bro.tar

0000_input_bro.conf0100777000000000000000000000041612777313371011337 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/12/2016
#
input {
  tcp {
    port => 6050
    codec =>   json
    tags => "bro"
  }
}
filter {
  if "bro" in [tags] {
    mutate {
      rename => { "Message" => "message" }
    }
  }  
}
1002_preprocess_bro.conf0100777000000000000000000000107212777313263012367 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 11/18/2015
#
# This file is to apply a filter against any Bro logs coming in
filter {
  if "bro" in [tags] {
    # If a log comes in with a message starting with # then drop it as it doesn'then
	# contain anything and is the header of a rotated bro log
    if [message] =~ /^#/ {
      drop {  }
    } else {
	  # Replace the host field with the host found in the bro log
      if [bro_host] {
#        mutate {
#          replace => [ "host", "%{bro_host}" ]
#        }
      }
    }
  }
}
1100_preprocessor_bro_conn.conf0100777000000000000000000000443112777313263013746 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for conn.log from Bro systems
filter {
  if [type] == "bro_conn" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","service","duration","original_bytes","respond_bytes","connection_state","local_orig","local_respond","missed_bytes","history","original_packets","original_ipbytes","respond_packets","respond_ipbytes","tunnel_parents","original_country_code","respond_country_code","sensor_name"]

    # If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
      separator => "	"
    }
    translate {
      field => "connection_state"

      destination => "ConnectionStateDescription"

      dictionary => [
                    "S0", "Connection attempt seen, no reply",
                    "S1", "Connection established, not terminated",
                    "S2", "Connection established and close attempt by originator seen (but no reply from responder)",
                    "S3", "Connection established and close attempt by responder seen (but no reply from originator)",
                    "SF", "Normal SYN/FIN completion",
                    "REJ", "Connection attempt rejected",
                    "RSTO", "Connection established, originator aborted (sent a RST)",
                    "RSTR", "Established, responder aborted",
                    "RSTOS0", "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder",
                    "RSTRH", "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator",
                    "SH", "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)",
		    "SHR", "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator",
                    "OTH", "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)"
                    ]
    }
  }
}
1101_preprocessor_bro_dhcp.conf0100777000000000000000000000101012777313263013716 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for dhcp.log from Bro systems
filter {
  if [type] == "bro_dhcp" {
    # This is the initial parsing of the log
    grok {
      match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<mac>(.*?))\t(?<assigned_ip>(.*?))\t(?<lease_time>(.*?))\t(?<transaction_id>(.*))" ]
    }
  }
}
1102_preprocessor_bro_dns.conf0100777000000000000000000000146312777313263013601 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for dns.log from Bro systems
filter {
  if [type] == "bro_dns" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","transaction_id","query","query_class","query_class_name","query_type","query_type_name","rcode","rcode_name","aa","tc","rd","ra","z","answers","ttls","rejected"]

