5.0.13+083613e"
2907 }
2908 ]
2909 },
2910 {
2911 "v": "1",
2912 "type": {
2913 "name": "pipeline_rule",
2914 "version": "1"
2915 },
2916 "id": "9544ca5f-1bd5-4c23-afab-ea30aa39e4c3",
2917 "data": {
2918 "title": {
2919 "@type": "string",
2920 "@value": "WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS"
2921 },
2922 "description": {
2923 "@type": "string",
2924 "@value": "WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS"
2925 },
2926 "source": {
2927 "@type": "string",
2928 "@value": "rule \"WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND has_field(\"data_win_eventdata_company\")\nthen\n let ldata = lookup_value(\n lookup_table: \"software-vendors\",\n key: to_string($message.data_win_eventdata_company)\n );\n set_field(\"software_approved\", ldata);\n let build_message_0 = to_string(\" Sysmon - Event 1: Process creation \");\n let build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_description));\n set_field(\"second_rule_description\", build_message_1);\nend"
2929 }
2930 },
2931 "constraints": [
2932 {
2933 "type": "server-version",
2934 "version": ">=5.0.13+083613e"
2935 }
2936 ]
2937 },
2938 {
2939 "v": "1",
2940 "type": {
2941 "name": "pipeline_rule",
2942 "version": "1"
2943 },
2944 "id": "917d7a35-5a98-4e8e-9b3a-daacc76e3d31",
2945 "data": {
2946 "title": {
2947 "@type": "string",
2948 "@value": "WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
2949 },
2950 "description": {
2951 "@type": "string",
2952 "@value": "WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
2953 },
2954 "source": {
2955 "@type": "string",
2956 "@value": "rule \"WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_win_eventdata_destinationIp != \"127.0.0.1\" AND $message.data_win_eventdata_destinationIp != \"255.255.255.255\" AND $message.data_win_eventdata_destinationIp != \"0.0.0.0\" AND $message.data_win_eventdata_destinationIsIpv6 == \"false\" AND !in_private_net(to_string($message.data_win_eventdata_destinationIp))\nthen\n let ip_and_ampersand = concat(to_string($message.data_win_eventdata_destinationIp), \"&customer_code=\");\n let new_key = concat(ip_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2957 }
2958 },
2959 "constraints": [
2960 {
2961 "type": "server-version",
2962 "version": ">=5.0.13+083613e"
2963 }
2964 ]
2965 },
2966 {
2967 "v": "1",
2968 "type": {
2969 "name": "pipeline_rule",
2970 "version": "1"
2971 },
2972 "id": "81cfe56d-b154-4be5-a7db-c062a863915c",
2973 "data": {
2974 "title": {
2975 "@type": "string",
2976 "@value": "WINDOWS SYSMON EVENT 10 LOG NORMALIZATION"
2977 },
2978 "description": {
2979 "@type": "string",
2980 "@value": "WINDOWS SYSMON EVENT 10 LOG NORMALIZATION"
2981 },
2982 "source": {
2983 "@type": "string",
2984 "@value": "rule \"WINDOWS SYSMON EVENT 10 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_10\"\nthen\n set_field(\"target_image\", $message.data_win_eventdata_targetImage);\n set_field(\"granted_access\", $message.data_win_eventdata_grantedAccess);\n set_field(\"source_image\", $message.data_win_eventdata_sourceImage);\n set_field(\"call_trace\", $message.data_win_eventdata_callTrace);\nend"
2985 }
2986 },
2987 "constraints": [
2988 {
2989 "type": "server-version",
2990 "version": ">=5.0.13+083613e"
2991 }
2992 ]
2993 },
2994 {
2995 "v": "1",
2996 "type": {
2997 "name": "pipeline_rule",
2998 "version": "1"
2999 },
3000 "id": "6f33986b-32cf-4c5c-bc9a-8e5626e29cce",
3001 "data": {
3002 "title": {
3003 "@type": "string",
3004 "@value": "WINDOWS SYSMON EVENT 1 LOG NORMALIZATION"
3005 },
3006 "description": {
3007 "@type": "string",
3008 "@value": "WINDOWS SYSMON EVENT 1 LOG NORMALIZATION"
3009 },
3010 "source": {
3011 "@type": "string",
3012 "@value": "rule \"WINDOWS SYSMON EVENT 1 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\"\nthen\n set_field(\"process_name\", $message.data_win_eventdata_originalFileName);\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"process_cmd_line\", $message.data_win_eventdata_commandLine);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"software_vendor\", $message.data_win_eventdata_company);\n set_field(\"process_image_hashes\", $message.data_win_eventdata_hashes);\n set_field(\"software_product\", $message.data_win_eventdata_product);\n set_field(\"parent_process_image\", $message.data_win_eventdata_parentImage);\n set_field(\"parent_cmd_line\", $message.data_win_eventdata_parentCommandLine);\n set_field(\"parent_process_id\", $message.data_win_eventdata_parentProcessId);\n set_field(\"parent_process_user\", $message.data_win_eventdata_parentUser);\nend"
3013 }
3014 },
3015 "constraints": [
3016 {
3017 "type": "server-version",
3018 "version": ">=5.0.13+083613e"
3019 }
3020 ]
3021 },
3022 {
3023 "v": "1",
3024 "type": {
3025 "name": "pipeline_rule",
3026 "version": "1"
3027 },
3028 "id": "f70e4aea-2343-45d1-8b19-224c5bdb8632",
3029 "data": {
3030 "title": {
3031 "@type": "string",
3032 "@value": "Packetbeat Timestamp - UTC"
3033 },
3034 "description": {
3035 "@type": "string",
3036 "@value": "Packetbeat Timestamp - UTC"
3037 },
3038 "source": {
3039 "@type": "string",
3040 "@value": "rule \"Packetbeat Timestamp - UTC\"\nwhen\n has_field(\"data_event_start\")\nthen\n let time = parse_date(to_string($message.data_event_start), \"yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSS'Z'\", \"Etc/UTC\");\n set_field(\"timestamp_utc\", time);\nend"
