mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
prepare for honeypy
This commit is contained in:
20
docker/elk/logstash/dist/logstash.conf
vendored
20
docker/elk/logstash/dist/logstash.conf
vendored
@ -76,6 +76,13 @@ input {
|
||||
type => "Heralding"
|
||||
}
|
||||
|
||||
# Honeypy
|
||||
file {
|
||||
path => ["/data/honeypy/log/json.log"]
|
||||
codec => json
|
||||
type => "Honeypy"
|
||||
}
|
||||
|
||||
# Honeytrap
|
||||
file {
|
||||
path => ["/data/honeytrap/log/attackers.json"]
|
||||
@ -266,6 +273,17 @@ filter {
|
||||
}
|
||||
}
|
||||
|
||||
# Honeypy
|
||||
if [type] == "Honeypy" {
|
||||
date {
|
||||
match => [ "timestamp", "ISO8601" ]
|
||||
remove_field => ["timestamp"]
|
||||
remove_field => ["date"]
|
||||
remove_field => ["time"]
|
||||
remove_field => ["millisecond"]
|
||||
}
|
||||
}
|
||||
|
||||
# Honeytrap
|
||||
if [type] == "Honeytrap" {
|
||||
date {
|
||||
@ -388,7 +406,7 @@ if "_grokparsefailure" in [tags] { drop {} }
|
||||
}
|
||||
|
||||
# Add T-Pot hostname and external IP
|
||||
if [type] == "Adbhoney" or [type] == "Ciscoasa" or [type] == "ConPot" or [type] == "Cowrie" or [type] == "Dionaea" or [type] == "ElasticPot" or [type] == "Glastopf" or [type] == "Glutton" or [type] == "Honeytrap" or [type] == "Heralding" or [type] == "Mailoney" or [type] == "Medpot" or [type] == "P0f" or [type] == "Rdpy" or [type] == "Suricata" or [type] == "Tanner" {
|
||||
if [type] == "Adbhoney" or [type] == "Ciscoasa" or [type] == "ConPot" or [type] == "Cowrie" or [type] == "Dionaea" or [type] == "ElasticPot" or [type] == "Glastopf" or [type] == "Glutton" or [type] == "Honeytrap" or [type] == "Heralding" or [type] == "Honeypy" or [type] == "Mailoney" or [type] == "Medpot" or [type] == "P0f" or [type] == "Rdpy" or [type] == "Suricata" or [type] == "Tanner" {
|
||||
mutate {
|
||||
add_field => {
|
||||
"t-pot_ip_ext" => "${MY_EXTIP}"
|
||||
|
Reference in New Issue
Block a user