Update Wazuh processing pipelines with Tetragon rules for enhanced event normalization (#471)
taylor_socfortress committed
Jul 4, 2025 at 11:22 UTC
06bd76640353afc02f42571e457c5656dc1dc4d0
1 file changed
+1
-1
backend/app/stack_provisioning/graylog/templates/SOCFORTRESS_WAZUH_CONTENT_PACK.json
+1
-1
@@ -1743,7 +1743,7 @@
1743
},
1744
"source": {
1745
"@type": "string",
1746
- "@value": "pipeline \"WAZUH PROCESSING PIPELINES\"\nstage 0 match pass\nrule \"DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE\"\nstage 1 match either\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nrule \"Linux Sysmon Timestamp - UTC\"\nrule \"Office365 Timestamp - UTC\"\nrule \"Osquery Epoch Timestamp - UTC\"\nrule \"Packetbeat Timestamp - UTC\"\nrule \"Windows Timestamp - UTC\"\nrule \"URL Encode data_name field for ASK SOCFortress API\"\nrule \"NIST 800-53 TO CUI MAPPING\"\nrule \"SYSLOG TYPE OFFICE365\"\nrule \"SYSLOG TYPE SURICATA\"\nstage 2 match pass\nrule \"USER ADDED TO PRIVILEGE ADMIN GROUP\"\nrule \"ASK SOCFORTRESS WINDOWS - CHAINSAW\"\nstage 3 match either\nrule \"LINUX SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT DNS LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 2 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 22 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 7 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 10 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 12 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 13 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 17 LOG NORMALIZATION\"\nrule \"LINUX OSQUERY PROCESS LIST LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT NETWORK LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 15 LOG NORMALIZATION\"\nrule \"OSSEC SYSCHECK ADDED EVENT NORMALIZATION\"\nrule \"EPSS CVE Criticality\"\nrule \"EPSS CVE Criticality - NMAP\"\nrule \"WINDOWS PROCESS ID - No EventData Field\"\nrule \"WINDOWS PROCESS ID - Non SOCFortress Sysmon\"\nrule \"Timestamp Failsafe - UTC\"\nrule \"LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_ProcessId\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId\"\nrule \"LINUX OSQUERY PROCESS ID - GENERIC\"\nrule \"MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION\"\nrule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained\"\nrule \"OpenAudit Remove field - data_system_software_item_install_date\"\nrule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_expires\"\nstage 4 match pass\nrule \"WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - NETWORK PORTS\"\nstage 5 match pass\nrule \"WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - UNCOMMON PORT\"\nstage 7 match either\nrule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nstage 6 match either\nrule \"LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL\"\nend"
1746
+ "@value": "pipeline \"WAZUH PROCESSING PIPELINES\"\nstage 0 match pass\nrule \"DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE\"\nstage 1 match either\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nrule \"Linux Sysmon Timestamp - UTC\"\nrule \"Office365 Timestamp - UTC\"\nrule \"Osquery Epoch Timestamp - UTC\"\nrule \"Packetbeat Timestamp - UTC\"\nrule \"Windows Timestamp - UTC\"\nrule \"URL Encode data_name field for ASK SOCFortress API\"\nrule \"NIST 800-53 TO CUI MAPPING\"\nrule \"SYSLOG TYPE OFFICE365\"\nrule \"SYSLOG TYPE SURICATA\"\nstage 2 match pass\nrule \"USER ADDED TO PRIVILEGE ADMIN GROUP\"\nrule \"ASK SOCFORTRESS WINDOWS - CHAINSAW\"\nstage 3 match either\nrule \"Tetragon - Set process_id from exec_id\"\nrule \"Tetragon - Set process_id from parent\"\nrule \"LINUX SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT DNS LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 2 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 22 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 7 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 10 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 12 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 13 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 17 LOG NORMALIZATION\"\nrule \"LINUX OSQUERY PROCESS LIST LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT NETWORK LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 15 LOG NORMALIZATION\"\nrule \"OSSEC SYSCHECK ADDED EVENT NORMALIZATION\"\nrule \"EPSS CVE Criticality\"\nrule \"EPSS CVE Criticality - NMAP\"\nrule \"WINDOWS PROCESS ID - No EventData Field\"\nrule \"WINDOWS PROCESS ID - Non SOCFortress Sysmon\"\nrule \"Timestamp Failsafe - UTC\"\nrule \"LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_ProcessId\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId\"\nrule \"LINUX OSQUERY PROCESS ID - GENERIC\"\nrule \"MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION\"\nrule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained\"\nrule \"OpenAudit Remove field - data_system_software_item_install_date\"\nrule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_expires\"\nstage 4 match pass\nrule \"WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - NETWORK PORTS\"\nstage 5 match pass\nrule \"WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - UNCOMMON PORT\"\nstage 7 match either\nrule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nstage 6 match either\nrule \"LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL\"\nend"
1747
},
1748
"connected_streams": [
1749
{