Rules (XIF)
[MODEL:dataset = "shodan_banner_raw"]
alter
has_triggers_obj = object_create("has_triggers",has_triggers),
expires_obj = object_create("expires",expires),
expiration_obj = object_create("expiration",expiration),
triggers_obj = object_create("triggers",replex(triggers,"[\\\"]","")),
internal_ipv4 = arrayindex(regextract(json_extract(filters,"$.ip"),"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0)
| alter
xdm.alert.name = name,
xdm.session_context_id = id,
xdm.event.description = filters,
xdm.alert.description = object_merge(triggers_obj,has_triggers_obj,expires_obj,expiration_obj),
xdm.target.host.ipv4_addresses = arraycreate(internal_ipv4),
xdm.event.type = "NETWORK";
Schema
shodan_banner_raw
| Field |
Type |
Array? |
created |
datetime |
— |
expiration |
string |
— |
expires |
int |
— |
filters |
string |
— |
has_triggers |
boolean |
— |
id |
string |
— |
name |
string |
— |
notifiers |
string |
— |
size |
int |
— |
triggers |
string |
— |
Raw JSON
{
"shodan_banner_raw": {
"name": {
"type": "string",
"is_array": false
},
"expiration": {
"type": "string",
"is_array": false
},
"id": {
"type": "string",
"is_array": false
},
"size": {
"type": "int",
"is_array": false
},
"created": {
"type": "datetime",
"is_array": false
},
"expires": {
"type": "int",
"is_array": false
},
"filters": {
"type": "string",
"is_array": false
},
"triggers": {
"type": "string",
"is_array": false
},
"notifiers": {
"type": "string",
"is_array": false
},
"has_triggers": {
"type": "boolean",
"is_array": false
}
}
}