-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Ryan Faircloth
committed
Jun 28, 2019
1 parent
c59c14e
commit 683bd9f
Showing
21 changed files
with
612 additions
and
573 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,251 @@ | ||
| # =============================================================================================== | ||
| # Destination Blocks (functions) for Splunk destinations | ||
| # Block argument defaults are defined in main syslog-ng.conf file | ||
| # Additional indexed fields (based on syslog-ng macros) can be added to the "with_metadata" blocks | ||
| # for both HEC and Kafka. | ||
| # Format is "fields.<splunk_indexed_field>=<syslog-ng macro>" | ||
| # =============================================================================================== | ||
|
|
||
| # =============================================================================================== | ||
| # blocks for file destination (for use with the Splunk Universal Forwarder) | ||
| # =============================================================================================== | ||
|
|
||
| # =============================================================================================== | ||
| # Logfile Local Defaults: | ||
| # vendor: unassigned | ||
| # message: suffix for log file names; "messages" | ||
| # =============================================================================================== | ||
|
|
||
| block destination d_splunk_logfile(category("") | ||
| vendor("unassigned") | ||
| filename("messages") | ||
| use_template(`splunk-default-template`) | ||
| ) { | ||
| file("`splunk-log-root`/`category`/$(lowercase \"${LOGHOST}\")/`vendor`/$(lowercase \"${HOST}\")/${YEAR}.${MONTH}.${DAY}.${HOUR}-`filename`" | ||
| template(`use_template`) | ||
| flush-lines(0) | ||
| create-dirs(yes) | ||
| dir_owner(`splunk-user`) | ||
| dir_group(`splunk-group`) | ||
| dir_perm(0700) | ||
| owner(`splunk-user`) | ||
| group(`splunk-group`) | ||
| perm(0600) | ||
| ); | ||
| }; | ||
|
|
||
| # =============================================================================================== | ||
| # blocks for direct connection to Splunk via Kafka and HEC | ||
| # =============================================================================================== | ||
| # =============================================================================================== | ||
| # Kafka with Metadata (Facility and Priority): | ||
| # =============================================================================================== | ||
|
|
||
| block destination d_kafka_with_metadata (kafka-libs(`kafka-lib-dir`) | ||
| kafka-brokers(`splunk-kafka-brokers`) | ||
| sourcetype(`splunk-sourcetype`) | ||
| topic(`splunk-topic`) | ||
| index(`splunk-index`) | ||
| use_template(`splunk-default-template`) | ||
| ) { | ||
| kafka(client-lib-dir("`kafka-libs`") | ||
| kafka-bootstrap-servers("`kafka-brokers`") | ||
| persist-name("`kafka_brokers`_`topic`_`sourcetype`_`index`") | ||
| template('$(format-json | ||
| time=$S_UNIXTIME.$S_MSEC | ||
| host=$HOST | ||
| source=${HOST_FROM} | ||
| sourcetype=`sourcetype` | ||
| index=`index` | ||
| event=$(template `use_template`) | ||
| fields.facility=$FACILITY | ||
| fields.severity=$LEVEL)') | ||
| topic("`topic`") | ||
| ); | ||
| }; | ||
|
|
||
| # =============================================================================================== | ||
| # Kafka with Full Metadata; additional fields can be added | ||
| # =============================================================================================== | ||
|
|
||
| block destination d_kafka_with_full_metadata (kafka-libs(`kafka-lib-dir`) | ||
| kafka-brokers(`splunk-kafka-brokers`) | ||
| sourcetype(`splunk-sourcetype`) | ||
| topic(`splunk-topic`) | ||
| index(`splunk-index`) | ||
| use_template(`splunk-default-template`) | ||
| ) { | ||
| kafka(client-lib-dir("`kafka-libs`") | ||
| kafka-bootstrap-servers("`kafka-brokers`") | ||