      #If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
      separator => "	"
    }
  }
}
1103_preprocessor_bro_dpd.conf0100777000000000000000000000065512777313263013567 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for dpd.log from Bro systems
filter {
  if [type] == "bro_dpd" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","analyzer","failure_reason"]
      separator => "	"
    }
  }	
}
1104_preprocessor_bro_files.conf0100777000000000000000000000107212777313263014115 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for files.log from Bro systems
filter {
  if [type] == "bro_files" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","fuid","source_ip","destination_ip","connection_uids","source","depth","analyzer","mimetype","file_name","duration","rig","is_orig","seen_bytes","total_bytes","missing_bytes","overflow_bytes","timed_out","fuid","md5","sha1","sha256","extracted"]
      separator => "	"
    }
  }
}
1105_preprocessor_bro_ftp.conf0100777000000000000000000000113212777313263013602 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for ftp.log from Bro systems
filter {
  if [type] == "bro_ftp" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","username","password","command","argument","mimetype","file_size","reply_code","reply_message","data_channel_passive","data_channel_source_ip","data_channel_destination_ip","data_channel_destination_port","fuid"]
      separator => "	"
    }
  }	
}
1106_preprocessor_bro_http.conf0100777000000000000000000000152012777313263013772 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for http.log from Bro systems
filter {
  if [type] == "bro_http" {
    grok {
      match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<method>(.*?))\t(?<virtual_host>(.*?))\t(?<uri>(.*?))\t(?<referrer>(.*?))\t(?<useragent>(.*?))\t(?<request_body_length>(.*?))\t(?<response_body_length>(.*?))\t(?<status_code>(.*?))\t(?<status_message>(.*?))\t(?<info_code>(.*?))\t(?<info_message>(.*?))\t(?<filename>(.*))\t(?<tags>(.*))\t(?<user>(.*))\t(?<password>(.*))\t(?<proxied>(.*))\t(?<orig_fuids>(.*))\t(?<orig_mime_types>(.*))\t(?<resp_fuids>(.*))\t(?<resp_mime_types>(.*))" ]
    }
  }
}
1107_preprocessor_bro_irc.conf0100777000000000000000000000076312777313263013601 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for irc.log from Bro systems
filter {
  if [type] == "bro_irc" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","nick","username","command","value","additional_info","dcc_file_name","dcc_file_size","dcc_mime_type","fuid"]
      separator => "	"
    }
  }	
}
1108_preprocessor_bro_kereberos.conf0100777000000000000000000000110212777313263014772 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for kerberos.log from Bro systems
filter {
  if [type] == "bro_kerberos" {
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","request_type","client","service","success","error_message","email_from","till","cipher","forwardable","renewable","client_certificate_subject","client_certificate_uid","server_certificate_subject","server_certificate_fuid"]
      separator => "	"
    }
  }
}
1109_preprocessor_bro_notice.conf0100777000000000000000000000125412777313263014303 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for notice.log from Bro systems
filter {
  if [type] == "bro_notice" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","fuid","file_mime_type","file_description","protocol","note","message","sub_message","source_ip","destination_ip","p","n","peer_description","action","suppress_for","dropped","destination_country_code","destination_region","destination_city","destination_latitude","destination_longitude"]
      separator => "	"
    }
  }
}
1110_preprocessor_bro_rdp.conf0100777000000000000000000000115212777313263013574 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for weird.log from Bro systems
filter {
  if [type] == "bro_rdp" {
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","cookie","result","security_protocol","keyboard_layout","client_build","client_name","client_digital_product_id","desktop_width","desktop_height","requested_color_depth","certificate_type","certificate_count","certificate_permanent","encryption_level","encryption_method"]
      separator => "	"
    }
  }
}
1111_preprocessor_bro_signatures.conf0100777000000000000000000000074712777313263015205 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for signatures.log from Bro systems
filter {
  if [type] == "bro_signatures" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","note","signature_id","event_message","sub_message","signature_count","host_count"]
      separator => "	"
    }
  }	
}
1112_preprocessor_bro_smtp.conf0100777000000000000000000000143312777313263013776 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for smtp.log from Bro systems
filter {
  if [type] == "bro_smtp" {
    grok {
      match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<trans_depth>(.*?))\t(?<helo>(.*?))\t(?<mail_from>(.*?))\t(?<recipient_to>(.*?))\t(?<mail_date>(.*?))\t(?<from>(.*?))\t(?<to>(.*?))\t(?<teply_to>(.*?))\t(?<message_id>(.*?))\t(?<in_reply_to>(.*?))\t(?<subject>(.*?))\t(?<x_originating_ip>(.*?))\t(?<first_received>(.*))\t(?<second_received>(.*))\t(?<last_reply>(.*))\t(?<path>(.*))\t(?<useragent>(.*))\t(?<tls>(.*))\t(?<fuids>(.*))\t(?<is_webmail>(.*))" ]
    }
  }
}
1113_preprocessor_bro_snmp.conf0100777000000000000000000000101012777313263013760 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for snmp.log from Bro systems
filter {
  if [type] == "bro_snmp" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","duration","version","community","get_requests","get_bulk_requests","get_responses","set_responses","display_string","up_since"]
      separator => "	"
    }
  }	
}
1114_preprocessor_bro_software.conf0100777000000000000000000000075412777313263014654 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for software.log from Bro systems
filter {
  if [type] == "bro_software" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","source_ip","source_port","software_type","name","version_major","version_minor","version_minor2","version_minor3","version_additional_info","unparsed_version"]
      separator => "	"
    }
  }	
}
1115_preprocessor_bro_ssh.conf0100777000000000000000000000124312777313263013612 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for ssh.log from Bro systems
filter {
  if [type] == "bro_ssh" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","authentication_success","direction","client","server","cipher_algorithm","mac_algorithm","compression_algorithm","kex_algorithm","host_key_algorithm","host_key","destination_country_code","destination_region","destination_city","destination_latitude","destination_longitude"]
      separator => "	"
    }
  }
}
1116_preprocessor_bro_ssl.conf0100777000000000000000000000300212777313263013612 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for ssl.log from Bro systems
filter {
  if [type] == "bro_ssl" {
   # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","cipher","curve","server_name","resumed","last_alert","next_protocol","established","certificate_chain_fuids","client_certificate_chain_fuids","subject","issuer","client_subject","client_issuer","validation_status"]
      separator => "	"
    }
    mutate {
      gsub => [ "subject", "\\\\,", "|" ]
    }
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "subject"
    }
    mutate {
      rename => { "CN" => "subject_common_name"}
      rename => { "C" => "subject_country_code"}
      rename => { "O" => "subject_organization"}
      rename => { "OU" => "subject_organization_unit"}
      rename => { "ST" => "subject_state"}
      rename => { "SN" => "subject_surname"}
      rename => { "L" => "subject_locality"}
      rename => { "DC" => "subject_distinguished_name"}
      rename => { "GN" => "subject_given_name"}
      rename => { "pseudonym" => "subject_pseudonym"}
      rename => { "serialNumber" => "subject_serial_number"}
      rename => { "title" => "subject_title"}
      rename => { "initials" => "subject_initials"}
    }
  }	
}
1117_preprocessor_bro_syslog.conf0100777000000000000000000000067112777313263014343 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for syslog.log from Bro systems
filter {
  if [type] == "bro_syslog" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","facilility","severity","message"]
      separator => "	"
    }
  }	
}
1118_preprocessor_bro_tunnel.conf0100777000000000000000000000064312777313264014331 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for tunnel.log from Bro systems
filter {
  if [type] == "bro_tunnel" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","tunnel_type","action"]
      separator => "	"
    }
  }	
}
1119_preprocessor_bro_weird.conf0100777000000000000000000000072412777313264014137 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for weird.log from Bro systems
filter {
  if [type] == "bro_weird" {
    grok {
      match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<name>(.*?))\t(?<additional_info>(.*?))\t(?<notice>(.*?))\t(?<peer>(.*))" ]
    }
  }
}
1121_preprocessor_bro_mysql.conf0100777000000000000000000000100212777313264014151 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for mysql.log from Bro systems
filter {
  if [type] == "bro_mysql" {
    # This is the initial parsing of the log
    grok {
      match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<SourceIP>(.*?))\t(?<SourcePort>(.*?))\t(?<DestinationIP>(.*?))\t(?<DestinationPort>(.*?))\t(?<Command>(.*?))\t(?<Argument>(.*?))\t(?<Success>(.*?))\t(?<RowsResponse>(.*))" ]
    }
  }
}
1122_preprocessor_bro_socks.conf0100777000000000000000000000120112777313264014130 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for socks.log from Bro systems
filter {
  if [type] == "bro_socks" {
    # This is the initial parsing of the log
    grok {
      match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<version>(.*?))\t(?<user>(.*?))\t(?<password>(.*?))\t(?<status>(.*))\t(?<request_host>(.*))\t(?<request_name>(.*))\t(?<request_port>(.*))\t(?<bound_host>(.*))\t(?<bound_name>(.*))\t(?<bound_port>(.*))" ]
    }
  }
}
1123_preprocessor_bro_x509.conf0100777000000000000000000000476012777313264013531 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for x509.log from Bro systems

filter {
  if [type] == "bro_x509" {
    grok {
      match => [ "message", "(?<timestamp>(.*?))\t(?<id>(.*?))\t(?<certificate_version>(.*?))\t(?<certificate_serial>(.*?))\t(?<certificate_subject>(.*?))\t(?<certificate_issuer>(.*?))\t(?<certificate_not_valid_before>(.*?))\t(?<certificate_not_valid_after>(.*?))\t(?<certificate_key_algorithm>(.*?))\t(?<certificate_signing_algorithm>(.*))\t(?<certificate_key_type>(.*))\t(?<certificate_key_length>(.*))\t(?<certificate_exponent>(.*))\t(?<certificate_curve>(.*))\t(?<san_dns>(.*))\t(?<san_uri>(.*))\t(?<san_email>(.*))\t(?<san_ip>(.*))\t(?<basic_constraints_ca>(.*))\t(?<basic_constraints_path_length>(.*))" ]
    }

    mutate {
      gsub => [ "certificate_issuer", "\\\\,", "|" ]
      gsub => [ "certificate_subject", "\\\\,", "|" ]
    }
	
