vee1e/PcapMonkey
1
0
Fork 0
mirror of https://github.com/vee1e/PcapMonkey.git synced 2026-09-01 17:57:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #27 from hariomch/master

Browse source 
Added searches and custom visualizations
This commit is contained in:
Federico 2021-07-13 16:01:52 +02:00 • committed by GitHub
commit da2a06cf6c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 21 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

28
filebeat.ndjson
View file

File diff suppressed because one or more lines are too long

6
kibana.ndjson
View file

@ -1,6 +0,0 @@
{"attributes":{"fieldAttrs":"{\"alert.signature\":{\"count\":3},\"dest_ip\":{\"count\":2},\"dest_port\":{\"count\":2},\"event_type\":{\"count\":1},\"http.hostname\":{\"count\":2},\"http.url\":{\"count\":2},\"src_ip\":{\"count\":2},\"src_port\":{\"count\":2},\"tags\":{\"count\":1},\"host\":{\"count\":1},\"id.orig_h\":{\"count\":1},\"id.orig_p\":{\"count\":1},\"id.resp_h\":{\"count\":1},\"id.resp_p\":{\"count\":1},\"mime_type\":{\"count\":1},\"source\":{\"count\":1},\"uri\":{\"count\":1}}","fields":"[]","timeFieldName":"timestamp","title":"pcapmonkey_original_ts*"},"id":"4aa85480-4691-11eb-bd96-13412c57399a","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"type":"index-pattern","updated_at":"2021-06-18T12:40:55.252Z","version":"WzI2MCwyXQ=="}
{"attributes":{"columns":["alert.signature","src_ip","src_port","dest_ip","dest_port","http.hostname","http.url"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":true,\"disabled\":false,\"type\":\"phrase\",\"key\":\"alert.signature\",\"params\":{\"query\":\"SURICATA Applayer Detect protocol only one direction\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"alert.signature\":\"SURICATA Applayer Detect protocol only one direction\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"event_type\",\"params\":{\"query\":\"alert\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"match_phrase\":{\"event_type\":\"alert\"}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["timestamp","asc"]],"title":"Suricata Alert","version":1},"id":"0c65ae10-d030-11eb-af94-7b8d7d8468c0","migrationVersion":{"search":"7.9.3"},"references":[{"id":"4aa85480-4691-11eb-bd96-13412c57399a","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"4aa85480-4691-11eb-bd96-13412c57399a","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"4aa85480-4691-11eb-bd96-13412c57399a","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","updated_at":"2021-06-18T12:23:54.993Z","version":"WzE0NCwyXQ=="}
{"attributes":{"columns":["id.orig_h","id.resp_p","id.resp_h","id.orig_p","host","uri"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\\\"10.3.11.194\\\" and tags:\\\"zeek_http\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["timestamp","asc"]],"title":"Zeek Http","version":1},"id":"25770a40-d033-11eb-af94-7b8d7d8468c0","migrationVersion":{"search":"7.9.3"},"references":[{"id":"4aa85480-4691-11eb-bd96-13412c57399a","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","updated_at":"2021-06-18T12:46:27.346Z","version":"WzI4MCwyXQ=="}
{"attributes":{"fieldAttrs":"{\"alert.signature\":{\"count\":1},\"event_type\":{\"count\":1},\"tags\":{\"count\":1}}","fields":"[]","timeFieldName":"@timestamp","title":"pcapmonkey*"},"id":"5a143c90-4691-11eb-bd96-13412c57399a","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"type":"index-pattern","updated_at":"2021-06-18T12:12:14.966Z","version":"Wzc5LDJd"}
{"attributes":{"buildNum":38015,"defaultIndex":"4aa85480-4691-11eb-bd96-13412c57399a"},"id":"7.11.2","migrationVersion":{"config":"7.9.0"},"references":[],"type":"config","updated_at":"2021-06-14T12:42:10.823Z","version":"WzIyLDFd"}
{"exportedCount":5,"missingRefCount":0,"missingReferences":[]}

3
prepare.sh Executable file
View file

@ -0,0 +1,3 @@
#!/bin/sh
chmod 644 ./config/filebeat/modules.d/*