3041 }
3042 },
3043 "constraints": [
3044 {
3045 "type": "server-version",
3046 "version": ">=5.0.13+083613e"
3047 }
3048 ]
3049 },
3050 {
3051 "v": "1",
3052 "type": {
3053 "name": "pipeline_rule",
3054 "version": "1"
3055 },
3056 "id": "4cf85cca-5ab5-4b1a-a503-e4f2d1d75bd6",
3057 "data": {
3058 "title": {
3059 "@type": "string",
3060 "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"
3061 },
3062 "description": {
3063 "@type": "string",
3064 "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"
3065 },
3066 "source": {
3067 "@type": "string",
3068 "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nwhen to_long($message.rule_level) > 3 AND to_long($message.rule_level) < 8\nthen\nset_field(\"syslog_level\", \"NOTICE\");\nend"
3069 }
3070 },
3071 "constraints": [
3072 {
3073 "type": "server-version",
3074 "version": ">=5.0.13+083613e"
3075 }
3076 ]
3077 },
3078 {
3079 "v": "1",
3080 "type": {
3081 "name": "pipeline_rule",
3082 "version": "1"
3083 },
3084 "id": "50303dca-8cc3-4367-9974-6fa0091d73a7",
3085 "data": {
3086 "title": {
3087 "@type": "string",
3088 "@value": "LINUX SYSMON EVENT 1 LOG NORMALIZATION"
3089 },
3090 "description": {
3091 "@type": "string",
3092 "@value": "LINUX SYSMON EVENT 1 LOG NORMALIZATION"
3093 },
3094 "source": {
3095 "@type": "string",
3096 "@value": "rule \"LINUX SYSMON EVENT 1 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event1\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"process_cmd_line\", $message.data_eventdata_commandLine);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"parent_process_image\", $message.data_eventdata_parentImage);\n set_field(\"parent_cmd_line\", $message.data_eventdata_parentCommandLine);\n set_field(\"parent_process_id\", $message.data_eventdata_parentProcessId);\n set_field(\"parent_process_user\", $message.data_eventdata_parentUser);\nend"
3097 }
3098 },
3099 "constraints": [
3100 {
3101 "type": "server-version",
3102 "version": ">=5.0.13+083613e"
3103 }
3104 ]
3105 },
3106 {
3107 "v": "1",
3108 "type": {
3109 "name": "pipeline_rule",
3110 "version": "1"
3111 },
3112 "id": "bfe85101-5ed8-442d-a0c2-3b3c6d3f1cd6",
3113 "data": {
3114 "title": {
3115 "@type": "string",
3116 "@value": "WINDOWS SYSMON EVENT 7 LOG NORMALIZATION"
3117 },
3118 "description": {
3119 "@type": "string",
3120 "@value": "WINDOWS SYSMON EVENT 7 LOG NORMALIZATION"
3121 },
3122 "source": {
3123 "@type": "string",
3124 "@value": "rule \"WINDOWS SYSMON EVENT 7 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\"\nthen\n set_field(\"dll_name\", $message.data_win_eventdata_originalFileName);\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"software_vendor\", $message.data_win_eventdata_company);\n set_field(\"image_loaded\", $message.data_win_eventdata_imageLoaded);\n set_field(\"dll_signature\", $message.data_win_eventdata_signature);\n set_field(\"dll_signed\", $message.data_win_eventdata_signed);\n set_field(\"dll_signature_status\", $message.data_win_eventdata_signatureStatus);\n set_field(\"dll_hashes\", $message.data_win_eventdata_hashes);\nend"
3125 }
3126 },
3127 "constraints": [
3128 {
3129 "type": "server-version",
3130 "version": ">=5.0.13+083613e"
3131 }
3132 ]
3133 },
3134 {
3135 "v": "1",
3136 "type": {
3137 "name": "pipeline_rule",
3138 "version": "1"
3139 },
3140 "id": "66d12fb9-3e88-4060-b17f-512ac5dac6a7",
3141 "data": {
3142 "title": {
3143 "@type": "string",
3144 "@value": "WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL"
3145 },
3146 "description": {
3147 "@type": "string",
3148 "@value": "WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL"
3149 },
3150 "source": {
3151 "@type": "string",
3152 "@value": "rule \"WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event6\" AND $message.data_win_eventdata_signed == \"false\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
3153 }
3154 },
3155 "constraints": [
3156 {
3157 "type": "server-version",
3158 "version": ">=5.0.13+083613e"
3159 }
3160 ]
3161 },
3162 {
3163 "v": "1",
3164 "type": {
3165 "name": "pipeline_rule",
3166 "version": "1"
3167 },
3168 "id": "da125db2-5391-4fa7-8cfc-effabd40641c",
3169 "data": {
3170 "title": {
3171 "@type": "string",
3172 "@value": "LINUX OSQUERY PROCESS ID - GENERIC"
3173 },
3174 "description": {
3175 "@type": "string",
3176 "@value": "LINUX OSQUERY PROCESS ID - GENERIC"
3177 },
3178 "source": {
3179 "@type": "string",
3180 "@value": "rule \"LINUX OSQUERY PROCESS ID - GENERIC\"\nwhen\n$message.rule_group1 == \"osquery\"\nthen\n set_field(\"process_id\", $message.data_columns_pid);\nend"
3181 }
3182 },
3183 "constraints": [
3184 {
3185 "type": "server-version",
3186 "version": ">=5.0.13+083613e"
3187 }
3188 ]
3189 },
3190 {
3191 "v": "1",
3192 "type": {
3193 "name": "pipeline_rule",
3194 "version": "1"
3195 },
3196 "id": "571ffe1c-0220-4b91-bc0f-04302d1e800c",
3197 "data": {
3198 "title": {
3199 "@type": "string",
3200 "@value": "WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL"
3201 },
3202 "description": {
3203 "@type": "string",
3204 "@value": "WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL"
3205 },
3206 "source": {
3207 "@type": "string",
