telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

prep for ipphoney

Browse Source
This commit is contained in:
t3chn0m4g3
2020-08-24 21:36:08 +00:00
parent 8f06b5b499
commit b86d2c715b
7 changed files with 57 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
docker/elk/logstash/dist/logstash.conf vendored
View File

@ -112,6 +112,13 @@ input {
type => "Honeytrap"
}
# Ipphoney
file {
path => ["/data/ipphoney/log/ipphoney.json"]
codec => json
type => "Ipphoney"
}
# Mailoney
file {
path => ["/data/mailoney/log/commands.log"]
@ -415,6 +422,24 @@ filter {
}
}
# Ipphoney
if [type] == "Ipphoney" {
date {
match => [ "timestamp", "ISO8601" ]
}
mutate {
rename => {
"content_type" => "http.http_content_type"
"dst_port" => "dest_port"
"dst_ip" => "dest_ip"
"request" => "request_method"
"operation" => "data"
"user_agent" => "http_user_agent"
"url" => "http.url"
}
}
}
# Mailoney
if [type] == "Mailoney" {
date {
@ -518,7 +543,7 @@ if "_grokparsefailure" in [tags] { drop {} }
}
# Add T-Pot hostname and external IP
if [type] == "Adbhoney" or [type] == "Ciscoasa" or [type] == "CitrixHoneypot" or [type] == "ConPot" or [type] == "Cowrie" or [type] == "Dicompot" or [type] == "Dionaea" or [type] == "ElasticPot" or [type] == "Fatt" or [type] == "Glutton" or [type] == "Honeysap" or [type] == "Honeytrap" or [type] == "Heralding" or [type] == "Honeypy" or [type] == "Mailoney" or [type] == "Medpot" or [type] == "P0f" or [type] == "Rdpy" or [type] == "Suricata" or [type] == "Tanner" {
if [type] == "Adbhoney" or [type] == "Ciscoasa" or [type] == "CitrixHoneypot" or [type] == "ConPot" or [type] == "Cowrie" or [type] == "Dicompot" or [type] == "Dionaea" or [type] == "ElasticPot" or [type] == "Fatt" or [type] == "Glutton" or [type] == "Honeysap" or [type] == "Honeytrap" or [type] == "Heralding" or [type] == "Honeypy" or [type] == "Ipphoney" or [type] == "Mailoney" or [type] == "Medpot" or [type] == "P0f" or [type] == "Rdpy" or [type] == "Suricata" or [type] == "Tanner" {
mutate {
add_field => {
"t-pot_ip_ext" => "${MY_EXTIP}"