From ae7d5c22b35a427c3c20ad6b43289ab81c97b016 Mon Sep 17 00:00:00 2001 From: Ryan Faircloth <35384120+rfaircloth-splunk@users.noreply.github.com> Date: Sat, 31 Aug 2019 11:37:10 -0400 Subject: [PATCH] Fixes #70 (#71) --- docs/sources.md | 54 ++++++++++- .../conf.d/conflib/_splunk/splunkfields.conf | 16 ++-- .../log_paths/P_rfc3164-juniper_nsm_idp.conf | 3 +- package/etc/conf.d/log_paths/internal.conf | 8 +- .../log_paths/p_rfc3164-cisco-nx-os.conf | 3 +- .../conf.d/log_paths/p_rfc3164-cisco_asa.conf | 3 +- .../conf.d/log_paths/p_rfc3164-cisco_ios.conf | 3 +- .../log_paths/p_rfc3164-fortinet_fortios.conf | 14 ++- .../log_paths/p_rfc3164-juniper-idp.conf | 3 +- .../log_paths/p_rfc3164-juniper-junos.conf | 20 +++-- .../p_rfc3164-juniper_netscreen.conf | 4 +- .../log_paths/p_rfc3164-juniper_nsm.conf | 4 +- .../log_paths/p_rfc3164-paloalto-panos.conf | 24 +++-- .../p_rfc5424_noversion-cisco_asa.conf | 3 +- .../p_rfc_5424_noversion-symantec-proxy.conf | 4 +- .../p_rfc_5424_strict-juniper-junos.conf | 23 +++-- package/etc/conf.d/log_paths/zfallback.conf | 3 +- package/etc/conf.d/sources/network.conf | 2 +- package/etc/context-local/splunk_index.csv | 89 ++++++------------- tests/test_juniper.py | 2 +- tests/test_juniper_junos_rfc3164.py | 2 +- tests/test_juniper_junos_rfc5124.py | 2 +- 22 files changed, 180 insertions(+), 109 deletions(-) diff --git a/docs/sources.md b/docs/sources.md index 24e9d72..cb38f73 100644 --- a/docs/sources.md +++ b/docs/sources.md @@ -16,6 +16,13 @@ | cisco:pix | Not supported | | cisco:fwsm | Not supported | +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| cisco_asa | cisco:asa | netfw | none | + + ### Filter type MSG Parse: This filter parses message content @@ -50,17 +57,26 @@ Verify timestamp, and host values match as expected | NX-OS Manual | https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide/sm_5syslog.html| | Cisco ACI | https://community.cisco.com/legacyfs/online/attachments/document/technote-aci-syslog_external-v1.pdf | | Cisco WLC & AP | https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html#anc8 | + ### Sourcetypes | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| | cisco:ios | This source type is also used for NX-OS, ACI and WLC product lines | +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| cisco_ios | cisco:ios | netops | none | +| cisco_nx_os | cisco:ios | netops | none | + ### Filter type * Cisco IOS products can be identified by message parsing alone * Cisco NX OS, WLC, and ACI products must be identified by host or ip assignment update the filter `f_cisco_nx_os` as required + ### Setup and Configuration * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. @@ -112,11 +128,22 @@ Verify timestamp, and host values match as expected | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| -| fgt_log | The catch all sourcetype is not used | +| fgt_log | The catch all sourcetype is not used | | fgt_traffic | None | | fgt_utm | None | | fgt_event | None + +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| fortinet_fortios_traffic | fgt_traffic | netops | none | +| fortinet_fortios_utm | fgt_utm | netids | none | +| fortinet_fortios_event | fgt_event | netops | none | +| fortinet_fortios_log | fgt_log | netops | none | + + ### Filter type MSG Parse: This filter parses message content @@ -204,6 +231,22 @@ Verify timestamp, and host values match as expected | pan:log | None | | pan:traffic | None | | pan:threat | None | +| pan:system | None | +| pan:config | None | +| pan:hipwatch | None | +| pan:correlation | None | + +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| pan_log | pan:log | netops | none | +| pan_traffic | pan:traffic | netfw | none | +| pan_threat | pan:threat | netproxy | none | +| pan_system | pan:system | netops | none | +| pan_config | pan:config | netops | none | +| pan_hipwatch | pan:hipwatch | netops | none | +| pan_correlation | pan:correlation | netops | none | ### Filter type @@ -240,7 +283,14 @@ index= sourcetype=pan:*| stats count by host | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| -| bluecoat:proxysg:access:kv | Requires version 3.6 | +| bluecoat:proxysg:access:kv | Requires version TA 3.6 | + +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| bluecoat_proxy | bluecoat:proxysg:access:kv | netops | none | + ### Filter type diff --git a/package/etc/conf.d/conflib/_splunk/splunkfields.conf b/package/etc/conf.d/conflib/_splunk/splunkfields.conf index 7d96599..3e1d2c9 100644 --- a/package/etc/conf.d/conflib/_splunk/splunkfields.conf +++ b/package/etc/conf.d/conflib/_splunk/splunkfields.conf @@ -1,5 +1,5 @@ -#Used to set index fields we will always use -rewrite r_set_splunk_basic { +#Used to set indexed fields we will always use to global defaults +rewrite r_set_splunk_default { set("`index`", value(".splunk.index")); set("`sourcetype`", value(".splunk.sourcetype")); @@ -9,10 +9,16 @@ rewrite r_set_splunk_basic { set($LOGHOST, value("fields.sc4s_syslog_server")); set($SOURCEIP, value("fields.sc4s_fromhostip")); }; +#used by each log-path to set index and sourcetype which may be +#overridden by user defined values +block rewrite r_set_splunk_dest_default( + index() + sourcetype() + ) { + set("`index`", value(".splunk.index")); + set("`sourcetype`", value(".splunk.sourcetype")); +}; -#rewrite - -#Used by fallback to log everything we can block rewrite r_set_splunk( template(`splunk-default-template`) ) { diff --git a/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf b/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf index 377820c..740a10c 100644 --- a/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf +++ b/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf @@ -4,8 +4,9 @@ log { filter(f_is_rfc3164); filter(f_juniper_nsm_idp); + rewrite {r_set_splunk_dest_default(sourcetype("juniper:nsm:idp"), index("netids"))}; parser { - p_add_context_splunk(key("juniper:nsm:idp")); + p_add_context_splunk(key("juniper_idp")); }; rewrite { r_set_splunk(template("t_standard")) diff --git a/package/etc/conf.d/log_paths/internal.conf b/package/etc/conf.d/log_paths/internal.conf index 879925f..352c2ac 100644 --- a/package/etc/conf.d/log_paths/internal.conf +++ b/package/etc/conf.d/log_paths/internal.conf @@ -3,7 +3,9 @@ log { if (match("^Log statistics; " value("MESSAGE"))) { - parser {p_add_context_splunk(key("syslog-ng:metrics")); }; + rewrite { r_set_splunk_dest_default(sourcetype("syslog-ng:metrics"), index("em_metrics")) }; + + parser {p_add_context_splunk(key("syslog-ng_metrics")); }; rewrite { subst('(?:Log statistics; )?(?[^= ]+)=\x27(?[^\(]+)\((?[^,\)]+)(?:,(?[^,]+),(?[^\)]+))?\)\=(?\d+)\x27(?:, )?', ' @@ -28,7 +30,9 @@ log { }; destination(d_hecmetrics); #--HEC-- } else { - parser {p_add_context_splunk(key("syslog-ng:events")); }; + rewrite { r_set_splunk_dest_default(sourcetype("syslog-ng:events"), index("_internal"))}; + + parser {p_add_context_splunk(key("syslog-ng_events")); }; rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- destination(d_hec); #--HEC-- }; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf index e9f018c..d282022 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf @@ -3,8 +3,9 @@ log { source(s_default-ports); filter(f_cisco_nx_os); + rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"))}; parser { - p_add_context_splunk(key("cisco:nx-os")); + p_add_context_splunk(key("cisco_nx_os")); }; rewrite { r_set_splunk(template("t_hdr_msg")) diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf index 428cb0f..f63aad9 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf @@ -10,7 +10,8 @@ log { filter(f_cisco_asa); #set the source type based on program field and lookup index from the splunk context csv - parser {p_add_context_splunk(key("cisco:asa")); }; + rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"))}; + parser {p_add_context_splunk(key("cisco_asa")); }; #Using the 5424 parser the message content is all we need rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf index 780130e..bd4ce8d 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf @@ -9,8 +9,9 @@ log { filter(f_cisco_ios); + rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"))}; parser { - p_add_context_splunk(key("cisco:ios")); + p_add_context_splunk(key("cisco_ios")); }; rewrite { r_set_splunk(template("t_msg_only")) #--HEC-- diff --git a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf index d81c565..cd419db 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf @@ -11,14 +11,20 @@ log { rewrite { set("${.kv.devname}", value("HOST")); }; #set the source type based on program field and lookup index from the splunk context csv + + if (match("traffic" value(".kv.type"))) { - parser {p_add_context_splunk(key("fgt_traffic")); }; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_traffic"), index("netfw"))}; + parser {p_add_context_splunk(key("fortinet_fortios_traffic")); }; } elif (match("utm" value(".kv.type"))) { - parser {p_add_context_splunk(key("fgt_utm")); }; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_utm"), index("netids"))}; + parser {p_add_context_splunk(key("fortinet_fortios_utm")); }; } elif (match("event" value(".kv.type"))) { - parser {p_add_context_splunk(key("fgt_event")); }; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_event"), index("netops"))}; + parser {p_add_context_splunk(key("fortinet_fortios_event")); }; } else { - parser {p_add_context_splunk(key("fgt_log")); }; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_log"), index("netops"))}; + parser {p_add_context_splunk(key("fortinet_fortios_log")); }; }; #rewrite the final message for splunk json diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf index 4b84403..68a37e7 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf @@ -4,8 +4,9 @@ log { filter(f_is_rfc3164); filter(f_juniper_idp); + rewrite { r_set_splunk_dest_default(sourcetype("juniper:idp"), index("netids"))}; parser { - p_add_context_splunk(key("juniper:idp")); + p_add_context_splunk(key("juniper_idp")); }; rewrite { r_set_splunk(template("t_standard")) diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf index e689cf6..97b67b5 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf @@ -9,13 +9,23 @@ log { filter(f_juniper_junos_legacy); if (program('RT_IDP')) { - parser {p_add_context_splunk(key("juniper:junos:idp")); }; - } elif (program('RT_FLOW|RT_IDS|RT_UTM')) { - parser {p_add_context_splunk(key("juniper:junos:firewall")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp"), index("netids"))}; + parser {p_add_context_splunk(key("juniper_idp")); }; + } elif (program('RT_FLOW')) { + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall"), index("netfw"))}; + parser {p_add_context_splunk(key("juniper_junos_flow")); }; + } elif (program('RT_IDS')) { + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall"), index("netids"))}; + parser {p_add_context_splunk(key("juniper_junos_ids")); }; + } elif (program('RT_UTM')) { + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall"), index("netids"))}; + parser {p_add_context_splunk(key("juniper_junos_utm")); }; } elif (program('Juniper')) { - parser {p_add_context_splunk(key("juniper:sslvpn")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:sslvpn"), index("netfw"))}; + parser {p_add_context_splunk(key("juniper_sslvpn")); }; } else { - parser {p_add_context_splunk(key("juniper:legacy")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:legacy"), index("netops"))}; + parser {p_add_context_splunk(key("juniper_legacy")); }; }; rewrite { r_set_splunk(template("t_standard")) }; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf index efd046c..0d3667d 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf @@ -3,8 +3,10 @@ log { source(s_default-ports); filter(f_juniper_netscreen); + rewrite { r_set_splunk_dest_default(sourcetype("netscreen:firewall"), index("netfw"))}; + parser { - p_add_context_splunk(key("juniper:netscreen")); + p_add_context_splunk(key("juniper_netscreen")); }; rewrite { r_set_splunk(template("t_standard")) diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf index 04810cc..9d79fe1 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf @@ -8,8 +8,10 @@ log { filter(f_is_rfc3164); filter(f_juniper_nsm); + rewrite { r_set_splunk_dest_default(sourcetype("juniper:nsm"), index("netfw"))}; + parser { - p_add_context_splunk(key("juniper:nsm")); + p_add_context_splunk(key("juniper_nsm")); }; rewrite { r_set_splunk(template("t_standard")) diff --git a/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf b/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf index 956f747..a2ac570 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf @@ -33,21 +33,29 @@ log { #set the source type based on program field and lookup index from the splunk context csv if (message(',\d+,THREAT')) { - parser {p_add_context_splunk(key("pan:threat")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:threat"), index("netproxy"))}; + parser {p_add_context_splunk(key("pan_threat")); }; } elif (message(',\d+,TRAFFIC')) { - parser {p_add_context_splunk(key("pan:traffic")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:traffic"), index("netfw"))}; + parser {p_add_context_splunk(key("pan_traffic")); }; } elif (message(',\d+,SYSTEM')) { - parser {p_add_context_splunk(key("pan:system")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:system"), index("netops"))}; + parser {p_add_context_splunk(key("pan_system")); }; } elif (message(',\d+,CONFIG')) { - parser {p_add_context_splunk(key("pan:config")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:config"), index("netops"))}; + parser {p_add_context_splunk(key("pan_config")); }; } elif (message(',\d+,HIPWATCH')) { - parser {p_add_context_splunk(key("pan:hipwatch")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:hipwatch"), index("main"))}; + parser {p_add_context_splunk(key("pan_hipwatch")); }; } elif (message(',\d+,CORRELATION')) { - parser {p_add_context_splunk(key("pan:correlation")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:correlation"), index("main"))}; + parser {p_add_context_splunk(key("pan_correlation")); }; } elif (message(',\d+,USERID')) { - parser {p_add_context_splunk(key("pan:userid")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:userid"), index("netauth"))}; + parser {p_add_context_splunk(key("pan_userid")); }; } else { - parser {p_add_context_splunk(key("pan:log")); }; + rewrite { r_set_splunk_dest_default(sourcetype("pan:log"), index("netops"))}; + parser {p_add_context_splunk(key("pan_log")); }; }; #rewrite the final message for splunk json diff --git a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf index 295669a..ecc4459 100644 --- a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf +++ b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf @@ -5,7 +5,8 @@ log { #set the source type based on program field and lookup index from the splunk context csv - parser {p_add_context_splunk(key("cisco:asa")); }; + rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"))}; + parser {p_add_context_splunk(key("cisco_asa")); }; #Using the 5424 parser the message content is all we need rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf index 4d2b8e4..2c7085a 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf +++ b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf @@ -5,7 +5,9 @@ log { #set the source type based on program field and lookup index from the splunk context csv - parser {p_add_context_splunk(key("bluecoat:proxysg:access:kv")); }; + rewrite { r_set_splunk_dest_default(sourcetype("bluecoat:proxysg:access:kv"), index("netproxy"))}; + + parser {p_add_context_splunk(key("bluecoat_proxy")); }; #Using the 5424 parser the message content is all we need rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf index c49854b..edb9eb5 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf +++ b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf @@ -9,15 +9,24 @@ log { filter(f_juniper_junos); if (program('RT_IDP')) { - parser {p_add_context_splunk(key("juniper:junos:idp:structured")); }; - } elif (program('RT_FLOW|RT_IDS|RT_UTM')) { - parser {p_add_context_splunk(key("juniper:junos:firewall:structured")); }; - } - elif (program('Jnpr')) { - parser {p_add_context_splunk(key("juniper:idp:structured")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp:structured"), index("netids"))}; + parser {p_add_context_splunk(key("juniper_idp")); }; + } elif (program('RT_FLOW')) { + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netfw"))}; + parser {p_add_context_splunk(key("juniper_junos_flow")); }; + } elif (program('RT_IDS')) { + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netids"))}; + parser {p_add_context_splunk(key("juniper_junos_ids")); }; + } elif (program('RT_UTM')) { + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netids"))}; + parser {p_add_context_splunk(key("juniper_junos_utm")); }; + } elif (program('Jnpr')) { + rewrite { r_set_splunk_dest_default(sourcetype("juniper:idp:structured"), index("netids"))}; + parser {p_add_context_splunk(key("juniper_junos_idp")); }; } else { - parser {p_add_context_splunk(key("juniper:structured")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:structured"), index("netops"))}; + parser {p_add_context_splunk(key("juniper_structured")); }; }; rewrite { r_set_splunk(template("t_hdr_sdata_msg"))}; diff --git a/package/etc/conf.d/log_paths/zfallback.conf b/package/etc/conf.d/log_paths/zfallback.conf index 4b1b5d5..1100605 100644 --- a/package/etc/conf.d/log_paths/zfallback.conf +++ b/package/etc/conf.d/log_paths/zfallback.conf @@ -1,8 +1,9 @@ log { source(s_default-ports); + rewrite { r_set_splunk_dest_default(sourcetype("syslog-ng:fallback"), index("main"))}; parser { - p_add_context_splunk(key("syslog-ng:fallback")); + p_add_context_splunk(key("syslog-ng_fallback")); }; rewrite { r_set_splunk(template("t_JSON"))}; #--HEC-- diff --git a/package/etc/conf.d/sources/network.conf b/package/etc/conf.d/sources/network.conf index 70a5f7b..2d562b6 100644 --- a/package/etc/conf.d/sources/network.conf +++ b/package/etc/conf.d/sources/network.conf @@ -44,7 +44,7 @@ source s_default-ports { #TODO: #60 Remove this function with enhancement rewrite(set_metadata_presume); rewrite(set_rfcnonconformant); - rewrite(r_set_splunk_basic); + rewrite(r_set_splunk_default); if { filter(f_rfc5424_strict); diff --git a/package/etc/context-local/splunk_index.csv b/package/etc/context-local/splunk_index.csv index e3d7f9d..b734cf1 100644 --- a/package/etc/context-local/splunk_index.csv +++ b/package/etc/context-local/splunk_index.csv @@ -1,62 +1,27 @@ -bluecoat:proxysg:access:kv,index,netproxy -bluecoat:proxysg:access:kv,sourcetype,bluecoat:proxysg:access:kv -cisco:asa,index,netfw -cisco:asa,sourcetype,cisco:asa -cisco:ios,index,netops -cisco:ios,sourcetype,cisco:ios -cisco:nx-os,index,netops -cisco:nx-os,sourcetype,cisco:ios -fgt_event,sourcetype,fgt_event -fgt_event,index,netops -fgt_log,sourcetype,fgt_log -fgt_log,index,netops -fgt_traffic,sourcetype,fgt_traffic -fgt_traffic,index,netfw -fgt_utm,sourcetype,fgt_utm -fgt_utm,index,netids -juniper:structured,index,main -juniper:structured,sourcetype,juniper:structured -juniper:junos:firewall:structured,index,netfw -juniper:junos:firewall:structured,sourcetype,juniper:junos:firewall:structured -juniper:junos:idp:structured,index,netids -juniper:junos:idp:structured,sourcetype,juniper:junos:idp:structured -juniper:junos:firewall,index,netfw -juniper:junos:firewall,sourcetype,juniper:junos:firewall -juniper:junos:idp,index,netids -juniper:junos:idp,sourcetype,juniper:junos:idp -juniper:nsm:idp,index,netids -juniper:nsm:idp,sourcetype,juniper:nsm:idp -juniper:sslvpn,index,netfw -juniper:sslvpn,sourcetype,juniper:sslvpn -juniper:netscreen,index,netfw -juniper:netscreen,sourcetype,netscreen:firewall -juniper:idp,index,netids -juniper:idp,sourcetype,juniper:idp -juniper:idp:structured,index,netids -juniper:idp:structured,sourcetype,juniper:idp:structured -juniper:nsm,index,netids -juniper:nsm,sourcetype,juniper:nsm -juniper:legacy,index,netfw -juniper:legacy,sourcetype,juniper:legacy -pan:traffic,index,netfw -pan:threat,index,netproxy -pan:system,index,netops -pan:config,index,netops -pan:hipwatch,index,main -pan:correlation,index,main -pan:userid,index,netops -pan:unknown,index,main -pan:traffic,sourcetype,pan:traffic -pan:threat,sourcetype,pan:threat -pan:system,sourcetype,pan:system -pan:config,sourcetype,pan:config -pan:hipwatch,sourcetype,pan:hipwatch -pan:correlation,sourcetype,pan:correlation -pan:userid,sourcetype,pan:userid -pan:unknown,sourcetype,pan:unknown -syslog-ng:events,index,main -syslog-ng:events,sourcetype,syslog-ng:events -syslog-ng:fallback,index,main -syslog-ng:fallback,sourcetype,syslog-ng:fallback -syslog-ng:metrics,index,em_metrics -syslog-ng:metrics,sourcetype,httpevent \ No newline at end of file +#bluecoat_proxy,index,netproxy +#cisco_asa,index,netfw +#cisco_ios,index,netops +#cisco_nx_os,index,netops +#fortinet_fortios_event,index,netops +#fortinet_fortios_log,index,netops +#fortinet_fortios_traffic,index,netfw +#fortinet_fortios_utm,index,netids +#juniper_idp,index,netids +#juniper_junos_flow,index,netfw +#juniper_junos_ids,index,netids +#juniper_junos_utm,index,netids +#juniper_sslvpn,index,netfw +#juniper_netscreen,index,netfw +#juniper_nsm,index,netids +#juniper_legacy,index,netops +#pan_traffic,index,netfw +#pan_threat,index,netproxy +#pan_system,index,netops +#pan_config,index,netops +#pan_hipwatch,index,main +#pan_correlation,index,main +#pan_userid,index,netauth +#pan_unknown,index,netops +#syslog-ng_events,index,_internal +#syslog-ng_fallback,index,main +#syslog-ng_metrics,index,em_metrics diff --git a/tests/test_juniper.py b/tests/test_juniper.py index c4bdb81..46e7468 100644 --- a/tests/test_juniper.py +++ b/tests/test_juniper.py @@ -22,7 +22,7 @@ def test_juniper_nsm_standard(record_property, setup_wordlist, get_host_key, set sendsingle(message) - st = env.from_string("search index=netids host=\"jnpnsm-{{ host }}\" sourcetype=\"juniper:nsm\" | head 2") + st = env.from_string("search index=netfw host=\"jnpnsm-{{ host }}\" sourcetype=\"juniper:nsm\" | head 2") search = st.render(host=host) resultCount, eventCount = splunk_single(setup_splunk, search) diff --git a/tests/test_juniper_junos_rfc3164.py b/tests/test_juniper_junos_rfc3164.py index 3ec13ff..5fcca2e 100644 --- a/tests/test_juniper_junos_rfc3164.py +++ b/tests/test_juniper_junos_rfc3164.py @@ -20,7 +20,7 @@ def test_juniper_utm_standard(record_property, setup_wordlist, get_host_key, set sendsingle(message) - st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"juniper:junos:firewall\" | head 2") + st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"juniper:junos:firewall\" | head 2") search = st.render(host=host) resultCount, eventCount = splunk_single(setup_splunk, search) diff --git a/tests/test_juniper_junos_rfc5124.py b/tests/test_juniper_junos_rfc5124.py index b9ff921..978c9a9 100644 --- a/tests/test_juniper_junos_rfc5124.py +++ b/tests/test_juniper_junos_rfc5124.py @@ -22,7 +22,7 @@ def test_juniper_junos_structured(record_property, setup_wordlist, get_host_key, sendsingle(message) - st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"juniper:structured\" | head 2") + st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"juniper:structured\" | head 2") search = st.render(host=host) resultCount, eventCount = splunk_single(setup_splunk, search)