3208 "@value": "rule \"WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND ! has_field(\"data_win_eventdata_company\")\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
3209 }
3210 },
3211 "constraints": [
3212 {
3213 "type": "server-version",
3214 "version": ">=5.0.13+083613e"
3215 }
3216 ]
3217 },
3218 {
3219 "v": "1",
3220 "type": {
3221 "name": "pipeline_rule",
3222 "version": "1"
3223 },
3224 "id": "721afb39-b970-4636-b1e9-a3bec5b3c8da",
3225 "data": {
3226 "title": {
3227 "@type": "string",
3228 "@value": "WINDOWS SYSMON EVENT 17 LOG NORMALIZATION"
3229 },
3230 "description": {
3231 "@type": "string",
3232 "@value": "WINDOWS SYSMON EVENT 17 LOG NORMALIZATION"
3233 },
3234 "source": {
3235 "@type": "string",
3236 "@value": "rule \"WINDOWS SYSMON EVENT 17 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_17\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"pipe_name\", $message.data_win_eventdata_pipeName);\nend"
3237 }
3238 },
3239 "constraints": [
3240 {
3241 "type": "server-version",
3242 "version": ">=5.0.13+083613e"
3243 }
3244 ]
3245 },
3246 {
3247 "v": "1",
3248 "type": {
3249 "name": "pipeline_rule",
3250 "version": "1"
3251 },
3252 "id": "056eeb4e-36ff-4ebe-9a79-77adc2f7106e",
3253 "data": {
3254 "title": {
3255 "@type": "string",
3256 "@value": "WINDOWS SYSMON EVENT 5 LOG NORMALIZATION"
3257 },
3258 "description": {
3259 "@type": "string",
3260 "@value": "WINDOWS SYSMON EVENT 5 LOG NORMALIZATION"
3261 },
3262 "source": {
3263 "@type": "string",
3264 "@value": "rule \"WINDOWS SYSMON EVENT 5 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event5\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\nend"
3265 }
3266 },
3267 "constraints": [
3268 {
3269 "type": "server-version",
3270 "version": ">=5.0.13+083613e"
3271 }
3272 ]
3273 },
3274 {
3275 "v": "1",
3276 "type": {
3277 "name": "pipeline_rule",
3278 "version": "1"
3279 },
3280 "id": "0fd58b5c-991c-418a-92dd-dadc2c1df8ee",
3281 "data": {
3282 "title": {
3283 "@type": "string",
3284 "@value": "WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS"
3285 },
3286 "description": {
3287 "@type": "string",
3288 "@value": "WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS"
3289 },
3290 "source": {
3291 "@type": "string",
3292 "@value": "rule \"WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND ! has_field(\"data_win_eventdata_company\")\nthen\n let ldata = lookup_value(\n lookup_table: \"software-vendors\",\n key: to_string($message.data_win_eventdata_signature)\n );\n set_field(\"software_approved\", ldata);\n let build_message_0 = to_string(\" Sysmon - Event 7: Image Loaded With Empty Company Name - \");\n let build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_signature));\n set_field(\"rule_description\", build_message_1);\n set_field(\"syslog_level\", \"WARNING\");\nend"
3293 }
3294 },
3295 "constraints": [
3296 {
3297 "type": "server-version",
3298 "version": ">=5.0.13+083613e"
3299 }
3300 ]
3301 },
3302 {
3303 "v": "1",
3304 "type": {
3305 "name": "pipeline_rule",
3306 "version": "1"
3307 },
3308 "id": "169eaa47-8de6-4cd8-aa18-adb37ff884c0",
3309 "data": {
3310 "title": {
3311 "@type": "string",
3312 "@value": "LINUX PACKETBEAT DNS LOG NORMALIZATION"
3313 },
3314 "description": {
3315 "@type": "string",
3316 "@value": "LINUX PACKETBEAT DNS LOG NORMALIZATION"
3317 },
3318 "source": {
3319 "@type": "string",
3320 "@value": "rule \"LINUX PACKETBEAT DNS LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"dns\"\nthen\n set_field(\"dns_query\", $message.data_dns_question_name);\n set_field(\"dns_answer\", $message.data_dns_resolved_ip);\n set_field(\"dns_response_code\", $message.data_dns_response_code);\n remove_field(\"$message.data_@metadata_beat\");\n remove_field(\"$message.data_@metadata_type\");\n remove_field(\"$message.data_@metadata_version\");\n remove_field(\"$message.data_agent_ephemeral_id\");\n remove_field(\"$message.data_host_architecture\");\n remove_field(\"$message.data_host_containerized\");\n remove_field(\"$message.data_host_hostname\");\n remove_field(\"$message.data_host_id\");\n remove_field(\"$message.data_host_ip\");\n remove_field(\"$message.data_host_mac\");\n remove_field(\"$message.data_host_name\");\n remove_field(\"$message.data_host_os_codename\");\n remove_field(\"$message.data_host_os_family\");\n remove_field(\"$message.data_host_os_kernel\");\n remove_field(\"$message.data_host_os_name\");\n remove_field(\"$message.data_host_os_platform\");\n remove_field(\"$message.data_host_os_type\");\n remove_field(\"$message.data_host_os_version\");\nend"
3321 }
3322 },
3323 "constraints": [
3324 {
3325 "type": "server-version",
3326 "version": ">=5.0.13+083613e"
3327 }
3328 ]
3329 },
3330 {
3331 "v": "1",
3332 "type": {
3333 "name": "pipeline_rule",
3334 "version": "1"
3335 },
3336 "id": "09c78369-36ac-4956-a1de-fa636aadae92",
3337 "data": {
3338 "title": {
3339 "@type": "string",
3340 "@value": "Timestamp Failsafe - UTC"
3341 },
3342 "description": {
3343 "@type": "string",
3344 "@value": "Set Timestamp based upon `msg_timestamp` field which is the time Graylog ingested the message. This is a failsafe to catch if no other field names have been detected in the log that provide the timestamp value that the host assigned with the raw alert."
