Add local directory

package/etc/conf.d/local/config/destinations/README.md

@@ -0,0 +1 @@
+This file exists to preserve the path for plugin use

package/etc/conf.d/local/config/filters/README.md

@@ -0,0 +1 @@
+This file exists to preserve the path for plugin use

package/etc/conf.d/local/config/filters/example.conf

@@ -0,0 +1,4 @@
+
+filter f_local_example {
+    program(sc4splugin);
+};

package/etc/conf.d/local/config/log_paths/README.md

@@ -0,0 +1 @@
+This file exists to preserve the path for plugin use

package/etc/conf.d/local/config/log_paths/example.conf.tmpl

@@ -0,0 +1,76 @@
+# LOCAL_EXAMPLE
+
+# When creating a real plugin, replace the upper case text "LOCAL_EXAMPLE" throughout this file with a unique 
+# string to identify the vendor product.  The string should be of the form "VENDOR_PRODUCT" to signify the
+# manufacturer and product type, and must contain only characters matching this regex: [A-Z\_]+
+
+# If any of the "LOCAL_EXAMPLE" variables passed into the environment are set (e.g. TLS, UDP, or TLS),
+# the template generator will build a custom source based on the value of one or more of the set variables.
+
+{{- if (ne (getenv (print "SC4S_LISTEN_LOCAL_EXAMPLE_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_LOCAL_EXAMPLE_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_LOCAL_EXAMPLE_TLS_PORT") "no") "no") }}
+
+# "port_id" is used to generate the port variable to be used. It should match the "core" of the variable name
+# set in the line above.  For example, the "port_id" of "SC4S_LISTEN_LOCAL_EXAMPLE_TCP_PORT" is "LOCAL_EXAMPLE".
+# "parser" can be customized on dedicated ports only
+# "common" uses the same parser sequence as the default ports and is the most commonly used
+
+{{ $context := dict "port_id" "LOCAL_EXAMPLE" "parser" "common"}}
+
+# The following template execution creates a syslog-ng source with one or more dedicated ports for use with this log_path
+# The ports used are based on the values of one or more of the environment variables set above.
+
+{{ tmpl.Exec "t/source_network.t" $context }}
+{{- end -}}
+{{ define "log_path" }}
+log {
+
+# The first time this template is used the log_path will be linked to the default port
+
+{{- if eq (.) "yes"}}
+    source(s_default-ports);
+
+# Filters should be updated to use the simplest and most effecient logic possible to discard
+# the message from this path
+
+    filter(f_is_rfc3164);
+    filter(f_local_example);
+{{- end}}
+{{- if eq (.) "no"}}
+
+# In the second pass through the template a link to the dedicated port is used. This
+# normally does not require additional filters
+
+source (s_dedicated_port_LOCAL_EXAMPLE);
+{{- end}}
+
+#Set a default sourcetype and index
+
+    rewrite { r_set_splunk_dest_default(sourcetype("sc4s:local_example"), index("main"), template("t_msg_only"))};
+
+#using the key "local_example" find any cutomized index,source or sourcetype meta values
+
+    parser {p_add_context_splunk(key("local_example")); };
+
+# Any additional logic needed to process the event before sending to Splunk goes here
+
+# Send it to Splunk
+
+    destination(d_hec);  #--HEC--
+
+# Note: We normally do not use the "final" flag; this will allow another plugin to be created that will
+# forward events to another system
+
+    flags(flow-control);
+
+};
+{{- end}}
+{{- if (ne (getenv (print "SC4S_LISTEN_LOCAL_EXAMPLE_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_LOCAL_EXAMPLE_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_MICROFOCUS_ARCSIGHT_TLS_PORT") "no") "no") }}
+
+# Listen on the specified dedicated port(s) for LOCAL_EXAMPLE traffic
+
+    {{tmpl.Exec "log_path" "no" }}
+{{- end}}
+
+# Listen on the default port (typically 514) for LOCAL_EXAMPLE traffic
+
+{{tmpl.Exec "log_path" "yes" }}

package/etc/conf.d/local/config/sources/README.md

@@ -0,0 +1 @@
+This file exists to preserve the path for plugin use

package/etc/conf.d/local/context/compliance_meta_by_source.conf

@@ -0,0 +1,5 @@
+@version: 3.23
+filter f_test_test {
+    host("something-*" type(glob)) or
+    netmask(192.168.100.1/24)
+};