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "certificate_issuer"
    }
    mutate {
      rename => { "CN" => "issuer_common_name"}
      rename => { "C" => "issuer_country_code"}
      rename => { "O" => "issuer_organization"}
      rename => { "OU" => "issuer_organization_unit"}
      rename => { "ST" => "issuer_state"}
      rename => { "SN" => "issuer_surname"}
      rename => { "L" => "issuer_locality"}
      rename => { "DC" => "issuer_distinguished_name"}
      rename => { "GN" => "issuer_given_name"}
      rename => { "pseudonym" => "issuer_pseudonym"}
      rename => { "serialNumber" => "issuer_serial_number"}
      rename => { "title" => "issuer_title"}
      rename => { "initials" => "issuer_initials"}
    }
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "certificate_subject"
    }
    mutate {
      rename => { "CN" => "common_name"}
      rename => { "C" => "country_code"}
      rename => { "O" => "organization"}
      rename => { "OU" => "organization_unit"}
      rename => { "ST" => "state"}
      rename => { "SN" => "surname"}
      rename => { "L" => "locality"}
      rename => { "GN" => "given_name"}
      rename => { "pseudonym" => "pseudonym"}
      rename => { "serialNumber" => "serial_number"}
      rename => { "title" => "title"}
      rename => { "initials" => "initials"}
    }
  }
}
1124_preprocessor_bro_intel.conf0100777000000000000000000000075712777313264014142 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 9/22/2016
#
# This conf file is based on accepting logs for intel.log from Bro systems
filter {
  if [type] == "bro_intel" {
    # This is the initial parsing of the log
    csv {
      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","fuid","mimetype","file_description","indicator","indicator_type","seen_where","seen_node","sources"]
      separator => "	"
    }
  }	
}
6000_bro.conf0100777000000000000000000000777512777313264010146 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/10/2016
#
# This conf file is based on accepting logs for conn.log from Bro systems
filter {
  if "bro" in [tags] {
    if [duration] == "-" {
      mutate {
        replace => [ "duration", "0" ]
      }
    }
    if [original_bytes] == "-" {
      mutate {
        replace => [ "original_bytes", "0" ]
      }
    }
    # If MissedBytes is unspecified set it to zero so it is an integer
    if [missed_bytes] == "-" {
      mutate {
        replace => [ "missed_bytes", "0" ]
      }
    }
    # If OriginalIPBytes is unspecified set it to zero so it is an integer
    if [original_ip_bytes] == "-" {
      mutate {
        replace => [ "original_ip_bytes", "0" ]
      }
    }
    # If RespondBytes is unspecified set it to zero so it is an integer
    if [respond_bytes] == "-" {
      mutate {
        replace => [ "respond_bytes", "0" ]
      }
    }
    # If RespondIPBytes is unspecified set it to zero so it is an integer
    if [respond_ip_bytes] == "-" {
      mutate {
        replace => [ "respond_ip_bytes", "0" ]
      }
    }
    if [source_port] == "-" {
      mutate {
        remove_field => ["source_port"]
      }
    }
    if [destination_port] == "-" {
      mutate {
        remove_field => ["destination_port"]
      }
    }

    # I renamed conn_uids to uid so that it is easy to pivot to all things tied to a connection
    mutate {
       rename => [ "connection_uids", "uid" ]
    }
    # If total_bytes is set to "-" change it to 0 so it is an integer
    if [total_bytes] == "-" {
      mutate {
        replace => [ "total_bytes", "0" ]
      }
    }
    # If seen_bytes is set to "-" change it to 0 so it is an integer
    if [seen_bytes] == "-" {
      mutate {
        replace => [ "seen_bytes", "0" ]
      }
    }
    # If missing_bytes is set to "-" change it to 0 so it is an integer
    if [missing_bytes] == "-" {
      mutate {
        replace => [ "missing_bytes", "0" ]
      }
    }
    # If pverflow_bytes is set to "-" change it to 0 so it is an integer
    if [overflow_bytes] == "-" {
      mutate {
        replace => [ "overflow_bytes", "0" ]
      }
    }
    # I recommend changing the field types below to integer or floats so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "bound_port", "integer" ]
      convert => [ "data_channel_destination_port", "integer" ]
      convert => [ "destination_port", "integer" ]
      convert => [ "depth", "integer" ]
      convert => [ "duration", "float" ]
      convert => [ "info_code", "integer" ]
      convert => [ "missed_bytes", "integer" ]
      convert => [ "missing_bytes", "integer" ]
      convert => [ "n", "integer" ]
      convert => [ "original_bytes", "integer" ]
      convert => [ "original_packets", "integer" ]
      convert => [ "original_ip_bytes", "integer" ]
      convert => [ "overflow_bytes", "integer" ]
      convert => [ "p", "integer" ]
      convert => [ "query_class", "integer" ]
      convert => [ "query_type", "integer" ]
      convert => [ "rcode", "integer" ]
      convert => [ "request_body_length", "integer" ]
      convert => [ "request_port", "integer" ]
      convert => [ "respond_bytes", "integer" ]
      convert => [ "respond_packets", "integer" ]
      convert => [ "respond_ip_bytes", "integer" ]
      convert => [ "response_body_length", "integer" ]
      convert => [ "seen_bytes", "integer" ]
      convert => [ "source_port", "integer" ]
      convert => [ "status_code", "integer" ]
      convert => [ "suppress_for", "float" ]
      convert => [ "total_bytes", "integer" ]
      convert => [ "trans_depth", "integer" ]
      convert => [ "transaction_id", "integer" ]
      lowercase => [ "query" ]
    }