3345 },
3346 "source": {
3347 "@type": "string",
3348 "@value": "rule \"Timestamp Failsafe - UTC\"\nwhen\n ! has_field(\"timestamp_utc\")\nthen\n let msg_timestamp = $message.msg_timestamp;\n set_field(\"timestamp_utc\", msg_timestamp);\n remove_field(\"msg_timestamp\");\nend"
3349 }
3350 },
3351 "constraints": [
3352 {
3353 "type": "server-version",
3354 "version": ">=5.0.13+083613e"
3355 }
3356 ]
3357 },
3358 {
3359 "v": "1",
3360 "type": {
3361 "name": "pipeline_rule",
3362 "version": "1"
3363 },
3364 "id": "64b2b33d-f5a9-4365-9233-e9901abbf4c1",
3365 "data": {
3366 "title": {
3367 "@type": "string",
3368 "@value": "OSQUERY NETWORK CONNECTION LOG NORMALIZATION"
3369 },
3370 "description": {
3371 "@type": "string",
3372 "@value": "OSQUERY NETWORK CONNECTION LOG NORMALIZATION"
3373 },
3374 "source": {
3375 "@type": "string",
3376 "@value": "rule \"OSQUERY NETWORK CONNECTION LOG NORMALIZATION\"\nwhen\n $message.data_osquery_name == \"list_network_connection\"\nthen\n set_field(\"process_image\", $message.data_osquery_columns_name);\n set_field(\"process_id\", $message.data_osquery_columns_pid);\n set_field(\"protocol\", $message.data_osquery_columns_protocol);\n set_field(\"user_name\", $message.data_osquery_columns_username);\n set_field(\"dst_ip\", $message.data_osquery_columns_remote_address);\n set_field(\"dst_port\", $message.data_osquery_columns_remote_port);\n set_field(\"src_ip\", $message.data_osquery_columns_local_address);\n set_field(\"src_port\", $message.data_osquery_columns_local_port);\nend"
3377 }
3378 },
3379 "constraints": [
3380 {
3381 "type": "server-version",
3382 "version": ">=5.0.13+083613e"
3383 }
3384 ]
3385 },
3386 {
3387 "v": "1",
3388 "type": {
3389 "name": "pipeline_rule",
3390 "version": "1"
3391 },
3392 "id": "e71eaeef-b11b-4c97-afca-7f5875cd7459",
3393 "data": {
3394 "title": {
3395 "@type": "string",
3396 "@value": "WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL"
3397 },
3398 "description": {
3399 "@type": "string",
3400 "@value": "WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL"
3401 },
3402 "source": {
3403 "@type": "string",
3404 "@value": "rule \"WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_15\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
3405 }
3406 },
3407 "constraints": [
3408 {
3409 "type": "server-version",
3410 "version": ">=5.0.13+083613e"
3411 }
3412 ]
3413 },
3414 {
3415 "v": "1",
3416 "type": {
3417 "name": "pipeline_rule",
3418 "version": "1"
3419 },
3420 "id": "af6d5827-98f8-4470-b580-05365c9562cc",
3421 "data": {
3422 "title": {
3423 "@type": "string",
3424 "@value": "WINDOWS SYSMON EVENT 12 LOG NORMALIZATION"
3425 },
3426 "description": {
3427 "@type": "string",
3428 "@value": "WINDOWS SYSMON EVENT 12 LOG NORMALIZATION"
3429 },
3430 "source": {
3431 "@type": "string",
3432 "@value": "rule \"WINDOWS SYSMON EVENT 12 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_12\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"target_object\", $message.data_win_eventdata_targetObject);\n set_field(\"event_type\", $message.data_win_eventdata_eventType);\nend"
3433 }
3434 },
3435 "constraints": [
3436 {
3437 "type": "server-version",
3438 "version": ">=5.0.13+083613e"
3439 }
3440 ]
3441 },
3442 {
3443 "v": "1",
3444 "type": {
3445 "name": "pipeline_rule",
3446 "version": "1"
3447 },
3448 "id": "be2a3538-26f8-4b0c-8df4-dea7ed241ecc",
3449 "data": {
3450 "title": {
3451 "@type": "string",
3452 "@value": "OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained"
3453 },
3454 "description": {
3455 "@type": "string",
3456 "@value": "OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained"
3457 },
3458 "source": {
3459 "@type": "string",
3460 "@value": "rule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained\"\nwhen\n // Apply the rule when the specified field is present\n has_field(\"data_system_network_item_dhcp_lease_obtained\")\nthen\n // Remove the specified field\n remove_field(\"data_system_network_item_dhcp_lease_obtained\");\nend\n"
3461 }
3462 },
3463 "constraints": [
3464 {
3465 "type": "server-version",
3466 "version": ">=5.0.13+083613e"
3467 }
3468 ]
3469 },
3470 {
3471 "v": "1",
3472 "type": {
3473 "name": "pipeline_rule",
3474 "version": "1"
3475 },
3476 "id": "ad3d829e-ca93-42dc-b49e-4cc5104a8f69",
3477 "data": {
3478 "title": {
3479 "@type": "string",
3480 "@value": "LINUX SYSMON EVENT 5 LOG NORMALIZATION"
3481 },
3482 "description": {
3483 "@type": "string",
3484 "@value": "LINUX SYSMON EVENT 5 LOG NORMALIZATION"
3485 },
3486 "source": {
3487 "@type": "string",
3488 "@value": "rule \"LINUX SYSMON EVENT 5 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event5\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\nend\n"
3489 }
3490 },
3491 "constraints": [
3492 {
3493 "type": "server-version",
3494 "version": ">=5.0.13+083613e"
3495 }
3496 ]
3497 },
3498 {
3499 "v": "1",
3500 "type": {
3501 "name": "pipeline_rule",
3502 "version": "1"
3503 },
3504 "id": "af720a8a-6293-48cf-a8a6-a5edea7b7e0b",
3505 "data": {
3506 "title": {
3507 "@type": "string",
3508 "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
3509 },
3510 "description": {
3511 "@type": "string",
3512 "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
3513 },
3514 "source": {
3515 "@type": "string",
3516 "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nwhen to_long($message.rule_level) > 0 AND to_long($message.rule_level) < 4\nthen\nset_field(\"syslog_level\", \"INFO\");\nend"
