notice.log seems to have community ID on it now, so parsing that

cisagov · Mar 25, 2024 · 05a38d2 · 05a38d2
1 parent 84c68b5
commit 05a38d2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/logstash/pipelines/zeek/11_zeek_parse.conf b/logstash/pipelines/zeek/11_zeek_parse.conf
@@ -2384,7 +2384,7 @@ filter {
         id => "dissect_zeek_notice_with_all_fields"
         # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
         mapping => {
-          "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][fuid]}	%{[zeek_cols][file_mime_type]}	%{[zeek_cols][file_desc]}	%{[zeek_cols][proto]}	%{[zeek_cols][note]}	%{[zeek_cols][msg]}	%{[zeek_cols][sub]}	%{[zeek_cols][src]}	%{[zeek_cols][dst]}	%{[zeek_cols][p]}	%{[zeek_cols][n]}	%{[zeek_cols][peer_descr]}	%{[zeek_cols][actions]}	%{[zeek_cols][email_dest]}	%{[zeek_cols][suppress_for]}	%{[zeek_cols][remote_location_country_code]}	%{[zeek_cols][remote_location_region]}	%{[zeek_cols][remote_location_city]}	%{[zeek_cols][remote_location_latitude]}	%{[zeek_cols][remote_location_longitude]}"
+          "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][fuid]}	%{[zeek_cols][file_mime_type]}	%{[zeek_cols][file_desc]}	%{[zeek_cols][proto]}	%{[zeek_cols][note]}	%{[zeek_cols][msg]}	%{[zeek_cols][sub]}	%{[zeek_cols][src]}	%{[zeek_cols][dst]}	%{[zeek_cols][p]}	%{[zeek_cols][n]}	%{[zeek_cols][peer_descr]}	%{[zeek_cols][actions]}	%{[zeek_cols][email_dest]}	%{[zeek_cols][suppress_for]}	%{[zeek_cols][remote_location_country_code]}	%{[zeek_cols][remote_location_region]}	%{[zeek_cols][remote_location_city]}	%{[zeek_cols][remote_location_latitude]}	%{[zeek_cols][remote_location_longitude]}	%{[zeek_cols][community_id]}"
         }
       }
       if ("_dissectfailure" in [tags]) {
@@ -2395,7 +2395,7 @@ filter {
         }
         ruby {
           id => "ruby_zip_zeek_notice"
-          init => "@zeek_notice_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'fuid', 'file_mime_type', 'file_desc', 'proto', 'note', 'msg', 'sub', 'src', 'dst', 'p', 'n', 'peer_descr', 'actions', 'email_dest', 'suppress_for', 'remote_location_country_code', 'remote_location_region', 'remote_location_city', 'remote_location_latitude', 'remote_location_longitude' ]"
+          init => "@zeek_notice_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'fuid', 'file_mime_type', 'file_desc', 'proto', 'note', 'msg', 'sub', 'src', 'dst', 'p', 'n', 'peer_descr', 'actions', 'email_dest', 'suppress_for', 'remote_location_country_code', 'remote_location_region', 'remote_location_city', 'remote_location_latitude', 'remote_location_longitude', 'community_id' ]"
           code => "event.set('[zeek_cols]', @zeek_notice_field_names.zip(event.get('[message]')).to_h)"
         }
       }