    # Combine OriginalBytes and RespondBytes and save the value to total_bytes
    if [original_bytes] {
      if [respond_bytes] {
        ruby {
          code => "event['total_bytes'] = event['original_bytes'] + event['respond_bytes']"
        }
      }
    }
  }
}
9000_output_bro.conf0100777000000000000000000000077412777313264011561 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/12/2016
#

output {
  if "bro" in [tags] {
#    stdout { codec => rubydebug }
    elasticsearch {
      hosts => [ "172.16.1.8", "172.16.1.9" ]
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_all.conf0100777000000000000000000000142412712674274010312 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 11/18/2015
#
# This file is to apply a filter against any Bro logs coming in
filter {
  if [type] =~ "bro" {
    # If a log comes in with a message starting with # then drop it as it doesn'then
	# contain anything and is the header of a rotated bro log
    if [message] =~ /^#/ {
      drop {  }
    } else {
      # I like to tag all bro logs as bro.  If you don't like this then comment it out
      # or change it
      if [SourcePort] == "-" {
        mutate {
          replace => [ "SourcePort", "0" ]
        }
      }
      if [DestinationPort] == "-" {
        mutate {
          replace => [ "DestinationPort", "0" ]
        }
      }
      mutate {
        add_tag => [ "bro" ]
      }
    }
  }
}
bro_conn.conf0100777000000000000000000001261612712674274010504 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for conn.log from Bro systems
input {
  file {
    type => "bro_conn"
    sincedb_path => "/var/tmp/.bro_conn_sincedb"
 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/conn.log"
  }
}

filter {
  if [type] == "bro_conn" {
    # This is the initial parsing of the log
	csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Protocol","Service","Duration","OriginalBytes","RespondBytes","ConnectionState","LocalOrig","LocalRespond","MissedBytes","History","OriginalPackets","OriginalIPBytes","RespondPackets","RespondIPBytes","TunnelParents","OriginalCountryCode","RespondCountryCode","SensorName"]

    # If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    # If duration is unspecified set it to zero so it is an integer
    if [duration] == "-" {
      mutate {
        replace => [ "Duration", "0" ]
      }
    }
    # If OriginalBytes is unspecified set it to zero so it is an integer
    if [OriginalBytes] == "-" {
      mutate {
        replace => [ "OriginalBytes", "0" ]
      }
    }
    # If MissedBytes is unspecified set it to zero so it is an integer
    if [MissedBytes] == "-" {
      mutate {
        replace => [ "MissedBytes", "0" ]
      }
    }
    # If OriginalIPBytes is unspecified set it to zero so it is an integer
    if [OriginalIPBytes] == "-" {
      mutate {
        replace => [ "OriginalIPBytes", "0" ]
      }
    }
    # If RespondBytes is unspecified set it to zero so it is an integer
    if [RespondBytes] == "-" {
      mutate {
        replace => [ "RespondBytes", "0" ]
      }
    }
    # If RespondIPBytes is unspecified set it to zero so it is an integer
    if [RespondIPBytes] == "-" {
      mutate {
        replace => [ "RespondIPBytes", "0" ]
      }
    }
    # I recommend changing the field types below to integer or floats so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
      convert => [ "OriginalBytes", "integer" ]
      convert => [ "RespondBytes", "integer" ]
      convert => [ "MissedBytes", "integer" ]
      convert => [ "OriginalPackets", "integer" ]
      convert => [ "OriginalIPBytes", "integer" ]
      convert => [ "RespondPackets", "integer" ]
      convert => [ "RespondIPBytes", "integer" ]
      convert => [ "Duration", "float" ]
    }
    # Combine OriginalBytes and RespondBytes and save the value to total_bytes
    if [OriginalBytes] {
      if [RespondBytes] {
        ruby {
          code => "event['TotalBytes'] = event['OriginalBytes'] + event['RespondBytes']"
        }
      }
    }

    date {
      match => [ "ts", "UNIX" ]
    }
    translate {
      field => "ConnectionState"

      destination => "ConnectionStateDescription"

      dictionary => [
                    "S0", "Connection attempt seen, no reply",
                    "S1", "Connection established, not terminated",
                    "S2", "Connection established and close attempt by originator seen (but no reply from responder)",
                    "S3", "Connection established and close attempt by responder seen (but no reply from originator)",
                    "SF", "Normal SYN/FIN completion",
                    "REJ", "Connection attempt rejected",
                    "RSTO", "Connection established, originator aborted (sent a RST)",
                    "RSTR", "Established, responder aborted",
                    "RSTOS0", "Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder",
                    "RSTRH", "Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator",
                    "SH", "Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was 'half' open)",
		    "SHR", "Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator",
                    "OTH", "No SYN seen, just midstream traffic (a 'partial connection' that was not later closed)"
                    ]
    }
    # If you'd like for IP addresses to be resolved to DNS names uncomment this section 
    # On conn.log this can generate a TON of DNS requests
    #
    if [SourceIP] {
      geoip {
        source => "SourceIP"
        target => "SourceGeo"
      }
    }
    if [DestinationIP] {
      geoip {
        source => "DestinationIP"
        target => "DestinationGeo"
      }
    }
  }
}

output {
  if [type] == "bro_conn" {
    #stdout { codec => rubydebug }
    elasticsearch {
       # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
       # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_dhcp.conf0100777000000000000000000000314612712674274010463 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for dhcp.log from Bro systems
input {
  file {
    type => "bro_dhcp"
    sincedb_path => "/var/tmp/.bro_dhcp_sincedb"
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/dhcp.log"
  }
}

filter {
  if [type] == "bro_dhcp" {
    # This is the initial parsing of the log
    grok {
      match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<SourceIP>(.*?))\t(?<SourcePort>(.*?))\t(?<DestinationIP>(.*?))\t(?<DestinationPort>(.*?))\t(?<MAC>(.*?))\t(?<AssignedIP>(.*?))\t(?<LeaseTime>(.*?))\t(?<TransactionID>(.*))" ]
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }
}

output {
  if [type] == "bro_dhcp" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_dns.conf0100777000000000000000000000564512712674274010337 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for dns.log from Bro systems
input {
  file {
    type => "bro_dns"
    sincedb_path => "/var/tmp/.bro_dns_sincedb"
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/dns.log"
  }
}

filter {
  if [type] == "bro_dns" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Protocol","TransactionID","Query","QueryClass","QueryClassName","QueryType","QueryTypeName","rcode","rcode_name","AA","TC","RD","RA","Z","Answers","TTLs","Rejected"]

