telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

tweaking, bump elastic stack to 7.14.1, rebuild dashboards

Browse Source
This commit is contained in:
t3chn0m4g3
2021-09-15 15:58:44 +00:00
parent 00457b8b70
commit 9de1bdd0b5
7 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docker/elk/logstash/dist/logstash.conf vendored
View File

@ -314,6 +314,14 @@ filter {
}
}
# Ddospot
if [type] == "Ddospot" {
date {
match => [ "time", "yyyy-MM-dd HH:mm:ss.SSSSSS" ]
remove_field => ["time"]
}
}
# Dionaea
if [type] == "Dionaea" {
date {
@ -534,18 +542,20 @@ filter {
# Drop if parse fails
if "_grokparsefailure" in [tags] { drop {} }
if "_jsonparsefailure" in [tags] { drop {} }
# Add geo coordinates / ASN info / IP rep.
if [src_ip] {
geoip {
cache_size => 10000
source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.1.3-java/vendor/GeoLite2-City.mmdb"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.2-java/vendor/GeoLite2-City.mmdb"
}
geoip {
cache_size => 10000
source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.1.3-java/vendor/GeoLite2-ASN.mmdb"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.2-java/vendor/GeoLite2-ASN.mmdb"
}
translate {
refresh_interval => 86400
@ -576,6 +586,11 @@ if "_grokparsefailure" in [tags] { drop {} }
convert => { "id" => "string" }
}
}
if [request] {
mutate {
convert => { "request" => "string" }
}
}
# Add T-Pot hostname and external IP
# if [type] == "Adbhoney" or [type] == "Ciscoasa" or [type] == "CitrixHoneypot" or [type] == "ConPot" or [type] == "Cowrie" or [type] == "Dicompot" or [type] == "Dionaea" or [type] == "ElasticPot" or [type] == "Fatt" or [type] == "Glutton" or [type] == "Honeysap" or [type] == "Honeytrap" or [type] == "Heralding" or [type] == "Honeypy" or [type] == "Ipphoney" or [type] == "Mailoney" or [type] == "Medpot" or [type] == "P0f" or [type] == "Rdpy" or [type] == "Suricata" or [type] == "Tanner" {