Graylog-OPNsense_Extractors_RFC5424.json

{
  "extractors": [
    {
      "title": "OPNsense: RFC5424 IPv4 TCP",
      "extractor_type": "regex",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,ip-flags,protocol-id,protocol-name,length,src-ip,dst-ip,src-port,dst-port,datalength,tcp-flags,sequence,f1,f2,tcp-options,opnsense-rid",
            "trim_leading_whitespace": true
          }
        }
      ],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "full_message",
      "target_field": "filterlog_ipv4_tcp",
      "extractor_config": {
        "regex_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\](.*)$"
      },
      "condition_type": "regex",
      "condition_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*,(in|out),4,.*,tcp,.*)$"
    },
    {
      "title": "OPNsense: RFC5424 IPv6 TCP",
      "extractor_type": "regex",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-name,length,src-ip,dst-ip,datalength",
            "trim_leading_whitespace": true
          }
        }
      ],
      "order": 1,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "filterlog_ipv6_tcp",
      "extractor_config": {
        "regex_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\](.*)$"
      },
      "condition_type": "regex",
      "condition_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*,(in|out),4,.*,tcp,.*)$"
    },
    {
      "title": "OPNsense: RFC5424 IPv4 UDP",
      "extractor_type": "regex",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-name,length,src-ip,dst-ip,src-port,dst-port,opnsense-rid",
            "trim_leading_whitespace": true
          }
        }
      ],
      "order": 2,
      "cursor_strategy": "copy",
      "source_field": "full_message",
      "target_field": "filterlog_ipv4_udp",
      "extractor_config": {
        "regex_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*)$"
      },
      "condition_type": "regex",
      "condition_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*,(in|out),4,.*,udp,.*)$"
    },
    {
      "title": "OPNsense: RFC5424 IPv4 ICMP",
      "extractor_type": "regex",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-name,length,src-ip,dst-ip,datalength"
          }
        }
      ],
      "order": 4,
      "cursor_strategy": "copy",
      "source_field": "full_message",
      "target_field": "filterlog_ipv4_icmp",
      "extractor_config": {
        "regex_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*)$"
      },
      "condition_type": "regex",
      "condition_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*,(in|out),4,.*,icmp,.*)$"
    },
    {
      "title": "OPNsense: RFC5424 IPv6 ICMP",
      "extractor_type": "regex",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-name,length,src-ip,dst-ip,datalength"
          }
        }
      ],
      "order": 5,
      "cursor_strategy": "copy",
      "source_field": "full_message",
      "target_field": "filterlog_ipv6_icmp",
      "extractor_config": {
        "regex_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*)$"
      },
      "condition_type": "regex",
      "condition_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*,(in|out),6,.*,icmp,.*)$"
    },
    {
      "title": "OPNsense:  RFC5424 IPv6 UDP",
      "extractor_type": "regex",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,class,flowlabel,hoplimit,protocol-name,protocol-id,length,src-ip,dst-ip,src-port,dst-port,opnsense-rid",
            "trim_leading_whitespace": true
          }
        }
      ],
      "order": 3,
      "cursor_strategy": "copy",
      "source_field": "full_message",
      "target_field": "filterlog_ipv6_udp",
      "extractor_config": {
        "regex_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*)$"
      },
      "condition_type": "regex",
      "condition_value": "^(?i).*\\sfilterlog\\s[0-9]+\\s.*\\[meta\\ssequenceid=\\\"[0-9]+\\\"\\]\\s(.*,(in|out),6,.*,udp,.*)$"
    }
  ],
  "version": "5.2.2"
}