      #If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
      convert => [ "TransactionID", "integer" ]
      convert => [ "QueryClass", "integer" ]
      convert => [ "QueryType", "integer" ]
      convert => [ "rcode", "integer" ]
      lowercase => [ "Query" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
    # If Query exists run a frequency analysis against it.  In order for this to work you must have
    # freq.py and the corresponding frequency table in /opt/freq/.  This is a huge boost to security
    # and I highly recommend you set this up.  Example, if a frequency score less than 6 exists
    # then there is a likelihood that something malicious is happening.
    #
    # For higher accuracy, please generate your own frequency tables.  For questions on setup,
    # please refer to https://github.com/SMAPPER
    if [QueryTypeName] == "A" or [QueryTypeName] == "AAAA" {
      ruby {
       code => "freq_query = URI.escape(event['Query']); event['FrequencyScore'] = `/usr/bin/curl -s http://127.0.0.1:10004?cmd=measure\\&tgt=#{freq_query}`"
      }
      mutate {
        convert => [ "FrequencyScore", "float" ]
      }
    }
  }
}

output {
  if [type] == "bro_dns" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }						 
}
bro_dpd.conf0100777000000000000000000000255112712674274010313 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for dpd.log from Bro systems
input {
  file {
    type => "bro_dpd"
    sincedb_path => "/var/tmp/.bro_dpd_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/dpd.log"
  }
}

filter {
  if [type] == "bro_dpd" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Protocol","Analyzer","FailureReason"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }	
}

output {
  if [type] == "bro_dpd" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}

bro_files.conf0100777000000000000000000000522612712674274010650 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for files.log from Bro systems
input {
  file {
    type => "bro_files"
    sincedb_path => "/var/tmp/.bro_files_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/files.log"
  }
}

filter {
  if [type] == "bro_files" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","fuid","SourceIP","DestinationIP","conn_uids","Source","Depth","Analyzers","MIMEType","FileName","Duration","local_orig","is_orig","SeenBytes","TotalBytes","MissingBytes","OverflowBytes","TimedOut","parent_fuid","md5","sha1","sha256","Extracted"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    # I renamed conn_uids to uid so that it is easy to pivot to all things tied to a connection
    mutate {
       rename => [ "conn_uids", "uid" ]
    }
    # If TotalBytes is set to "-" change it to 0 so it is an integer
    if [TotalBytes] == "-" {
      mutate {
        replace => [ "TotalBytes", "0" ]
      }
    }
    # If SeenBytes is set to "-" change it to 0 so it is an integer
    if [SeenBytes] == "-" {
      mutate {
        replace => [ "SeenBytes", "0" ]
      }
    }
    # If MissingBytes is set to "-" change it to 0 so it is an integer
    if [MissingBytes] == "-" {
      mutate {
        replace => [ "MissingBytes", "0" ]
      }
    }
    # If OverflowBytes is set to "-" change it to 0 so it is an integer
    if [OverflowBytes] == "-" {
      mutate {
        replace => [ "OverflowBytes", "0" ]
      }
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "TotalBytes", "integer" ]
      convert => [ "Duration", "float" ]
      convert => [ "Depth", "integer" ]
      convert => [ "SeenBytes", "integer" ]
      convert => [ "MissingBytes", "integer" ]
      convert => [ "OverflowBytes", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }
}

output {
  if [type] == "bro_files" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_ftp.conf0100777000000000000000000000310612712674274010332 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for ftp.log from Bro systems
input {
  file {
    type => "bro_ftp"
    sincedb_path => "/var/tmp/.bro_ftp_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/ftp.log"
  }
}

filter {
  if [type] == "bro_ftp" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Username","Password","Command","Argument","MIMEType","FileSize","ReplyCode","ReplyMessage","DataChannelPassive","DataChannelSourceIP","DataChannelDestinationIP","DataChannelDestinationPort","fuid"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
      convert => [ "DataChannelDestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }	
}

output {
  if [type] == "bro_ftp" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}

bro_http.conf0100777000000000000000000000721012712674274010520 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for http.log from Bro systems
input {
  file {
    type => "bro_http"
    sincedb_path => "/var/tmp/.bro_http_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/http_eth1.log"
  }
}

filter {
  if [type] == "bro_http" {
    grok {
      match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<SourceIP>(.*?))\t(?<SourcePort>(.*?))\t(?<DestinationIP>(.*?))\t(?<DestinationPort>(.*?))\t(?<TransDepth>(.*?))\t(?<Method>(.*?))\t(?<VirtualHost>(.*?))\t(?<URI>(.*?))\t(?<referrer>(.*?))\t(?<UserAgent>(.*?))\t(?<RequestBodyLength>(.*?))\t(?<ResponseBodyLength>(.*?))\t(?<StatusCode>(.*?))\t(?<StatusMessage>(.*?))\t(?<InfoCode>(.*?))\t(?<InfoMessage>(.*?))\t(?<filename>(.*))\t(?<tags>(.*))\t(?<Username>(.*))\t(?<Password>(.*))\t(?<proxied>(.*))\t(?<orig_fuids>(.*))\t(?<orig_mime_types>(.*))\t(?<resp_fuids>(.*))\t(?<resp_mime_types>(.*))" ]
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
      convert => [ "TransDepth", "integer" ]
      convert => [ "RequestBodyLength", "integer" ]
      convert => [ "ResponseBodyLength", "integer" ]
      convert => [ "StatusCode", "integer" ]
      convert => [ "InfoCode", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
    # If SourceIP is set try to do a geoip lookup.  This will only save a geoip if the SourceIP is not a private IP address
    if [SourceIP] and [type] == "bro_http" {
      geoip {
        source => "[SourceIP]"
	target => "SourceGeo"
      }
    }
    # If DestinationIP is set try to do a geoip lookup.  This will only save a geopip if the DestinationIP is not a private IP address
    if [DestinationIP] and [type] == "bro_http"  {
      geoip {
        source => "[DestinationIP]"
	target => "DestinationGeo"
      }
    }
    mutate {
      add_field => { "DestinationIPResolved" => "%{DestinationIP}" }
    }
    dns {
      reverse => [ "[DestinationIPResolved]" ]
      action => "replace"
    }
    mutate {
      add_field => { "SourceIPResolved" => "%{SourceIP}" }
    }
    dns {
      reverse => [ "[SourceIPResolved]" ]
      action => "replace"
    }

