Add barracuda/0.1.0 integration (snapshot)

packages/barracuda/0.1.0/dataset/waf/elasticsearch/ingest_pipeline/default.yml

@@ -0,0 +1,55 @@
+---
+description: Pipeline for Barracuda Web Application Firewall
+
+processors:
+  # User agent
+  - user_agent:
+        field: user_agent.original
+        ignore_missing: true
+  # IP Geolocation Lookup
+  - geoip:
+        field: source.ip
+        target_field: source.geo
+        ignore_missing: true
+  - geoip:
+        field: destination.ip
+        target_field: destination.geo
+        ignore_missing: true
+
+  # IP Autonomous System (AS) Lookup
+  - geoip:
+        database_file: GeoLite2-ASN.mmdb
+        field: source.ip
+        target_field: source.as
+        properties:
+            - asn
+            - organization_name
+        ignore_missing: true
+  - geoip:
+        database_file: GeoLite2-ASN.mmdb
+        field: destination.ip
+        target_field: destination.as
+        properties:
+            - asn
+            - organization_name
+        ignore_missing: true
+  - rename:
+        field: source.as.asn
+        target_field: source.as.number
+        ignore_missing: true
+  - rename:
+        field: source.as.organization_name
+        target_field: source.as.organization.name
+        ignore_missing: true
+  - rename:
+        field: destination.as.asn
+        target_field: destination.as.number
+        ignore_missing: true
+  - rename:
+        field: destination.as.organization_name
+        target_field: destination.as.organization.name
+        ignore_missing: true
+on_failure:
+  - append:
+        field: error.message
+        value: "{{ _ingest.on_failure_message }}"

packages/barracuda/0.1.0/dataset/waf/fields/base-fields.yml

@@ -0,0 +1,16 @@
+- name: dataset.type
+  type: constant_keyword
+  description: >
+    Dataset type.
+- name: dataset.name
+  type: constant_keyword
+  description: >
+    Dataset name.
+- name: dataset.namespace
+  type: constant_keyword
+  description: >
+    Dataset namespace.
+- name: "@timestamp"
+  type: date
+  description: >
+    Event timestamp.