3517 }
3518 },
3519 "constraints": [
3520 {
3521 "type": "server-version",
3522 "version": ">=5.0.13+083613e"
3523 }
3524 ]
3525 },
3526 {
3527 "v": "1",
3528 "type": {
3529 "name": "pipeline_rule",
3530 "version": "1"
3531 },
3532 "id": "1ab185cc-0e73-4a98-b9aa-2cb5045fd4e3",
3533 "data": {
3534 "title": {
3535 "@type": "string",
3536 "@value": "EPSS CVE Criticality"
3537 },
3538 "description": {
3539 "@type": "string",
3540 "@value": "EPSS CVE Criticality"
3541 },
3542 "source": {
3543 "@type": "string",
3544 "@value": "rule \"EPSS CVE Criticality\"\nwhen\n $message.rule_group1 == \"vulnerability-detector\"\nthen\n let ldata = lookup(\n lookup_table: \"epss\",\n key: to_string($message.data_vulnerability_cve)\n );\n set_fields(\n fields: ldata,\n prefix: \"epss_\"\n );\nend"
3545 }
3546 },
3547 "constraints": [
3548 {
3549 "type": "server-version",
3550 "version": ">=5.0.13+083613e"
3551 }
3552 ]
3553 },
3554 {
3555 "v": "1",
3556 "type": {
3557 "name": "pipeline_rule",
3558 "version": "1"
3559 },
3560 "id": "bc32db42-cff2-4750-ad22-00d82a01924b",
3561 "data": {
3562 "title": {
3563 "@type": "string",
3564 "@value": "WINDOWS SYSMON EVENT 3 - NETWORK PORTS"
3565 },
3566 "description": {
3567 "@type": "string",
3568 "@value": "WINDOWS SYSMON EVENT 3 - NETWORK PORTS"
3569 },
3570 "source": {
3571 "@type": "string",
3572 "@value": "rule \"WINDOWS SYSMON EVENT 3 - NETWORK PORTS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND has_field(\"data_win_eventdata_destinationPort\")\nthen\n let ldata = lookup_value(\n lookup_table: \"network-ports\",\n key: to_string($message.data_win_eventdata_destinationPort)\n );\n set_field(\"port_common\", ldata);\nend"
3573 }
3574 },
3575 "constraints": [
3576 {
3577 "type": "server-version",
3578 "version": ">=5.0.13+083613e"
3579 }
3580 ]
3581 },
3582 {
3583 "v": "1",
3584 "type": {
3585 "name": "pipeline_rule",
3586 "version": "1"
3587 },
3588 "id": "76773053-f1c5-4e98-93be-69baf05f95b5",
3589 "data": {
3590 "title": {
3591 "@type": "string",
3592 "@value": "DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE"
3593 },
3594 "description": {
3595 "@type": "string",
3596 "@value": "DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE"
3597 },
3598 "source": {
3599 "@type": "string",
3600 "@value": "rule \"DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event_10\" AND $message.data_win_eventdata_sourceImage == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\AteraAgent.exe\"\nthen\n drop_message();\nend"
3601 }
3602 },
3603 "constraints": [
3604 {
3605 "type": "server-version",
3606 "version": ">=5.0.13+083613e"
3607 }
3608 ]
3609 },
3610 {
3611 "v": "1",
3612 "type": {
3613 "name": "pipeline_rule",
3614 "version": "1"
3615 },
3616 "id": "0f68d0d0-3555-4da1-8ef0-6fa3a028b8af",
3617 "data": {
3618 "title": {
3619 "@type": "string",
3620 "@value": "DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE"
3621 },
3622 "description": {
3623 "@type": "string",
3624 "@value": "DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE"
3625 },
3626 "source": {
3627 "@type": "string",
3628 "@value": "rule \"DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event7\" AND \n($message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageHeartbeat\\\\\\\\AgentPackageHeartbeat.exe\" \nOR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageSTRemote\\\\\\\\AgentPackageSTRemote.exe\" \nOR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageMonitoring\\\\\\\\AgentPackageMonitoring.exe\" \nOR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageInternalPoller\\\\\\\\AgentPackageInternalPoller.exe\")\nthen\n drop_message();\nend"
3629 }
3630 },
3631 "constraints": [
3632 {
3633 "type": "server-version",
3634 "version": ">=5.0.13+083613e"
3635 }
3636 ]
3637 },
3638 {
3639 "v": "1",
3640 "type": {
3641 "name": "pipeline_rule",
3642 "version": "1"
3643 },
3644 "id": "46b3df32-92c5-4cc7-8026-a66cc2623a52",
3645 "data": {
3646 "title": {
3647 "@type": "string",
3648 "@value": "Windows Timestamp - UTC"
3649 },
3650 "description": {
3651 "@type": "string",
3652 "@value": "Windows Timestamp - UTC"
3653 },
3654 "source": {
3655 "@type": "string",
3656 "@value": "rule \"Windows Timestamp - UTC\"\nwhen\n has_field(\"data_win_system_systemTime\")\nthen\n let time = parse_date(to_string($message.data_win_system_systemTime), \"yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSS'Z'\", \"Etc/UTC\");\n set_field(\"timestamp_utc\", time);\nend"
3657 }
3658 },
3659 "constraints": [
3660 {
3661 "type": "server-version",
3662 "version": ">=5.0.13+083613e"
3663 }
3664 ]
3665 },
3666 {
3667 "v": "1",
3668 "type": {
3669 "name": "pipeline_rule",
3670 "version": "1"
3671 },
3672 "id": "bb76d44c-45e5-4b3c-9414-a72c44370a7f",
3673 "data": {
3674 "title": {
3675 "@type": "string",
3676 "@value": "WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS"
3677 },
3678 "description": {
3679 "@type": "string",
3680 "@value": "WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS"
3681 },
3682 "source": {
3683 "@type": "string",
3684 "@value": "rule \"WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND ! has_field(\"data_win_eventdata_company\")\nthen\n set_field(\"software_approved\", \"no\");\n let build_message_0 = to_string(\" Sysmon - Event 1: Process creation With Empty Company Name - \");\n let build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_image));\n set_field(\"second_rule_description\", build_message_1);\n set_field(\"syslog_level\", \"WARNING\");\nend"