| persist-name("`kafka_brokers`_`topic`_`sourcetype`_`index`") | ||
| template('$(format-json | ||
| time=$S_UNIXTIME.$S_MSEC | ||
| host=$HOST | ||
| source=${HOST_FROM} | ||
| sourcetype=`sourcetype` | ||
| index=`index` | ||
| event=$(template `use_template`) | ||
| fields.facility=$FACILITY | ||
| fields.severity=$LEVEL | ||
| fields.message_header=$MSGHDR | ||
| fields.program_name=$PROGRAM | ||
| fields.pid=$PID | ||
| fields.full_message=$(template t_everything) | ||
| )') | ||
| topic("`topic`") | ||
| ); | ||
| }; | ||
|
|
||
| # =============================================================================================== | ||
| # Basic Kafka (no indexed fields) | ||
| # =============================================================================================== | ||
|
|
||
| block destination d_kafka_basic (kafka-libs(`kafka-lib-dir`) | ||
| kafka-brokers(`splunk-kafka-brokers`) | ||
| sourcetype(`splunk-sourcetype`) | ||
| topic(`splunk-topic`) | ||
| index(`splunk-index`) | ||
| use_template(`splunk-default-template`) | ||
| ) { | ||
| kafka(client-lib-dir("`kafka-libs`") | ||
| kafka-bootstrap-servers("`kafka-brokers`") | ||
| persist-name("`kafka_brokers`_`topic`_`sourcetype`_`index`") | ||
| template('$(format-json time=$S_UNIXTIME | ||
| host=$HOST | ||
| source=$HOST_FROM | ||
| sourcetype=`sourcetype` | ||
| index=`index` | ||
| event=$(template `use_template`))') | ||
| topic("`topic`") | ||
| ); | ||
| }; | ||
|
|
||
| # =============================================================================================== | ||
| # HEC with Metadata (Facility and Priority): | ||
| # Be sure to adjust batch paramaters below to suit scale/environment | ||
| # If validated certs are used, uncomment relevant lines in the tls() block below | ||
| # and change peer-verify() to "yes" | ||
| # =============================================================================================== | ||
|
|
||
| block destination d_hec_with_metadata (hec-url(`splunk-hec-url`) | ||
| hec-token(`splunk-hec-token`) | ||
| sourcetype(`splunk-sourcetype`) | ||
| index(`splunk-index`) | ||
| use_template(`splunk-default-template`) | ||
| ) { | ||
| http(url("`hec-url`") | ||
| method("POST") | ||
| batch-lines(10) | ||
| batch-bytes(512Kb) | ||
| batch-timeout(5000) | ||
| user_agent("syslog-ng User Agent") | ||
| user("syslog-ng") | ||
| password("`hec-token`") | ||
| persist-name("`hec-url`_`sourcetype`_`hec-token`_`index`") | ||
| tls(peer-verify(no) | ||
| # ca-dir("dir") | ||
| # ca-file("ca") | ||
| # cert-file("cert") | ||
| # cipher-suite("cipher") | ||
| # key-file("key") | ||
| # peer-verify(yes|no) | ||
| # ssl-version(<the permitted SSL/TLS version>) | ||
| ) | ||
| body('$(format-json | ||
| time=$S_UNIXTIME.$S_MSEC | ||
| host=$HOST | ||
| source=${HOST_FROM} | ||
| sourcetype=`sourcetype` | ||
| index=`index` | ||
| event=$(template `use_template`) | ||
| fields.facility=$FACILITY | ||
| fields.severity=$LEVEL)') | ||
| ); | ||
| }; | ||
|
|
||
| # =============================================================================================== | ||
| # HEC with Full Metadata; additional fields can be added | ||
| # Be sure to adjust batch paramaters below to suit scale/environment | ||
| # If validated certs are used, uncomment relevant lines in the tls() block below | ||
| # and change peer-verify() to "yes" | ||
| # =============================================================================================== | ||
|
|
||
| block destination d_hec_with_full_metadata(hec-url(`splunk-hec-url`) | ||
| hec-token(`splunk-hec-token`) | ||
| sourcetype(`splunk-sourcetype`) | ||
| index(`splunk-index`) | ||
| use_template(`splunk-default-template`) | ||
| ) { | ||
| http(url("`hec-url`") | ||
| method("POST") | ||
| batch-lines(10) | ||
| batch-bytes(512Kb) | ||
| batch-timeout(5000) | ||
| user_agent("syslog-ng User Agent") | ||
| user("syslog-ng") | ||
| password("`hec-token`") | ||