    # If uri exists run a frequency analysis against it.  In order for this to work you must have
    # freq.py and the corresponding frequency table in /opt/freq/.  This is a huge boost to security
    # and I highly recommend you set this up.  Example, if a frequency score less than 6 exists
    # then there is a likelihood that something malicious is happening.
    #
    # For higher accuracy, please generate your own frequency tables.  For questions on setup,
    # please refer to https://github.com/SMAPPER
    if [VirtualHost]{
      ruby {
       code => "freq_query = URI.escape(event['VirtualHost']); event['FrequencyScore'] = `/usr/bin/curl -s http://127.0.0.1:10002?cmd=measure\\&tgt=#{freq_query}`"
      }
      mutate {
        convert => [ "FrequencyScore", "float" ]
      }
    }
  }
}

output {
  if [type] == "bro_http" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_irc.conf0100777000000000000000000000264112712674274010321 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for irc.log from Bro systems
input {
  file {
    type => "bro_irc"
    sincedb_path => "/var/tmp/.bro_irc_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/irc.log"
  }
}

filter {
  if [type] == "bro_irc" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Nick","Username","Command","Value","Additional","DCCFileName","DCCFileSize","DCCMIMEType","fuid"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
	  convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }	
}

output {
  if [type] == "bro_irc" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_kerberos.conf0100777000000000000000000000326512712674274011363 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for kerberos.log from Bro systems
input {
  file {
    type => "bro_kerberos"
    start_position => "end"
    sincedb_path => "/var/tmp/.bro_kerberos_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/kerberos.log"
  }
}

filter {
  if [type] == "bro_kerberos" {
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","RequestType","Client","Service","Success","ErrorMessage","From","Till","Cipher","Forwardable","Renewable","ClientCertificateSubject","ClientCertificateUID","ServerCertificateSubject","ServerCertificateFUID"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SrcPort", "integer" ]
      convert => [ "DstPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }
}

output {
  if [type] == "bro_kerberos" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_notice.conf0100777000000000000000000000451012712674274011022 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for notice.log from Bro systems
input {
  file {
    type => "bro_notice"
    start_position => "end"
    sincedb_path => "/var/tmp/.bro_notice_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/notice.log"
  }
}

filter {
  if [type] == "bro_notice" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","fuid","FileMIMEType","FileDescription","Protocol","Note","Message","SubMessage","src","dst","p","n","PeerDescription","Actions","SuppressFor","Dropped","DestinationCountryCode","DestinationRegion","DestinationCity","DestinationLatitude","DestinationLongitude"]
      separator => "	"
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SrcPort", "integer" ]
      convert => [ "DstPort", "integer" ]
      convert => [ "p", "integer" ]
      convert => [ "n", "integer" ]
      convert => [ "SuppressFor", "float" ]
    }
    if [SourceIP] == "-" {
      mutate {
        remove_field => ["SourceIP"]
      }
    }
    if [DestinationIP] == "-" {
      mutate {
        remove_field => ["DestinationIP"]
      }
    }
    if [SourcePort] == "-" {
      mutate {
        remove_field => ["SourcePort"]
      }
    }
    if [DestinationPort] == "-" {
      mutate {
        remove_field => ["DestinationPort"]
      }
    }

    if [SourceIP] {
      geoip {
        source => "SourceIP"
	target => "SourceGeo"
      }
    }
    if [DestinationIP]{
      geoip {
        source => "DestinationIP"
	target => "DestinationGeo"
      }
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }
}

output {
  if [type] == "bro_notice" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_signatures.conf0100777000000000000000000000321612712674274011727 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for signatures.log from Bro systems
input {
  file {
    type => "bro_signatures"
    sincedb_path => "/var/tmp/.bro_signatures_sincedb"
 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/signatures.log"
  }
}

filter {
  if [type] == "bro_signatures" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Note","SignatureID","EventMessage","SubMessage","SignatureCount","HostCount"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
	  convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
    if [SourceIP] {
      geoip {
        source => "SourceIP"
	target => "SourceGeo"
      }
    }
    if [DestinationIP]{
      geoip {
        source => "DestinationIP"
	target => "DestinationGeo"
      }
    }
  }	
}

output {
  if [type] == "bro_signatures" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_smtp.conf0100777000000000000000000000414012712674274010523 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for smtp.log from Bro systems
input {
  file {
    type => "bro_smtp"
    start_position => "end"
    sincedb_path => "/var/tmp/.bro_smtp_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/smtp.log"
  }
}

filter {
  if [type] == "bro_smtp" {
    grok {
      match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<SourceIP>(.*?))\t(?<SourcePort>(.*?))\t(?<DestinationIP>(.*?))\t(?<DestinationPort>(.*?))\t(?<TransDepth>(.*?))\t(?<HELO>(.*?))\t(?<MailFrom>(.*?))\t(?<RecipientTo>(.*?))\t(?<Date>(.*?))\t(?<From>(.*?))\t(?<To>(.*?))\t(?<ReplyTo>(.*?))\t(?<MessageID>(.*?))\t(?<InReplyTo>(.*?))\t(?<Subject>(.*?))\t(?<XOriginatingIP>(.*?))\t(?<FirstReceived>(.*))\t(?<SecondReceived>(.*))\t(?<LastReply>(.*))\t(?<Path>(.*))\t(?<UserAgent>(.*))\t(?<TLS>(.*))\t(?<fuids>(.*))\t(?<IsWebmail>(.*))" ]
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SrcPort", "integer" ]
      convert => [ "DstPort", "integer" ]
    }
    if [SourceIP] {
      geoip {
        source => "SourceIP"
        target => "SourceGeo"
      }
    }
    if [DestinationIP]{
      geoip {
        source => "DestinationIP"
        target => "DestinationGeo"
      }
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }
}