3685 }
3686 },
3687 "constraints": [
3688 {
3689 "type": "server-version",
3690 "version": ">=5.0.13+083613e"
3691 }
3692 ]
3693 },
3694 {
3695 "v": "1",
3696 "type": {
3697 "name": "pipeline_rule",
3698 "version": "1"
3699 },
3700 "id": "992c3888-0fa5-42d8-8748-6a61c2b8464b",
3701 "data": {
3702 "title": {
3703 "@type": "string",
3704 "@value": "WINDOWS PROCESS ID - Non SOCFortress Sysmon"
3705 },
3706 "description": {
3707 "@type": "string",
3708 "@value": "WINDOWS PROCESS ID - Non SOCFortress Sysmon"
3709 },
3710 "source": {
3711 "@type": "string",
3712 "@value": "rule \"WINDOWS PROCESS ID - Non SOCFortress Sysmon\"\nwhen\n $message.rule_group1 != \"windows\" AND has_field(\"data_win_eventdata_processId\")\nthen\n set_field(\"process_id\", $message.data_win_eventdata_processId);\nend"
3713 }
3714 },
3715 "constraints": [
3716 {
3717 "type": "server-version",
3718 "version": ">=5.0.13+083613e"
3719 }
3720 ]
3721 },
3722 {
3723 "v": "1",
3724 "type": {
3725 "name": "pipeline_rule",
3726 "version": "1"
3727 },
3728 "id": "4d70e0a5-2a88-43aa-b659-16933a41c5da",
3729 "data": {
3730 "title": {
3731 "@type": "string",
3732 "@value": "OpenAudit Remove field - data_system_software_item_install_date"
3733 },
3734 "description": {
3735 "@type": "string",
3736 "@value": "OpenAudit Remove field - data_system_software_item_install_date"
3737 },
3738 "source": {
3739 "@type": "string",
3740 "@value": "rule \"OpenAudit Remove field - data_system_software_item_install_date\"\nwhen\n // Apply the rule when the specified field is present\n has_field(\"data_system_software_item_install_date\")\nthen\n // Remove the specified field\n remove_field(\"data_system_software_item_install_date\");\nend\n"
3741 }
3742 },
3743 "constraints": [
3744 {
3745 "type": "server-version",
3746 "version": ">=5.0.13+083613e"
3747 }
3748 ]
3749 },
3750 {
3751 "v": "1",
3752 "type": {
3753 "name": "pipeline_rule",
3754 "version": "1"
3755 },
3756 "id": "d049995b-2c18-407a-bdd2-141c94b93568",
3757 "data": {
3758 "title": {
3759 "@type": "string",
3760 "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT"
3761 },
3762 "description": {
3763 "@type": "string",
3764 "@value": "CREATE FIELD SYSLOG LEVEL - ALERT"
3765 },
3766 "source": {
3767 "@type": "string",
3768 "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nwhen to_long($message.rule_level) > 11\nthen\nset_field(\"syslog_level\", \"ALERT\");\nend"
3769 }
3770 },
3771 "constraints": [
3772 {
3773 "type": "server-version",
3774 "version": ">=5.0.13+083613e"
3775 }
3776 ]
3777 },
3778 {
3779 "v": "1",
3780 "type": {
3781 "name": "pipeline_rule",
3782 "version": "1"
3783 },
3784 "id": "fad6eb39-5771-42ec-b95c-0b363c33bdb1",
3785 "data": {
3786 "title": {
3787 "@type": "string",
3788 "@value": "USER ADDED TO PRIVILEGE ADMIN GROUP"
3789 },
3790 "description": {
3791 "@type": "string",
3792 "@value": "USER ADDED TO PRIVILEGE ADMIN GROUP"
3793 },
3794 "source": {
3795 "@type": "string",
3796 "@value": "rule \"USER ADDED TO PRIVILEGE ADMIN GROUP\"\nwhen\n $message.data_win_system_eventID == \"4728\" OR $message.data_win_system_eventID == \"4732\" OR $message.data_win_system_eventID == \"4756\"\nthen\n let ldata = lookup_value(\n lookup_table: \"ad-admin-groups\",\n key: to_string($message.data_win_eventdata_targetUserName)\n );\n set_field(\"is_admin_group\", ldata);\nend"
3797 }
3798 },
3799 "constraints": [
3800 {
3801 "type": "server-version",
3802 "version": ">=5.0.13+083613e"
3803 }
3804 ]
3805 },
3806 {
3807 "v": "1",
3808 "type": {
3809 "name": "pipeline_rule",
3810 "version": "1"
3811 },
3812 "id": "833dcc65-5743-4525-a9a0-cb08f5358d67",
3813 "data": {
3814 "title": {
3815 "@type": "string",
3816 "@value": "OSSEC SYSCHECK ADDED EVENT NORMALIZATION"
3817 },
3818 "description": {
3819 "@type": "string",
3820 "@value": "OSSEC SYSCHECK ADDED EVENT NORMALIZATION"
3821 },
3822 "source": {
3823 "@type": "string",
3824 "@value": "rule \"OSSEC SYSCHECK ADDED EVENT NORMALIZATION\"\nwhen\n $message.rule_group1 == \"ossec\" AND $message.rule_group2 == \"syscheck\" AND $message.syscheck_event == \"added\"\nthen\n set_field(\"sha256\", $message.syscheck_sha256_after);\nend"
3825 }
3826 },
3827 "constraints": [
3828 {
3829 "type": "server-version",
3830 "version": ">=5.0.13+083613e"
3831 }
3832 ]
3833 },
3834 {
3835 "v": "1",
3836 "type": {
3837 "name": "pipeline_rule",
3838 "version": "1"
3839 },
3840 "id": "862acb0a-e994-47fe-b3b7-ea8474cf953a",
3841 "data": {
3842 "title": {
3843 "@type": "string",
3844 "@value": "WINDOWS PROCESS ID - No EventData Field"
3845 },
3846 "description": {
3847 "@type": "string",
3848 "@value": "WINDOWS PROCESS ID - No EventData Field"
3849 },
3850 "source": {
3851 "@type": "string",
3852 "@value": "rule \"WINDOWS PROCESS ID - No EventData Field\"\nwhen\n ! has_field(\"data_win_eventdata_processId\") AND $message.rule_group1 == \"windows\"\nthen\n set_field(\"process_id\", $message.data_win_system_processID);\nend"
3853 }
3854 },
3855 "constraints": [
3856 {
3857 "type": "server-version",
3858 "version": ">=5.0.13+083613e"
3859 }
3860 ]
3861 },
3862 {
3863 "v": "1",
3864 "type": {
3865 "name": "pipeline_rule",
3866 "version": "1"
3867 },
3868 "id": "f8767b41-6060-40d2-b47b-949421652dbc",
3869 "data": {
3870 "title": {
3871 "@type": "string",
