Skip to content

Commit 7c9b1d1

Browse files
osmonteroosmontero
committed
fix (filters) multiple filters using mother overloads that are null and type safe
1 parent 33a0c51 commit 7c9b1d1

9 files changed

Lines changed: 73 additions & 84 deletions

File tree

‎filters/cisco/asa.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5723,12 +5723,12 @@ pipeline:
57235723
from:
57245724
- log.tmpIp
57255725
to: origin.ip
5726-
where: log.messageId==733101 && action.contains("attacking")
5726+
where: log.messageId==733101 && contains("action", "attacking")
57275727
- rename:
57285728
from:
57295729
- log.tmpIp
57305730
to: target.ip
5731-
where: log.messageId==733101 && action.contains("targeted")
5731+
where: log.messageId==733101 && contains("action", "targeted")
57325732
# Adding action result
57335733
- add:
57345734
function: 'string'

‎filters/cisco/cs_switch.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ pipeline:
5252
- fieldName: log.ciscoMsg
5353
pattern: '{{.greedy}}'
5454
source: log.msg
55-
where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
55+
where: '(!contains("log.msg", "-MSG:SLOT")) && (!contains("log.msg", "-MSG: SLOT"))'
5656
# Extracting subfacility if present
5757
- grok:
5858
patterns:
@@ -61,7 +61,7 @@ pipeline:
6161
- fieldName: log.severity
6262
pattern: '{{.integer}}'
6363
source: log.severity
64-
where: '(log.msg.contains("-MSG:SLOT") == false) && (log.msg.contains("-MSG: SLOT") == false)'
64+
where: '(!contains("log.msg", "-MSG:SLOT")) && (!contains("log.msg", "-MSG: SLOT"))'
6565
# --------------------------
6666
# Variant -> %CARD-SEVERITY-MSG:SLOT %FACILITY-SEVERITY-MNEMONIC: Message-text
6767
- grok:
@@ -79,14 +79,14 @@ pipeline:
7979
- fieldName: log.ciscoMsg
8080
pattern: '{{.greedy}}'
8181
source: log.msg
82-
where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
82+
where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
8383

8484
- trim:
8585
function: prefix
8686
substring: '%'
8787
fields:
8888
- log.tmpFacilityMnemonic
89-
where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
89+
where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
9090
# %FACILITY-SEVERITY-MNEMONIC
9191
- grok:
9292
patterns:
@@ -97,7 +97,7 @@ pipeline:
9797
- fieldName: log.facilityMnemonic
9898
pattern: '{{.data}}\:'
9999
source: log.tmpFacilityMnemonic
100-
where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
100+
where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
101101
# Extracting subfacility if present
102102
- grok:
103103
patterns:
@@ -106,7 +106,7 @@ pipeline:
106106
- fieldName: log.severity
107107
pattern: '{{.integer}}'
108108
source: log.severity
109-
where: 'log.msg.contains("-MSG:SLOT") || log.msg.contains("-MSG: SLOT")'
109+
where: 'contains("log.msg", "-MSG:SLOT") || contains("log.msg", "-MSG: SLOT")'
110110

111111
# Cleaning common fields
112112
- trim:

‎filters/cisco/firepower.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4947,12 +4947,12 @@ pipeline:
49474947
from:
49484948
- log.tmpIp
49494949
to: origin.ip
4950-
where: equals("log.messageId", 733101) && action.contains("attacking")
4950+
where: equals("log.messageId", 733101) && contains("action", "attacking")
49514951
- rename:
49524952
from:
49534953
- log.tmpIp
49544954
to: target.ip
4955-
where: equals("log.messageId", 733101) && action.contains("targeted")
4955+
where: equals("log.messageId", 733101) && contains("action", "targeted")
49564956
# Adding action result
49574957
- add:
49584958
function: 'string'
@@ -4978,13 +4978,13 @@ pipeline:
49784978
params:
49794979
key: action
49804980
value: 'Threat-detection add host to shun list'
4981-
where: (equals("log.messageId", 733102) || log.messageId==733103) && log.msg.contains("add")
4981+
where: (equals("log.messageId", 733102) || log.messageId==733103) && contains("log.msg", "add")
49824982
- add:
49834983
function: 'string'
49844984
params:
49854985
key: action
49864986
value: 'Threat-detection removes host to shun list'
4987-
where: (equals("log.messageId", 733102) || log.messageId==733103) && log.msg.contains("removes")
4987+
where: (equals("log.messageId", 733102) || log.messageId==733103) && contains("log.msg", "removes")
49884988
#......................................................................#
49894989
# Decoding severity
49904990
- add:

‎filters/cisco/meraki.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -346,13 +346,13 @@ pipeline:
346346
params:
347347
key: actionResult
348348
value: 'accepted'
349-
where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (log.pattern.startsWith("0") || log.pattern.startsWith("allow") || log.pattern.startsWith("Allow"))'
349+
where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "0") || startsWith("log.pattern", "allow") || startsWith("log.pattern", "Allow"))'
350350
- add:
351351
function: 'string'
352352
params:
353353
key: actionResult
354354
value: 'denied'
355-
where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (log.pattern.startsWith("deny") || log.pattern.startsWith("Deny"))'
355+
where: '!equals("log.controlFlag", "Init") && startsWith("log.genericEvent", "src") && log.merakiGroup=="flows" && (startsWith("log.pattern", "deny") || startsWith("log.pattern", "Deny"))'
356356
# ........................................
357357
# Event: ids-alerts, ids signature matched in Meraki MX Security Appliance
358358
- grok:

‎filters/deceptivebytes/deceptive-bytes.yml‎

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -240,17 +240,6 @@ pipeline:
240240
pattern: '{{.integer}}\s'
241241
- fieldName: log.component
242242
pattern: '{{.word}}\,'
243-
- fieldName: log.errorCode
244-
pattern: '{{.integer}}\]'
245-
- fieldName: log.message
246-
pattern: '{{.greedy}}'
247-
source: log.restMessage
248-
where: log.restMessage.contains("file")
249-
250-
- grok:
251-
patterns:
252-
- fieldName: log.severityLabelCharacter
253-
pattern: '{{.word}}\s'
254243
- fieldName: log.trheadId
255244
pattern: '{{.integer}}\,'
256245
- fieldName: log.eventSource
@@ -262,7 +251,7 @@ pipeline:
262251
- fieldName: origin.path
263252
pattern: '(?:[A-Z]:\\(?:[^\\\n]+\\)*[^\\\n]*|\/(?:[^\/\n]+\/)*[^\/\n]*)'
264253
source: log.restMessage
265-
where: log.severityLabelCharacter.contains("V")
254+
where: contains("log.severityLabelCharacter", "V")
266255

267256
- grok:
268257
patterns:
@@ -350,7 +339,7 @@ pipeline:
350339
- fieldName: log.irrelevant
351340
pattern: '{{.greedy}}'
352341
source: raw
353-
where: log.severityLabelCharacter.contains("W")
342+
where: contains("log.severityLabelCharacter", "W")
354343

355344
# Removing unnecessary characters
356345
- trim:

0 commit comments

Comments
 (0)