telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

prepare for mailoney json logging

Browse Source
This commit is contained in:
t3chn0m4g3
2020-01-22 12:17:30 +00:00
parent a470a7b12f
commit f110eb08b0
3 changed files with 56 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docker/elk/logstash/dist/logstash.conf vendored
View File

@ -101,6 +101,7 @@ input {
# Mailoney
file {
path => ["/data/mailoney/log/commands.log"]
codec => json
type => "Mailoney"
}
@ -344,18 +345,14 @@ filter {
# Mailoney
if [type] == "Mailoney" {
grok {
match => [ "message", "\A%{NAGIOSTIME}\[%{IPV4:src_ip}:%{INT:src_port:integer}] %{GREEDYDATA:smtp_input}" ]
date {
match => [ "timestamp", "ISO8601" ]
}
mutate {
add_field => {
"dest_port" => "25"
}
}
date {
match => [ "nagios_epoch", "UNIX" ]
remove_field => ["nagios_epoch"]
}
}
# Medpot