Skip to content

Commit 124804b

Browse files
cwadhwani-splunkcwadhwani-splunk
authored
feat: Added support for vectra json logs (#2694)
* feat: Added support for vectra json logs * Empty commit for triggering workflow
1 parent 0998d28 commit 124804b

File tree

4 files changed

+553
-0
lines changed

4 files changed

+553
-0
lines changed

‎docs/sources/vendor/Vectra/cognito_json.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Cognito JSON
2+
3+
## Key facts
4+
5+
* MSG Format based filter
6+
* Legacy BSD Format default port 514
7+
8+
## Links
9+
10+
| Ref | Link |
11+
|----------------|---------------------------------------------------------------------------------------------------------|
12+
| Technology Add-On for Vectra Detect (JSON) | <https://splunkbase.splunk.com/app/5271> |
13+
14+
## Sourcetypes
15+
16+
| sourcetype | notes |
17+
|----------------|---------------------------------------------------------------------------------------------------------|
18+
|vectra:cognito:detect:json||
19+
|vectra:cognito:hostscoring:json||
20+
|vectra:cognito:hostdetect:json||
21+
|vectra:cognito:hostlockdown:json||
22+
|vectra:cognito:accountscoring:json||
23+
|vectra:cognito:accountdetect:json||
24+
|vectra:cognito:accountlockdown:json||
25+
|vectra:cognito:campaigns:json||
26+
|vectra:cognito:audit:json||
27+
|vectra:cognito:health:json||
28+
29+
### Index Configuration
30+
31+
| key | sourcetype | index | notes |
32+
|----------------|----------------|----------------|----------------|
33+
|vectra_cognito detect_detect |vectra:cognito:detect:json |main|
34+
|vectra_cognito detect_hostscoring |vectra:cognito:hostscoring:json |main|
35+
|vectra_cognito detect_hostdetect |vectra:cognito:hostdetect:json |main|
36+
|vectra_cognito detect_hostlockdown |vectra:cognito:hostlockdown:json |main|
37+
|vectra_cognito detect_accountscoring |vectra:cognito:accountscoring:json |main|
38+
|vectra_cognito detect_accountdetect |vectra:cognito:accountdetect:json |main|
39+
|vectra_cognito detect_accountlockdown |vectra:cognito:accountlockdown:json |main|
40+
|vectra_cognito detect_campaigns |vectra:cognito:campaigns:json |main|
41+
|vectra_cognito detect_audit |vectra:cognito:audit:json |main|
42+
|vectra_cognito detect_health |vectra:cognito:health:json |main|

‎package/etc/conf.d/conflib/syslog/app-syslog-vectra_json.conf‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
block parser app-syslog-vectra-json() {
2+
channel {
3+
parser {
4+
regexp-parser(
5+
prefix(".tmp.")
6+
patterns('\"vectra_timestamp\"\:\s\"(?<timestamp>[^\"]+)\"')
7+
template("$MESSAGE")
8+
);
9+
date-parser-nofilter(
10+
format('%s')
11+
template("${.tmp.timestamp}")
12+
);
13+
};
14+
15+
rewrite {
16+
subst('\-\:\s',"",value("MESSAGE"));
17+
};
18+
19+
rewrite {
20+
r_set_splunk_dest_default(
21+
index("main")
22+
sourcetype('vectra:cognito:detect:json')
23+
vendor("vectra")
24+
product("cognito detect")
25+
class('detect')
26+
template("t_msg_only")
27+
);
28+
};
29+
30+
if (message('\"host_\w+\"\:')) {
31+
rewrite {
32+
r_set_splunk_dest_update_v2(
33+
sourcetype('vectra:cognito:hostscoring:json')
34+
class('hostscoring')
35+
condition(message('\"HOST\sSCORING\"'))
36+
);
37+
};
38+
rewrite {
39+
r_set_splunk_dest_update_v2(
40+
sourcetype('vectra:cognito:hostdetect:json')
41+
class('hostdetect')
42+
condition(message('\"detection_id\"\:'))
43+
);
44+
};
45+
rewrite {
46+
r_set_splunk_dest_update_v2(
47+
sourcetype('vectra:cognito:hostlockdown:json')
48+
class('hostlockdown')
49+
condition(message('\"success\"\:'))
50+
);
51+
};
52+
} elif (message('\"account_uid\"\:')) {
53+
rewrite {
54+
r_set_splunk_dest_update_v2(
55+
sourcetype('vectra:cognito:accountscoring:json')
56+
class('accountscoring')
57+
condition(message('\"ACCOUNT\sSCORING\"'))
58+
);
59+
};
60+
rewrite {
61+
r_set_splunk_dest_update_v2(
62+
sourcetype('vectra:cognito:accountdetect:json')
63+
class('accountdetect')
64+
condition(message('\"detection_id\"\:'))
65+
);
66+
};
67+
rewrite {
68+
r_set_splunk_dest_update_v2(
69+
sourcetype('vectra:cognito:accountlockdown:json')
70+
class('accountlockdown')
71+
condition(message('\"success\"\:'))
72+
);
73+
};
74+
} elif (message('\"campaign_id\"\:')) {
75+
rewrite {
76+
r_set_splunk_dest_update_v2(
77+
sourcetype('vectra:cognito:campaigns:json')
78+
class('campaigns')
79+
);
80+
};
81+
} elif (message('\"role\"\:')) {
82+
rewrite {
83+
r_set_splunk_dest_update_v2(
84+
sourcetype('vectra:cognito:audit:json')
85+
class('audit')
86+
);
87+
};
88+
} elif (message('\"type\"\:')) {
89+
rewrite {
90+
r_set_splunk_dest_update_v2(
91+
sourcetype('vectra:cognito:health:json')
92+
class('health')
93+
);
94+
};
95+
} else {};
96+
};
97+
};
98+
99+
application app-syslog-vectra-json[sc4s-syslog-pgm] {
100+
filter {
101+
program('vectra_json' type(string) flags(prefix));
102+
};
103+
parser { app-syslog-vectra-json(); };
104+
};

