pfSense Graylog Pipeline Rules

This repository contains pfSense related graylog pipeline rules.

Graylog doesn't support pipeline in content packs yet, in the future this will become a content pack. #4222

Getting Started

Install syslog-ng package

• Services/syslog-ng/General Enable the service, set Interface to your LAN and port 5140
• Services/syslog-ng/Advanced Add:
• Object Type: Destination, Object Name: graylog

{ syslog("[your_graylog_ip]" transport(udp) port(514)); };

• Object Type: Log, Object Name: sent_to_graylog

{ source(_DEFAULT); destination(graylog); };

• Status/System Logs/Settings Enable Remote Logging, Source Address LAN, IPv4, Remote Log Server [your_pfsense_lan_ip]:5140, and select Everything

Create a new stream

Example:

• Field source must match exactly pfsense
• Field application_name must match exactly filterlog

Create the pipeline rules

• System/Pipelines/Manage rules
• Copy/paste this repository txt files one on each rule

Create the pipeline

• System/Pipelines/Manage pipelines/Add a new pipeline
• Edit connections and select the stream you created
• Edit stage 0 and add all pfsense rules you created

Additional scripts

generate_fields_from_csv.awk will help you to generate new rules based on existing CSV extractors.

Example

$ echo "RuleNumber,SubRuleNumber,Anchor,Tracker,Interface,Reason,Action,Direction,IPVersion,Class,FlowLabel,HopLimit,Protocol,ProtocolID,Length,SourceIP,DestIP,SourcePort,DestPort,DataLength" | ./generate_fields_from_csv.awk 
  set_field("RuleNumber", m[0]);
  set_field("SubRuleNumber", m[1]);
  set_field("Anchor", m[2]);
  set_field("Tracker", m[3]);
  set_field("Interface", m[4]);
  set_field("Reason", m[5]);
  set_field("Action", m[6]);
  set_field("Direction", m[7]);
  set_field("IPVersion", m[8]);
  set_field("Class", m[9]);
  set_field("FlowLabel", m[10]);
  set_field("HopLimit", m[11]);
  set_field("Protocol", m[12]);
  set_field("ProtocolID", m[13]);
  set_field("Length", m[14]);
  set_field("SourceIP", m[15]);
  set_field("DestIP", m[16]);
  set_field("SourcePort", m[17]);
  set_field("DestPort", m[18]);
  set_field("DataLength", m[19]);

Authors

• Wagner Sartori Junior - Initial work - trunet

Contributors

Some of these rules were ported from:

• https://github.com/Hobadee/Graylog_Extractors_pfSense

License

This project is licensed under the GPL License - see the COPYING.md file for details