| persist-name("`hec-url`_`sourcetype`_`hec-token`_`index`") | ||
| tls(peer-verify(no) | ||
| # ca-dir("dir") | ||
| # ca-file("ca") | ||
| # cert-file("cert") | ||
| # cipher-suite("cipher") | ||
| # key-file("key") | ||
| # peer-verify(yes|no) | ||
| # ssl-version(<the permitted SSL/TLS version>) | ||
| ) | ||
| body('$(format-json | ||
| time=$S_UNIXTIME.$S_MSEC | ||
| host=$HOST | ||
| source=${HOST_FROM} | ||
| sourcetype=`sourcetype` | ||
| index=`index` | ||
| event=$(template `use_template`) | ||
| fields.fullhost_from=${FULLHOST_FROM} | ||
| fields.facility=$FACILITY | ||
| fields.severity=$LEVEL | ||
| fields.message_header=$MSGHDR | ||
| fields.program_name=$PROGRAM | ||
| fields.pid=$PID | ||
| fields.full_message=$(template t_everything) | ||
| )') | ||
| ); | ||
| }; | ||
|
|
||
| # =============================================================================================== | ||
| # Basic HEC (no indexed fields) | ||
| # =============================================================================================== | ||
|
|
||
| block destination d_hec_basic (hec-url(`splunk-hec-url`) | ||
| hec-token(`splunk-hec-token`) | ||
| sourcetype(`splunk-sourcetype`) | ||
| index(`splunk-index`) | ||
| use_template(`splunk-default-template`) | ||
| ) { | ||
| http(url("`hec-url`") | ||
| method("POST") | ||
| batch-lines(10) | ||
| batch-bytes(512Kb) | ||
| batch-timeout(5000) | ||
| user_agent("syslog-ng User Agent") | ||
| user("syslog-ng") | ||
| password("`hec-token`") | ||
| persist-name("`hec-url`_`sourcetype`_`hec-token`_`index`") | ||
| tls(peer-verify(no) | ||
| # ca-dir("dir") | ||
| # ca-file("ca") | ||
| # cert-file("cert") | ||
| # cipher-suite("cipher") | ||
| # key-file("key") | ||
| # peer-verify(yes|no) | ||
| # ssl-version(<the permitted SSL/TLS version>) | ||
| ) | ||
| body('$(format-json | ||
| time=$S_UNIXTIME.$S_MSEC | ||
| host=$HOST | ||
| source=${HOST_FROM} | ||
| sourcetype=`sourcetype` | ||
| index=`index` | ||
| event=$(template `use_template`))') | ||
| ); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| # =============================================================================================== | ||
| # ForcePoint (Websense) | ||
| # =============================================================================================== | ||
|
|
||
| # =============================================================================================== | ||
| # Log Format: | ||
| # <159>Dec 19 10:48:57 EST 10.203.28.21 vendor=Websense product=Security product_version=7.7.0 action=permitted severity=1 category=153 user=- src_host=10.64.134.74 src_port=62189 dst_host=mail.google.com dst_ip=74.125.224.53 dst_port=443 bytes_out=197 bytes_in=76 http_response=200 http_method=CONNECT http_content_type=- http_user_agent=Mozilla/5.0_(Windows;_U;_Windows_NT_6.1;_enUS;_rv:1.9.2.23)_Gecko/20110920_Firefox/3.6.23 http_proxy_status_code=200 reason=- disposition=1034 policy=- role=8 duration=0 url=https://mail.google.com | ||
| # | ||
| # Primary reason for non-compliance: %Z (timesone mnemonic) appended after date/time | ||
| # =============================================================================================== | ||
|
|
||
| block parser p_websense-parser(prefix(".websense.")) { | ||
| channel { | ||
| rewrite { | ||
| # normal BSD timestamp, plus a timezone code. Remove the | ||
| # timezone information for now. | ||
| subst('([A-Za-z]{3} [0-9 ]\d \d{2}:\d{2}:\d{2}) [A-Z]{3,4}' "$1 " flags(global) value("MSG")); | ||
|
|
||
| # add a $PROGRAM field, so that syslog-parser() would extract | ||
| # that properly | ||
| subst('(vendor=Websense)' "Websense: $1" flags(global) value("MSG")); | ||
| }; | ||
| parser { | ||
| # by this time this message is a properly formatted syslog | ||
| # message | ||
| syslog-parser(time-zone(`default-timezone`)); | ||
| # syslog-parser(); | ||
|
|
||
| # extract name-value pairs. | ||
| # kv-parser(prefix("`prefix`")); | ||
| }; | ||
| }; | ||
| }; |
Oops, something went wrong.