From 2f0ce3864c704ff1d838dc3d6975d16e502f6d39 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 30 Mar 2020 18:34:20 -0400 Subject: [PATCH 1/3] Change f_catch_first to f_null_queue --- docs/configuration.md | 2 +- package/etc/conf.d/filters/misc/catchfirst.conf | 4 ++-- package/etc/conf.d/log_paths/lp-aaa-catch_first.conf.tmpl | 2 +- .../context_templates/vendor_product_by_source.conf.example | 2 +- .../context_templates/vendor_product_by_source.csv.example | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/configuration.md b/docs/configuration.md index d4e8af5..ec1569d 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -228,7 +228,7 @@ docker stack deploy --compose-file docker-compose.yml sc4s ## Dropping all data by ip or subnet In some cases rogue or port-probing data can be sent to SC4S from misconfigured devices or vulnerability scanners. Update -the `vendor_product_by_source.conf` filter `f_catch_first` with one or more ip/subnet masks to drop events without +the `vendor_product_by_source.conf` filter `f_null_queue` with one or more ip/subnet masks to drop events without logging. Note that drop metrics will be recorded. diff --git a/package/etc/conf.d/filters/misc/catchfirst.conf b/package/etc/conf.d/filters/misc/catchfirst.conf index 9005f11..f967591 100644 --- a/package/etc/conf.d/filters/misc/catchfirst.conf +++ b/package/etc/conf.d/filters/misc/catchfirst.conf @@ -1,5 +1,5 @@ -#f_catch_first -filter f_catch_first { +#f_null_queue +filter f_null_queue { match("^catch_first", value("fields.sc4s_vendor_product")); }; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/lp-aaa-catch_first.conf.tmpl b/package/etc/conf.d/log_paths/lp-aaa-catch_first.conf.tmpl index b8fac16..41ce1ee 100644 --- a/package/etc/conf.d/log_paths/lp-aaa-catch_first.conf.tmpl +++ b/package/etc/conf.d/log_paths/lp-aaa-catch_first.conf.tmpl @@ -2,7 +2,7 @@ # vulnerability scanners to be ignored log { - filter(f_catch_first); + filter(f_null_queue); flags(catchall,final); diff --git a/package/etc/context_templates/vendor_product_by_source.conf.example b/package/etc/context_templates/vendor_product_by_source.conf.example index 1115e34..1eb20df 100644 --- a/package/etc/context_templates/vendor_product_by_source.conf.example +++ b/package/etc/context_templates/vendor_product_by_source.conf.example @@ -2,7 +2,7 @@ filter f_test_test { host("testvp-*" type(glob)) #or netmask(xxx.xxx.xxx.xxx/xx) }; -filter f_catch_first { +filter f_null_queue { netmask(169.254.100.0/24) }; diff --git a/package/etc/context_templates/vendor_product_by_source.csv.example b/package/etc/context_templates/vendor_product_by_source.csv.example index 302b8ca..0ea93b5 100644 --- a/package/etc/context_templates/vendor_product_by_source.csv.example +++ b/package/etc/context_templates/vendor_product_by_source.csv.example @@ -1,6 +1,6 @@ f_test_test,sc4s_vendor_product,"test_test" f_brocade_syslog,sc4s_vendor_product,"brocade_syslog" -f_catch_first,sc4s_vendor_product,"catch_first" +f_null_queue,sc4s_vendor_product,"catch_first" f_cisco_meraki,sc4s_vendor_product,"cisco_meraki" f_citrix_netscaler,sc4s_vendor_product,"citrix_netscaler" f_dell_rsa_secureid,sc4s_vendor_product,"dell_rsa_secureid" From a287d5e9c2248b5e2002dc9d89cc78f0e708ca54 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 30 Mar 2020 21:35:17 -0400 Subject: [PATCH 2/3] rename file to match --- .../{lp-aaa-catch_first.conf.tmpl => lp-aaa-null_queue.conf.tmpl} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename package/etc/conf.d/log_paths/{lp-aaa-catch_first.conf.tmpl => lp-aaa-null_queue.conf.tmpl} (100%) diff --git a/package/etc/conf.d/log_paths/lp-aaa-catch_first.conf.tmpl b/package/etc/conf.d/log_paths/lp-aaa-null_queue.conf.tmpl similarity index 100% rename from package/etc/conf.d/log_paths/lp-aaa-catch_first.conf.tmpl rename to package/etc/conf.d/log_paths/lp-aaa-null_queue.conf.tmpl From d4b90d3d691ce98b706e86e5bb0638536e73dabe Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 31 Mar 2020 12:08:49 -0400 Subject: [PATCH 3/3] fix --- package/etc/conf.d/filters/misc/catchfirst.conf | 5 ----- package/etc/conf.d/filters/misc/null_queue.conf | 5 +++++ 2 files changed, 5 insertions(+), 5 deletions(-) delete mode 100644 package/etc/conf.d/filters/misc/catchfirst.conf create mode 100644 package/etc/conf.d/filters/misc/null_queue.conf diff --git a/package/etc/conf.d/filters/misc/catchfirst.conf b/package/etc/conf.d/filters/misc/catchfirst.conf deleted file mode 100644 index f967591..0000000 --- a/package/etc/conf.d/filters/misc/catchfirst.conf +++ /dev/null @@ -1,5 +0,0 @@ -#f_null_queue -filter f_null_queue { - match("^catch_first", value("fields.sc4s_vendor_product")); - -}; \ No newline at end of file diff --git a/package/etc/conf.d/filters/misc/null_queue.conf b/package/etc/conf.d/filters/misc/null_queue.conf new file mode 100644 index 0000000..561a2a8 --- /dev/null +++ b/package/etc/conf.d/filters/misc/null_queue.conf @@ -0,0 +1,5 @@ +#f_null_queue +filter f_null_queue { + match("^null_queue", value("fields.sc4s_vendor_product")); + +}; \ No newline at end of file