3872 "@value": "LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION"
3873 },
3874 "description": {
3875 "@type": "string",
3876 "@value": "LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION"
3877 },
3878 "source": {
3879 "@type": "string",
3880 "@value": "rule \"LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION\"\nwhen\n$message.rule_group1 == \"osquery\" AND ($message.rule_group2 == \"bpf_process_events\" OR $message.rule_group2 == \"list_processes_with_hash\")\nthen\n set_field(\"process_name\", $message.data_columns_path);\n set_field(\"process_image\", $message.data_columns_path);\n set_field(\"process_id\", $message.data_columns_pid);\n set_field(\"process_cmd_line\", $message.data_columns_cmdline);\n set_field(\"parent_process_id\", $message.data_columns_parent);\nend"
3881 }
3882 },
3883 "constraints": [
3884 {
3885 "type": "server-version",
3886 "version": ">=5.0.13+083613e"
3887 }
3888 ]
3889 },
3890 {
3891 "v": "1",
3892 "type": {
3893 "name": "pipeline_rule",
3894 "version": "1"
3895 },
3896 "id": "f11d88a6-077a-4b62-9979-f78e79920c54",
3897 "data": {
3898 "title": {
3899 "@type": "string",
3900 "@value": "WINDOWS SYSMON EVENT 3 - UNCOMMON PORT"
3901 },
3902 "description": {
3903 "@type": "string",
3904 "@value": "WINDOWS SYSMON EVENT 3 - UNCOMMON PORT"
3905 },
3906 "source": {
3907 "@type": "string",
3908 "@value": "rule \"WINDOWS SYSMON EVENT 3 - UNCOMMON PORT\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND ! has_field(\"port_common\")\nthen\nset_field(\"port_common\", \"no\");\nset_field(\"syslog_level\", \"WARNING\");\nlet build_message_0 = to_string(\" Sysmon - Event 3: Network connection to Uncommon Port by \");\nlet build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_image));\nset_field(\"rule_description\", build_message_1);\nend"
3909 }
3910 },
3911 "constraints": [
3912 {
3913 "type": "server-version",
3914 "version": ">=5.0.13+083613e"
3915 }
3916 ]
3917 },
3918 {
3919 "v": "1",
3920 "type": {
3921 "name": "pipeline_rule",
3922 "version": "1"
3923 },
3924 "id": "a08b82b7-6df9-4643-9d6e-549ed2f87c6d",
3925 "data": {
3926 "title": {
3927 "@type": "string",
3928 "@value": "Office365 Timestamp - UTC"
3929 },
3930 "description": {
3931 "@type": "string",
3932 "@value": "Office365 Timestamp - UTC"
3933 },
3934 "source": {
3935 "@type": "string",
3936 "@value": "rule \"Office365 Timestamp - UTC\"\nwhen\n has_field(\"data_office_365_CreationTime\")\nthen\n let creation_time = $message.data_office_365_CreationTime;\n set_field(\"timestamp_utc\", creation_time);\nend"
3937 }
3938 },
3939 "constraints": [
3940 {
3941 "type": "server-version",
3942 "version": ">=5.0.13+083613e"
3943 }
3944 ]
3945 },
3946 {
3947 "v": "1",
3948 "type": {
3949 "name": "pipeline_rule",
3950 "version": "1"
3951 },
3952 "id": "6233a285-38ea-48ef-bb17-fc85f94a75fc",
3953 "data": {
3954 "title": {
3955 "@type": "string",
3956 "@value": "URL Encode data_name field for ASK SOCFortress API"
3957 },
3958 "description": {
3959 "@type": "string",
3960 "@value": "URL Encode `data_name` field for ASK SOCFortress API"
3961 },
3962 "source": {
3963 "@type": "string",
3964 "@value": "rule \"URL Encode data_name field for ASK SOCFortress API\"\nwhen\n has_field(\"data_name\") AND $message.rule_group2 == \"chainsaw\" AND $message.data_logsource_product == \"windows\"\nthen\n let replaced = replace(to_string($message.data_name), \" \", \"%20\");\n set_field(\"sigma_name_encoded\", replaced);\nend\n"
3965 }
3966 },
3967 "constraints": [
3968 {
3969 "type": "server-version",
3970 "version": ">=5.0.13+083613e"
3971 }
3972 ]
3973 },
3974 {
3975 "v": "1",
3976 "type": {
3977 "name": "pipeline_rule",
3978 "version": "1"
3979 },
3980 "id": "5e400ee7-a24d-4e5f-970d-9f20e01278f5",
3981 "data": {
3982 "title": {
3983 "@type": "string",
3984 "@value": "ASK SOCFORTRESS WINDOWS - CHAINSAW"
3985 },
3986 "description": {
3987 "@type": "string",
3988 "@value": "ASK SOCFORTRESS WINDOWS - CHAINSAW"
3989 },
3990 "source": {
3991 "@type": "string",
3992 "@value": "rule \"ASK SOCFORTRESS WINDOWS - CHAINSAW\"\nwhen\n has_field(\"sigma_name_encoded\")\nthen\n let ask_socfortress = to_string($message.sigma_name_encoded);\n let ldata = lookup_value(\"ask_socfortress_windows\", ask_socfortress);\n set_field(\"ask_socfortress_message\", ldata);\nend"
3993 }
3994 },
3995 "constraints": [
3996 {
3997 "type": "server-version",
3998 "version": ">=5.0.13+083613e"
3999 }
4000 ]
4001 },
4002 {
4003 "v": "1",
4004 "type": {
4005 "name": "pipeline_rule",
4006 "version": "1"
4007 },
4008 "id": "679674f1-8e0e-4d87-b8a2-fb2b7a64bf56",
4009 "data": {
4010 "title": {
4011 "@type": "string",
4012 "@value": "OpenAudit Remove field - data_system_network_item_dhcp_lease_expires"
4013 },
4014 "description": {
4015 "@type": "string",
4016 "@value": "OpenAudit Remove field - data_system_network_item_dhcp_lease_expires"
4017 },
4018 "source": {
4019 "@type": "string",
4020 "@value": "rule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_expires\"\nwhen\n // Apply the rule when the specified field is present\n has_field(\"data_system_network_item_dhcp_lease_expires\")\nthen\n // Remove the specified field\n remove_field(\"data_system_network_item_dhcp_lease_expires\");\nend"
4021 }
4022 },
4023 "constraints": [
4024 {
4025 "type": "server-version",
4026 "version": ">=5.0.13+083613e"
4027 }
4028 ]
4029 },
4030 {
4031 "v": "1",
4032 "type": {
4033 "name": "pipeline_rule",
