trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #601 from mdtro/fix-zeek-props

Browse Source 
Add Custom props.conf for Zeek Splunk TA
This commit is contained in:
Chris Long
2021-02-09 08:45:05 -08:00
committed by GitHub
parent 872a4284e6 a422ad8442
commit a4eae82f3e
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Vagrant/logger_bootstrap.sh
View File

@@ -195,6 +195,10 @@ install_splunk() {
cp /vagrant/resources/splunk_server/windows_ta_props.conf /opt/splunk/etc/apps/Splunk_TA_windows/default/props.conf cp /vagrant/resources/splunk_server/windows_ta_props.conf /opt/splunk/etc/apps/Splunk_TA_windows/default/props.conf
cp /vagrant/resources/splunk_server/sysmon_ta_props.conf /opt/splunk/etc/apps/TA-microsoft-sysmon/default/props.conf cp /vagrant/resources/splunk_server/sysmon_ta_props.conf /opt/splunk/etc/apps/TA-microsoft-sysmon/default/props.conf
# Add props.conf to Splunk Zeek TA to properly parse timestamp
# and avoid grouping events as a single event
cp /vagrant/resources/splunk_server/zeek_ta_props.conf /opt/splunk/etc/apps/Splunk_TA_bro/local/props.conf
# Add custom Macro definitions for ThreatHunting App # Add custom Macro definitions for ThreatHunting App
cp /vagrant/resources/splunk_server/macros.conf /opt/splunk/etc/apps/ThreatHunting/default/macros.conf cp /vagrant/resources/splunk_server/macros.conf /opt/splunk/etc/apps/ThreatHunting/default/macros.conf
# Fix props.conf in ThreatHunting App # Fix props.conf in ThreatHunting App

12
Vagrant/resources/splunk_server/zeek_ta_props.conf Normal file
View File

@@ -0,0 +1,12 @@
[zeek:json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Structured
description = Zeek JSON sourcetype with fixed timestamp parsing.
disabled = false
pulldown_type = true
TIMESTAMP_FIELDS = ts
TIME_FORMAT = %s.%6N