output {
  if [type] == "bro_smtp" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_snmp.conf0100777000000000000000000000267612712674274010531 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for snmp.log from Bro systems
input {
  file {
    type => "bro_snmp"
    sincedb_path => "/var/tmp/.bro_snmp_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/snmp.log"
  }
}

filter {
  if [type] == "bro_snmp" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Duration","Version","Community","GetRequests","GetBulkRequests","GetResponses","SetResponses","DisplayString","UpSince"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
	  convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }	
}

output {
  if [type] == "bro_snmp" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_software.conf0100777000000000000000000000260412712674274011375 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for software.log from Bro systems
input {
  file {
    type => "bro_software"
    sincedb_path => "/var/tmp/.bro_software_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/software.log"
  }
}

filter {
  if [type] == "bro_software" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","SourceIP","SourcePort","SoftwareType","Name","VersionMajor","VersionMinor","VersionMinor2","VersionMinor3","VersionAdditionalInfo","UnparsedVersion"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }	
}

output {
  if [type] == "bro_software" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_ssh.conf0100777000000000000000000000347412712674274010346 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for ssh.log from Bro systems
input {
  file {
    type => "bro_ssh"
    start_position => "end"
    sincedb_path => "/var/tmp/.bro_ssh_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/ssh.log"
  }
}

filter {
  if [type] == "bro_ssh" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Version","AuthenticationSuccess","Direction","Client","Server","CipherAlgorithm","MacAlgorithm","CompressionAlgorithm","KexAlgorithm","HostKeyAlgorithm","HostKey","DestinationCountryCode","DestinationRegion","DestinationCity","DestinationLatitude","DestinationLongitude"]
      separator => "	"
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SrcPort", "integer" ]
      convert => [ "DstPort", "integer" ]
    }
    if [SourceIP] {
      geoip {
        source => "SourceIP"
	target => "SourceGeo"
      }
    }
    if [DestinationIP]{
      geoip {
        source => "DestinationIP"
	target => "DestinationGeo"
      }
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }
}

output {
  if [type] == "bro_ssh" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_ssl.conf0100777000000000000000000000770312712674274010351 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for ssl.log from Bro systems
input {
  file {
    type => "bro_ssl"
    sincedb_path => "/var/tmp/.bro_ssl_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/ssl.log"
  }
}

filter {
  if [type] == "bro_ssl" {
   # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Version","Cipher","Curve","ServerName","Resumed","LastAlert","NextProtocol","Established","cert_chain_fuids","client_cert_chain_fuids","Subject","Issuer","ClientSubject","ClientIssuer","ValidationStatus"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
     gsub => [
       "Subject", "\\\\,", "|"
     ]
    }
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "Subject"
    }
    mutate {
      rename => { "CN" => "SubjectCommonName"}
      rename => { "C" => "SubjectCountryCode"}
      rename => { "O" => "SubjectOrganization"}
      rename => { "OU" => "SubjectOrganizationUnit"}
      rename => { "ST" => "SubjectState"}
      rename => { "SN" => "SubjectSurname"}
      rename => { "L" => "SubjectLocality"}
      rename => { "DC" => "SubjectDistinguishedName"}
      rename => { "GN" => "SubjectGivenName"}
      rename => { "pseudonym" => "SubjectPseudonym"}
      rename => { "serialNumber" => "SubjectSerialNumber"}
      rename => { "title" => "SubjectTitle"}
      rename => { "initials" => "SubjectInitials"}
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
    # If CHANGE_ME exists run a frequency analysis against it.  In order for this to work you must have
    # freq.py and the corresponding frequency table in /opt/freq/.  This is a huge boost to security
    # and I highly recommend you set this up.  Example, if a frequency score less than 6 exists
    # then there is a likelihood that something malicious is happening.
    #
    # For higher accuracy, please generate your own frequency tables.  For questions on setup,
    # please refer to https://github.com/SMAPPER
    if [SubjectCommonName] or [ServerName] != "-"{
      if [ServerName] != "-" {
        ruby {
          code => "freq_query = URI.escape(event['ServerName']); event['FrequencyScore'] = `/usr/bin/curl -s http://127.0.0.1:10004?cmd=measure\\&tgt=#{freq_query}`"
        }
        mutate {
          convert => [ "FrequencyScore", "float" ]
        }
      } else {
        ruby {
          code => "freq_query = URI.escape(event['SubjectCommonName']); event['FrequencyScore'] = `/usr/bin/curl -s http://127.0.0.1:10004?cmd=measure\\&tgt=#{freq_query}`"
        }
        mutate {
          convert => [ "FrequencyScore", "float" ]
        }
      }
    }
    if [SourceIP] {
      geoip {
        source => "SourceIP"
        target => "SourceGeo"
      }
    }
    if [DestinationIP]{
      geoip {
        source => "DestinationIP"
        target => "DestinationGeo"
      }
    }
  }	
}

output {
  if [type] == "bro_ssl" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_syslog.conf0100777000000000000000000000257712712674274011074 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for syslog.log from Bro systems
input {
  file {
    type => "bro_syslog"
    sincedb_path => "/var/tmp/.bro_syslog_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/syslog.log"
  }
}

filter {
  if [type] == "bro_syslog" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Protocol","Facility","Severity","Message"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }	
}

output {
  if [type] == "bro_syslog" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_tunnel.conf0100777000000000000000000000255212712674274011052 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for tunnel.log from Bro systems
input {
  file {
    type => "bro_tunnel"
    sincedb_path => "/var/tmp/.bro_tunnel_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/tunnel.log"
  }
}

filter {
  if [type] == "bro_tunnel" {
    # This is the initial parsing of the log
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","TunnelType","Action"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    mutate {
      convert => [ "SourcePort", "integer" ]
      convert => [ "DestinationPort", "integer" ]
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }	
}