4034 "version": "1"
4035 },
4036 "id": "e3d86661-b008-4a88-bfc9-2ea479ab56b3",
4037 "data": {
4038 "title": {
4039 "@type": "string",
4040 "@value": "SYSLOG TYPE OFFICE365"
4041 },
4042 "description": {
4043 "@type": "string",
4044 "@value": "SYSLOG TYPE OFFICE365"
4045 },
4046 "source": {
4047 "@type": "string",
4048 "@value": "rule \"SYSLOG TYPE OFFICE365\"\nwhen\n $message.rule_group1 == \"office365\"\nthen\n set_field(\"syslog_type\", \"office365\");\nend"
4049 }
4050 },
4051 "constraints": [
4052 {
4053 "type": "server-version",
4054 "version": ">=5.0.13+083613e"
4055 }
4056 ]
4057 },
4058 {
4059 "v": "1",
4060 "type": {
4061 "name": "pipeline_rule",
4062 "version": "1"
4063 },
4064 "id": "94285f06-b069-45f8-a88f-34d20d0d83e4",
4065 "data": {
4066 "title": {
4067 "@type": "string",
4068 "@value": "SYSLOG TYPE SURICATA"
4069 },
4070 "description": {
4071 "@type": "string",
4072 "@value": "SYSLOG TYPE SURICATA"
4073 },
4074 "source": {
4075 "@type": "string",
4076 "@value": "rule \"SYSLOG TYPE SURICATA\"\nwhen\n $message.rule_group1 == \"suricata\"\nthen\n set_field(\"syslog_type\", \"suricata\");\nend"
4077 }
4078 },
4079 "constraints": [
4080 {
4081 "type": "server-version",
4082 "version": ">=5.0.13+083613e"
4083 }
4084 ]
4085 },
4086 {
4087 "v": "1",
4088 "type": {
4089 "name": "pipeline_rule",
4090 "version": "1"
4091 },
4092 "id": "273857f5-13cc-4845-8ba9-69fb4fe7bd15",
4093 "data": {
4094 "title": {
4095 "@type": "string",
4096 "@value": "Tetragon - Set process_id from exec_id"
4097 },
4098 "description": {
4099 "@type": "string",
4100 "@value": "Tetragon - Set process_id from exec_id"
4101 },
4102 "source": {
4103 "@type": "string",
4104 "@value": "rule \"Tetragon - Set process_id from exec_id\"\nwhen\n has_field(\"data_process_exec_process_exec_id\") &&\n (\n !has_field(\"data_process_exec_process_parent_exec_id\") ||\n to_string($message.data_process_exec_process_parent_exec_id) == \"\"\n )\nthen\n set_field(\"process_id\", to_string($message.data_process_exec_process_exec_id));\nend"
4105 }
4106 },
4107 "constraints": [
4108 {
4109 "type": "server-version",
4110 "version": ">=5.0.13+083613e"
4111 }
4112 ]
4113 },
4114 {
4115 "v": "1",
4116 "type": {
4117 "name": "pipeline_rule",
4118 "version": "1"
4119 },
4120 "id": "88483f85-30fe-47bf-b834-a72a6101d754",
4121 "data": {
4122 "title": {
4123 "@type": "string",
4124 "@value": "Tetragon - Set process_id from parent"
4125 },
4126 "description": {
4127 "@type": "string",
4128 "@value": "Tetragon - Set process_id from parent"
4129 },
4130 "source": {
4131 "@type": "string",
4132 "@value": "rule \"Tetragon - Set process_id from parent\"\nwhen\n has_field(\"data_process_exec_process_parent_exec_id\") &&\n to_string($message.data_process_exec_process_parent_exec_id) != \"\"\nthen\n set_field(\"process_id\", to_string($message.data_process_exec_process_parent_exec_id));\nend"
4133 }
4134 },
4135 "constraints": [
4136 {
4137 "type": "server-version",
4138 "version": ">=5.0.13+083613e"
4139 }
4140 ]
4141 },
4142 {
4143 "v": "1",
4144 "type": {
4145 "name": "stream",
4146 "version": "1"
4147 },
4148 "id": "feb9e1d7-9346-4a2a-9566-59ed483c1b83",
4149 "data": {
4150 "alarm_callbacks": [],
4151 "outputs": [],
4152 "remove_matches": {
4153 "@type": "boolean",
4154 "@value": true
4155 },
4156 "title": {
4157 "@type": "string",
4158 "@value": "WAZUH EDR AGENTS"
4159 },
4160 "stream_rules": [
4161 {
4162 "type": {
4163 "@type": "string",
4164 "@value": "EXACT"
4165 },
4166 "field": {
4167 "@type": "string",
4168 "@value": "rule_group1"
4169 },
4170 "value": {
4171 "@type": "string",
4172 "@value": "office365"
4173 },
4174 "inverted": {
4175 "@type": "boolean",
4176 "@value": true
4177 },
4178 "description": {
4179 "@type": "string",
4180 "@value": ""
4181 }
4182 },
4183 {
4184 "type": {
4185 "@type": "string",
4186 "@value": "EXACT"
4187 },
4188 "field": {
4189 "@type": "string",
4190 "@value": "rule_group1"
4191 },
4192 "value": {
4193 "@type": "string",
4194 "@value": "socfortress_healthcheck"
4195 },
4196 "inverted": {
4197 "@type": "boolean",
4198 "@value": true
4199 },
4200 "description": {
4201 "@type": "string",
4202 "@value": ""
4203 }
4204 },
4205 {
4206 "type": {
4207 "@type": "string",
4208 "@value": "EXACT"
4209 },
4210 "field": {
4211 "@type": "string",
4212 "@value": "rule_group1"
4213 },
4214 "value": {
4215 "@type": "string",
4216 "@value": "suricata"
4217 },
4218 "inverted": {
4219 "@type": "boolean",
4220 "@value": true
4221 },
4222 "description": {
4223 "@type": "string",
4224 "@value": ""
4225 }
4226 },
4227 {
4228 "type": {
4229 "@type": "string",
4230 "@value": "EXACT"
4231 },
4232 "field": {
4233 "@type": "string",
4234 "@value": "syslog_type"
4235 },
4236 "value": {
4237 "@type": "string",
4238 "@value": "wazuh"
4239 },
4240 "inverted": {
4241 "@type": "boolean",
4242 "@value": false
4243 },
4244 "description": {
4245 "@type": "string",
4246 "@value": ""
4247 }
4248 }
4249 ],
4250 "alert_conditions": [],
4251 "matching_type": {
4252 "@type": "string",
4253 "@value": "AND"
4254 },
4255 "disabled": {
4256 "@type": "boolean",
4257 "@value": false
4258 },
4259 "description": {
4260 "@type": "string",
4261 "@value": "WAZUH EDR AGENTS"
4262 },
4263 "default_stream": {
4264 "@type": "boolean",
4265 "@value": false
4266 }
4267 },
4268 "constraints": [
4269 {
4270 "type": "server-version",
4271 "version": ">=5.0.13+083613e"
4272 }
4273 ]
4274 }
4275 ]
4276 }