Add barracuda/0.1.0 integration (snapshot)

packages/barracuda/0.1.0/dataset/waf/elasticsearch/ingest_pipeline/default.yml

@@ -0,0 +1,55 @@
+---
+description: Pipeline for Barracuda Web Application Firewall
+
+processors:
+ # User agent
+ - user_agent:
+ field: user_agent.original
+ ignore_missing: true
+ # IP Geolocation Lookup
+ - geoip:
+ field: source.ip
+ target_field: source.geo
+ ignore_missing: true
+ - geoip:
+ field: destination.ip
+ target_field: destination.geo
+ ignore_missing: true
+
+ # IP Autonomous System (AS) Lookup
+ - geoip:
+ database_file: GeoLite2-ASN.mmdb
+ field: source.ip
+ target_field: source.as
+ properties:
+ - asn
+ - organization_name
+ ignore_missing: true
+ - geoip:
+ database_file: GeoLite2-ASN.mmdb
+ field: destination.ip
+ target_field: destination.as
+ properties:
+ - asn
+ - organization_name
+ ignore_missing: true
+ - rename:
+ field: source.as.asn
+ target_field: source.as.number
+ ignore_missing: true
+ - rename:
+ field: source.as.organization_name
+ target_field: source.as.organization.name
+ ignore_missing: true
+ - rename:
+ field: destination.as.asn
+ target_field: destination.as.number
+ ignore_missing: true
+ - rename:
+ field: destination.as.organization_name
+ target_field: destination.as.organization.name
+ ignore_missing: true
+on_failure:
+ - append:
+ field: error.message
+ value: "{{ _ingest.on_failure_message }}"

packages/barracuda/0.1.0/dataset/waf/fields/base-fields.yml

@@ -0,0 +1,16 @@
+- name: dataset.type
+ type: constant_keyword
+ description: >
+ Dataset type.
+- name: dataset.name
+ type: constant_keyword
+ description: >
+ Dataset name.
+- name: dataset.namespace
+ type: constant_keyword
+ description: >
+ Dataset namespace.
+- name: "@timestamp"
+ type: date
+ description: >
+ Event timestamp.