Linux Events Collection Modeling Rule

Modeling Rule

Linux Events Collection

Details

IDLinux_Events_Collection_ModelingRule
From Version6.8.0
To Version6.9.9
TagsLinux Logs Collection Redhat Ubuntu

Rules (XIF)

[MODEL: dataset="linux_linux_raw", model="Auth"]
filter _time != null
/* Extracting and calculating facility & severity from PRI value */
| alter pri_value = to_integer(arrayindex(regextract(_raw_log , "^\<(\d{0,2})") ,0))
| alter facility_val = floor(divide(pri_value,8))
| alter severity_val = subtract(pri_value, multiply(facility_val, 8))
| alter severity = if(severity_val = 0        ,"Emergency" ,severity_val = 1        ,"Alert" ,severity_val = 2        ,"Critical" ,severity_val = 3        ,"Error" ,severity_val = 4        ,"Warning" ,severity_val = 5        ,"Notice" ,severity_val = 6        ,"Informational" ,severity_val = 7        ,"Debug")
| alter facility = if(facility_val = 0,        "kern" ,facility_val = 1,        "user" ,facility_val = 2,        "mail" ,facility_val = 3,        "daemon" ,facility_val = 4,        "auth" ,facility_val = 5,        "syslog" ,facility_val = 6,        "lpr" ,facility_val = 7,        "news" ,facility_val = 8,        "uucp" ,facility_val = 9,        "cron" ,facility_val = 10,        "authpriv" ,facility_val = 11,        "ftp" ,facility_val = 12,        "ntp" ,facility_val = 13,        "security" ,facility_val = 14,        "console" ,facility_val = 15,        "solaris-cron" ,facility_val = 16, "local")
/*---------------- END ----------------*/
| filter _log_source_file_name in("auth*", "secure") or facility_val in(4,10,13)
| alter current_year =  arrayindex(regextract(to_string(current_time()), "\d{4}"), 0)
| alter timestamp = arrayindex(regextract(_raw_log , "\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}"), 0)
| alter timestamp = format_string("%s %s", current_year , timestamp )
| alter hostname =  to_string(arrayindex(regextract(_raw_log , "\d{2}\S\d{2}\S\d{2}\s+(\w+)\s"), 0))
| alter process_name =  to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s([\w|\-\/]+)\[*"), 0))
| alter pid = to_integer(arrayindex(regextract(_raw_log , "^\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\w+\S*?(\d*)\]") ,0))
| alter event_description = to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\S+\:(.+$)") ,0))
| alter src_ip = to_string(arrayindex(regextract(_raw_log ,"\s(\d{1,3}(?:\.\d{1,3}){3})") ,0))

| alter XDM.Auth.event_timestamp = parse_timestamp("%Y %b %d %H:%M:%S", timestamp)
| alter XDM.Auth.Client.host.hostname = hostname
| alter XDM.Auth.Client.process.name = process_name
| alter XDM.Auth.Client.process.pid = pid
| alter XDM.Auth.original_event_description = event_description
| alter XDM.Auth.Client.ipv4 = src_ip;

[MODEL: dataset="linux_linux_raw", model="Endpoint"]
filter _time != null
/* Extracting and calculating facility & severity from PRI value */
| alter pri_value = to_integer(arrayindex(regextract(_raw_log , "^\<(\d{0,2})") ,0))
| alter facility_val = floor(divide(pri_value,8))
| alter severity_val = subtract(pri_value, multiply(facility_val, 8))
| alter severity = if(severity_val = 0        ,"Emergency" ,severity_val = 1        ,"Alert" ,severity_val = 2        ,"Critical" ,severity_val = 3        ,"Error" ,severity_val = 4        ,"Warning" ,severity_val = 5        ,"Notice" ,severity_val = 6        ,"Informational" ,severity_val = 7        ,"Debug")
| alter facility = if(facility_val = 0,        "kern" ,facility_val = 1,        "user" ,facility_val = 2,        "mail" ,facility_val = 3,        "daemon" ,facility_val = 4,        "auth" ,facility_val = 5,        "syslog" ,facility_val = 6,        "lpr" ,facility_val = 7,        "news" ,facility_val = 8,        "uucp" ,facility_val = 9,        "cron" ,facility_val = 10,        "authpriv" ,facility_val = 11,        "ftp" ,facility_val = 12,        "ntp" ,facility_val = 13,        "security" ,facility_val = 14,        "console" ,facility_val = 15,        "solaris-cron" ,facility_val = 16, "local")
/*---------------- END ----------------*/
| filter _log_source_file_name in("syslog*", "messages") or facility_val not in(4,10,13)

| alter current_year =  arrayindex(regextract(to_string(current_time()), "\d{4}"), 0)
| alter timestamp = arrayindex(regextract(_raw_log , "\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}"), 0)
| alter timestamp = format_string("%s %s", current_year , timestamp )
| alter hostname =  to_string(arrayindex(regextract(_raw_log , "\d{2}\S\d{2}\S\d{2}\s+(\w+)\s"), 0))
| alter process_name =  to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s([\w|\-\/]+)\[*"), 0))
| alter pid = to_integer(arrayindex(regextract(_raw_log , "^\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\w+\S*?(\d*)\]") ,0))
| alter event_description = to_string(arrayindex(regextract(_raw_log , "\w+\s{1,2}\d{1,2}\s\d{2}\S\d{2}\S\d{2}\s+\w+\s\S+\:(.+$)") ,0))
| alter src_ip = to_string(arrayindex(regextract(_raw_log ,"\s(\d{1,3}(?:\.\d{1,3}){3})") ,0))

| alter XDM.Endpoint.event_timestamp = parse_timestamp("%Y %b %d %H:%M:%S", timestamp)
| alter XDM.Endpoint.Target.host.hostname = hostname
| alter XDM.Endpoint.Target.process.name = process_name
| alter XDM.Endpoint.Target.process.pid = pid
| alter XDM.Endpoint.original_event_description = event_description
| alter XDM.Endpoint.original_event_sub_type = facility
| alter XDM.Endpoint.threat.severity = severity;

Schema

linux_linux_raw

Field Type Array?
_log_source_file_name string
_raw_log string
Raw JSON
{
  "linux_linux_raw": {
    "_raw_log": {
        "type": "string",
        "is_array": false
    },
    "_log_source_file_name": {
        "type": "string",
        "is_array": false
    }

  }
}