output {
  if [type] == "bro_tunnel" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_weird.conf0100777000000000000000000000416412712674274010660 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for weird.log from Bro systems
input {
  file {
    type => "bro_weird"
    start_position => "end"
    sincedb_path => "/var/tmp/.bro_weird_sincedb" 
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/weird.log"
  }
}

filter {
  if [type] == "bro_weird" {
    csv {
      columns => ["ts","uid","SourceIP","SourcePort","DestinationIP","DestinationPort","Name","AdditionalInfo","Notice","Peer"]
      separator => "	"
    }
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    # I recommend changing the field types below to integer so searches can do greater than or less than
    # and also so math functions can be ran against them
    mutate {
      convert => [ "SrcPort", "integer" ]
      convert => [ "DstPort", "integer" ]
    }
    if [SourceIP] == "-" {
      mutate {
        remove_field => ["SourceIP"]
      }
    }
    if [DestinationIP] == "-" {
      mutate {
        remove_field => ["DestinationIP"]
      }
    }
    if [SourceIP] {
      geoip {
        source => "SourceIP"
        target => "SourceGeo"
      }
    }
    if [DestinationIP] {
      geoip {
        source => "DestinationIP"
        target => "DestinationGeo"
      }
    }
    if [SourcePort] == "-" {
      mutate {
        replace => [ "SourcePort", "0" ]
      }
    }
    if [DestinationPort] == "-" {
      mutate {
        replace => [ "DestinationPort", "0" ]
      }
    }
    date {
      match => [ "ts", "UNIX" ]
    }
  }
}

output {
  if [type] == "bro_weird" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}
bro_x509.conf0100777000000000000000000001034212712674274010246 0ustar00# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 5/5/2016
#
# This conf file is based on accepting logs for x509.log from Bro systems
input {
  file {
    type => "bro_x509"
    sincedb_path => "/var/tmp/.bro_x509_sincedb"
    # Edit the following path to reflect the location of your log files. You can also change the extension if you use something else
    path => "/nsm/bro/logs/current/x509.log"
  }
}

filter {
  if [type] == "bro_x509" {
   # This is the initial parsing of the log
    grok { 
      match => [ "message", "(?<ts>(.*?))\t(?<id>(.*?))\t(?<CertificateVersion>(.*?))\t(?<CertificateSerial>(.*?))\t(?<CertificateSubject>(.*?))\t(?<CertificateIssuer>(.*?))\t(?<CertificateNotValidBefore>(.*?))\t(?<CertificateNotValidAfter>(.*?))\t(?<CertificateKeyAlgorithm>(.*?))\t(?<CertificateSigningAlgorithm>(.*))\t(?<CertificateKeyType>(.*))\t(?<CertificateKeyLength>(.*))\t(?<CertificateExponent>(.*))\t(?<CertificateCurve>(.*))\t(?<SANDNS>(.*))\t(?<SANURI>(.*))\t(?<SANEmail>(.*))\t(?<SANIP>(.*))\t(?<BasicConstraintsCA>(.*))\t(?<BasicConstraintsPathLength>(.*))" ]
    }
    mutate {
      gsub => [
        "CertificateIssuer", "\\\\,", "|"
      ]
      gsub => [
        "CertificateSubject", "\\\\,", "|"
      ]
    }
	
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "DC", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "CertificateIssuer"
    }
    mutate {
      rename => { "CN" => "IssuerCommonName"}
      rename => { "C" => "IssuerCountryCode"}
      rename => { "O" => "IssuerOrganization"}
      rename => { "OU" => "IssuerOrganizationUnit"}
      rename => { "ST" => "IssuerState"}
      rename => { "SN" => "IssuerSurname"}
      rename => { "L" => "IssuerLocality"}
      rename => { "DC" => "IssuerDistinguishedName"}
      rename => { "GN" => "IssuerGivenName"}
      rename => { "pseudonym" => "IssuerPseudonym"}
      rename => { "serialNumber" => "IssuerSerialNumber"}
      rename => { "title" => "IssuerTitle"}
      rename => { "initials" => "IssuerInitials"}
    }
    kv {
      include_keys => [ "CN", "C", "O", "OU", "ST", "SN", "L", "GN", "pseudonym", "serialNumber", "title", "initials" ]
      field_split => ","
      source => "CertificateSubject"
    }
    mutate {
      rename => { "CN" => "SubjectCommonName"}
      rename => { "C" => "SubjectCountryCode"}
      rename => { "O" => "SubjectOrganization"}
      rename => { "OU" => "SubjectOrganizationUnit"}
      rename => { "ST" => "SubjectState"}
      rename => { "SN" => "SubjectSurname"}
      rename => { "L" => "SubjectLocality"}
      rename => { "GN" => "SubjectGivenName"}
      rename => { "pseudonym" => "SubjectPseudonym"}
      rename => { "serialNumber" => "SubjectSerialNumber"}
      rename => { "title" => "SubjectTitle"}
      rename => { "initials" => "SubjectInitials"}
    }
	
    # Replace the host field with the host found in the bro log
    if [bro_host] {
      mutate {
        replace => [ "host", "%{bro_host}" ]
      }
    }
    date {
      match => [ "ts", "UNIX" ]
    }
    # If SubjectCommonName exists run a frequency analysis against it.  In order for this to work you must have
    # freq.py and the corresponding frequency table in /opt/freq/.  This is a huge boost to security
    # and I highly recommend you set this up.  Example, if a frequency score less than 6 exists
    # then there is a likelihood that something malicious is happening.
    #
    # For higher accuracy, please generate your own frequency tables.  For questions on setup,
    # please refer to https://github.com/SMAPPER
    if [SubjectCommonName]{
      ruby {
       code => "freq_query = URI.escape(event['SubjectCommonName']); event['FrequencyScore'] = `/usr/bin/curl -s http://127.0.0.1:10004?cmd=measure\\&tgt=#{freq_query}`"
      }
      mutate {
        convert => [ "FrequencyScore", "float" ]
      }
    }
  }
}


output {
  if [type] == "bro_x509" {
    #stdout { codec => rubydebug }
    elasticsearch {
      # Due to the volume of bro logs I like to save them to a seperate index.  This makes it easy to change retention
      # You can uncomment the index line below if you would like all logs to be in the same logstash index
      index => "logstash-bro-%{+YYYY.MM.dd}"
    }
  }
}