package/etc/conf.d/local/context/compliance_meta_by_source.csv

@@ -0,0 +1,2 @@
+#f_test_test,.splunk.index,"badindex"
+#f_test_test,fields.compliance,"pci"

package/etc/conf.d/local/context/splunk_index.csv

@@ -0,0 +1,40 @@
+#bluecoat_proxy,index,netproxy
+#cef_ArcSight_ArcSight,index,netwaf
+#cef_Incapsula_SIEMintegration,index,netwaf
+#cef_Microsoft_Microsoft Windows,index,oswinsec
+#cef_Microsoft_System or Application Event,index,oswin
+#cisco_asa,index,netfw
+#cisco_ios,index,netops
+#cisco_nx_os,index,netops
+#local_example,index,main
+#fortinet_fortios_event,index,netops
+#fortinet_fortios_log,index,netops
+#fortinet_fortios_traffic,index,netfw
+#fortinet_fortios_utm,index,netids
+#juniper_idp,index,netids
+#juniper_structured,index,netops
+#juniper_idp_structured,index,netids
+#juniper_junos_fw_structured,index,netfw
+#juniper_junos_ids_structured,index,netids
+#juniper_junos_utm_structured,index,netfw
+#juniper_junos_fw,index,netfw
+#juniper_junos_ids,index,netids
+#juniper_junos_utm,index,netfw
+#juniper_sslvpn,index,netfw
+#juniper_netscreen,index,netfw
+#juniper_nsm,index,netfw
+#juniper_nsm_idp,index,netids
+#juniper_legacy,index,netops
+#pan_traffic,index,netfw
+#pan_threat,index,netproxy
+#pan_system,index,netops
+#pan_config,index,netops
+#pan_hipwatch,index,main
+#pan_correlation,index,main
+#pan_userid,index,netauth
+#pan_unknown,index,netops
+#proofpoint_pps_filter,index,email
+#proofpoint_pps_sendmail,index,email
+#sc4s_events,index,main
+#sc4s_fallback,index,main
+#sc4s_metrics,index,em_metrics

package/etc/conf.d/local/context/vendor_product_by_source.conf

@@ -0,0 +1,37 @@
+@version: 3.22
+#TODO: #60 The syntax below uses regex and an indirect reference to a variable due to a
+#bug/limitation of selector files. The better syntax should be as follows
+#filter {match("f5_test" template("$(env PRESUME_SYSLOG)")); };
+
+filter f_test_test {
+    host("testvp-*" type(glob)) or
+    netmask(192.168.100.1/24)
+};
+filter f_juniper_nsm {
+    host("jnpnsm-*" type(glob)) or
+    netmask(192.168.1.0/24)
+};
+filter f_juniper_nsm_idp {
+    host("jnpnsmidp-*" type(glob)) or
+    netmask(192.168.2.0/24)
+};
+filter f_juniper_idp {
+    host("jnpidp-*" type(glob)) or
+    netmask(192.168.3.0/24)
+};
+filter f_juniper_netscreen {
+    host("jnpns-*" type(glob)) or
+    netmask(192.168.4.0/24)
+};
+filter f_cisco_nx_os {
+    host("csconx-*" type(glob)) or
+    netmask(192.168.5.0/24)
+};    
+filter f_proofpoint_pps_sendmail {
+    host("pps-*" type(glob)) or
+    netmask(192.168.6.0/24)
+};
+filter f_proofpoint_pps_filter {
+    host("pps-*" type(glob)) or
+    netmask(192.168.7.0/24)
+};

package/etc/conf.d/local/context/vendor_product_by_source.csv

@@ -0,0 +1,8 @@
+f_test_test,sc4s_vendor_product,"test_test"
+f_juniper_nsm,sc4s_vendor_product,"juniper_nsm"
+f_juniper_nsm_idp,sc4s_vendor_product,"juniper_nsm_idp"
+f_juniper_idp,sc4s_vendor_product,"juniper_idp"
+f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen"
+f_cisco_nx_os,sc4s_vendor_product,"cisco_nx_os"
+f_proofpoint_pps_sendmail,sc4s_vendor_product,"proofpoint_pps_sendmail"
+f_proofpoint_pps_filter,sc4s_vendor_product,"proofpoint_pps_filter"