Multiple bugfixes, add dashboard

2020-03-27 14:53:04 -07:00
parent 242e1a7cf3
commit 34d8a39c43
9 changed files with 312 additions and 192 deletions
--- a/Vagrant/resources/splunk_server/transforms.conf
+++ b/Vagrant/resources/splunk_server/transforms.conf
@@ -8,3 +8,13 @@ FORMAT = host::$1
 DEST_KEY = MetaData:Host
 REGEX = (?m)ComputerName=(.+)
 FORMAT = host::$1
+
+[osquery_hostidentifier_as_host]
+DEST_KEY = MetaData:Host
+REGEX = hostIdentifier\"\:\"([^\"]+)\"
+FORMAT = host::$1
+
+[setnull]
+REGEX = Error\scasting
+DEST_KEY = queue
+FORMAT = nullQueue