telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

prepare for new attack map feature

Browse Source 
tweaking, cleanup
This commit is contained in:
t3chn0m4g3
2022-01-04 16:16:27 +00:00
parent 0178b4c4d3
commit 788a4c4f98
7 changed files with 74 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
docker/elk/logstash/dist/logstash.conf vendored
View File

@ -664,6 +664,14 @@ filter {
if "_grokparsefailure" in [tags] { drop {} }
if "_jsonparsefailure" in [tags] { drop {} }
# Add T-Pot hostname and external IP
mutate {
add_field => {
"t-pot_ip_ext" => "${MY_EXTIP}"
"t-pot_ip_int" => "${MY_INTIP}"
"t-pot_hostname" => "${MY_HOSTNAME}"
}
}
# Add geo coordinates / ASN info / IP rep.
if [src_ip] {
@ -684,6 +692,20 @@ if "_jsonparsefailure" in [tags] { drop {} }
dictionary_path => "/etc/listbot/iprep.yaml"
}
}
if [t-pot_ip_ext] {
geoip {
cache_size => 10000
source => "t-pot_ip_ext"
target => "geoip_ext"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-City.mmdb"
}
geoip {
cache_size => 10000
source => "t-pot_ip_ext"
target => "geoip_ext"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-ASN.mmdb"
}
}
# In some rare conditions dest_port, src_port, status are indexed as string, forcing integer for now
if [dest_port] {
@ -712,15 +734,6 @@ if "_jsonparsefailure" in [tags] { drop {} }
}
}
# Add T-Pot hostname and external IP
mutate {
add_field => {
"t-pot_ip_ext" => "${MY_EXTIP}"
"t-pot_ip_int" => "${MY_INTIP}"
"t-pot_hostname" => "${MY_HOSTNAME}"
}
}
}
# Output section