‎package/lite/etc/addons/vectra/app-syslog-vectra_json.conf‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
block parser app-syslog-vectra-json() {
2+
channel {
3+
parser {
4+
regexp-parser(
5+
prefix(".tmp.")
6+
patterns('\"vectra_timestamp\"\:\s\"(?<timestamp>[^\"]+)\"')
7+
template("$MESSAGE")
8+
);
9+
date-parser-nofilter(
10+
format('%s')
11+
template("${.tmp.timestamp}")
12+
);
13+
};
14+
15+
rewrite {
16+
subst('\-\:\s',"",value("MESSAGE"));
17+
};
18+
19+
rewrite {
20+
r_set_splunk_dest_default(
21+
index("main")
22+
sourcetype('vectra:cognito:detect:json')
23+
vendor("vectra")
24+
product("cognito detect")
25+
class('detect')
26+
template("t_msg_only")
27+
);
28+
};
29+
30+
if (message('\"host_\w+\"\:')) {
31+
rewrite {
32+
r_set_splunk_dest_update_v2(
33+
sourcetype('vectra:cognito:hostscoring:json')
34+
class('hostscoring')
35+
condition(message('\"HOST\sSCORING\"'))
36+
);
37+
};
38+
rewrite {
39+
r_set_splunk_dest_update_v2(
40+
sourcetype('vectra:cognito:hostdetect:json')
41+
class('hostdetect')
42+
condition(message('\"detection_id\"\:'))
43+
);
44+
};
45+
rewrite {
46+
r_set_splunk_dest_update_v2(
47+
sourcetype('vectra:cognito:hostlockdown:json')
48+
class('hostlockdown')
49+
condition(message('\"success\"\:'))
50+
);
51+
};
52+
} elif (message('\"account_uid\"\:')) {
53+
rewrite {
54+
r_set_splunk_dest_update_v2(
55+
sourcetype('vectra:cognito:accountscoring:json')
56+
class('accountscoring')
57+
condition(message('\"ACCOUNT\sSCORING\"'))
58+
);
59+
};
60+
rewrite {
61+
r_set_splunk_dest_update_v2(
62+
sourcetype('vectra:cognito:accountdetect:json')
63+
class('accountdetect')
64+
condition(message('\"detection_id\"\:'))
65+
);
66+
};
67+
rewrite {
68+
r_set_splunk_dest_update_v2(
69+
sourcetype('vectra:cognito:accountlockdown:json')
70+
class('accountlockdown')
71+
condition(message('\"success\"\:'))
72+
);
73+
};
74+
} elif (message('\"campaign_id\"\:')) {
75+
rewrite {
76+
r_set_splunk_dest_update_v2(
77+
sourcetype('vectra:cognito:campaigns:json')
78+
class('campaigns')
79+
);
80+
};
81+
} elif (message('\"role\"\:')) {
82+
rewrite {
83+
r_set_splunk_dest_update_v2(
84+
sourcetype('vectra:cognito:audit:json')
85+
class('audit')
86+
);
87+
};
88+
} elif (message('\"type\"\:')) {
89+
rewrite {
90+
r_set_splunk_dest_update_v2(
91+
sourcetype('vectra:cognito:health:json')
92+
class('health')
93+
);
94+
};
95+
} else {};
96+
};
97+
};
98+
99+
application app-syslog-vectra-json[sc4s-syslog-pgm] {
100+
filter {
101+
program('vectra_json' type(string) flags(prefix));
102+
};
103+
parser { app-syslog-vectra-json(); };
104+
};

0 commit comments

Comments
 (0)