2019-05-16 23:33:51 +02:00
|
|
|
title: SumoLogic
|
2019-04-23 00:54:10 +02:00
|
|
|
order: 20
|
2019-05-20 01:00:33 +02:00
|
|
|
backends:
|
|
|
|
|
- sumologic
|
2018-12-09 17:55:51 -05:00
|
|
|
# Sumulogic mapping depends on customer configuration. Adapt to your context!
|
|
|
|
|
# typically rule on _sourceCategory, _index or Field Extraction Rules (FER)
|
|
|
|
|
# supposing existing FER for service, EventChannel, EventID
|
|
|
|
|
logsources:
|
2019-07-06 10:05:43 -04:00
|
|
|
unix:
|
|
|
|
|
product: unix
|
|
|
|
|
index: UNIX
|
2018-12-09 17:55:51 -05:00
|
|
|
linux:
|
|
|
|
|
product: linux
|
2018-12-10 22:37:39 +01:00
|
|
|
index: LINUX
|
2018-12-09 17:55:51 -05:00
|
|
|
linux-sshd:
|
|
|
|
|
product: linux
|
|
|
|
|
service: sshd
|
2018-12-10 22:37:39 +01:00
|
|
|
index: LINUX
|
2018-12-09 17:55:51 -05:00
|
|
|
linux-auth:
|
|
|
|
|
product: linux
|
|
|
|
|
service: auth
|
2018-12-10 22:37:39 +01:00
|
|
|
index: LINUX
|
2018-12-09 17:55:51 -05:00
|
|
|
linux-clamav:
|
|
|
|
|
product: linux
|
|
|
|
|
service: clamav
|
2018-12-10 22:37:39 +01:00
|
|
|
index: LINUX
|
2018-12-09 17:55:51 -05:00
|
|
|
windows:
|
|
|
|
|
product: windows
|
2018-12-10 22:37:39 +01:00
|
|
|
index: WINDOWS
|
2018-12-09 17:55:51 -05:00
|
|
|
windows-sysmon:
|
|
|
|
|
product: windows
|
|
|
|
|
service: sysmon
|
|
|
|
|
conditions:
|
|
|
|
|
EventChannel: Microsoft-Windows-Sysmon
|
2018-12-10 22:37:39 +01:00
|
|
|
index: WINDOWS
|
2018-12-09 17:55:51 -05:00
|
|
|
windows-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: security
|
|
|
|
|
conditions:
|
|
|
|
|
EventChannel: Security
|
2018-12-10 22:37:39 +01:00
|
|
|
index: WINDOWS
|
2018-12-09 17:55:51 -05:00
|
|
|
windows-powershell:
|
|
|
|
|
product: windows
|
|
|
|
|
service: powershell
|
|
|
|
|
conditions:
|
|
|
|
|
EventChannel: Microsoft-Windows-Powershell
|
2018-12-10 22:37:39 +01:00
|
|
|
index: WINDOWS
|
2018-12-09 17:55:51 -05:00
|
|
|
windows-system:
|
|
|
|
|
product: windows
|
|
|
|
|
service: system
|
|
|
|
|
conditions:
|
|
|
|
|
EventChannel: System
|
2018-12-10 22:37:39 +01:00
|
|
|
index: WINDOWS
|
2019-02-05 14:35:16 +01:00
|
|
|
windows-dhcp:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dhcp
|
2019-12-07 00:23:30 +01:00
|
|
|
conditions:
|
2019-02-05 14:35:16 +01:00
|
|
|
EventChannel: Microsoft-Windows-DHCP-Server
|
|
|
|
|
index: WINDOWS
|
2018-12-09 17:55:51 -05:00
|
|
|
apache:
|
|
|
|
|
product: apache
|
|
|
|
|
service: apache
|
2018-12-10 22:37:39 +01:00
|
|
|
index: WEBSERVER
|
2019-07-06 10:56:37 -04:00
|
|
|
apache2:
|
|
|
|
|
product: apache
|
|
|
|
|
index: WEBSERVER
|
2019-07-06 10:05:43 -04:00
|
|
|
webserver:
|
|
|
|
|
category: webserver
|
|
|
|
|
index: WEBSERVER
|
2018-12-09 17:55:51 -05:00
|
|
|
firewall:
|
2019-07-06 10:56:37 -04:00
|
|
|
category: firewall
|
|
|
|
|
index: FIREWALL
|
|
|
|
|
firewall2:
|
2018-12-09 17:55:51 -05:00
|
|
|
product: firewall
|
2018-12-10 22:37:39 +01:00
|
|
|
index: FIREWALL
|
2019-07-06 10:05:43 -04:00
|
|
|
network-dns:
|
2019-07-06 10:56:37 -04:00
|
|
|
category: dns
|
|
|
|
|
index: DNS
|
|
|
|
|
network-dns2:
|
2019-07-06 10:05:43 -04:00
|
|
|
product: dns
|
|
|
|
|
index: DNS
|
2019-07-06 10:56:37 -04:00
|
|
|
proxy:
|
|
|
|
|
category: proxy
|
|
|
|
|
index: PROXY
|
|
|
|
|
antivirus:
|
|
|
|
|
product: antivirus
|
|
|
|
|
index: ANTIVIRUS
|
2019-07-06 10:05:43 -04:00
|
|
|
application-sql:
|
|
|
|
|
product: sql
|
|
|
|
|
index: DATABASE
|
|
|
|
|
application-python:
|
|
|
|
|
product: python
|
|
|
|
|
index: APPLICATIONS
|
|
|
|
|
application-django:
|
|
|
|
|
product: django
|
|
|
|
|
index: DJANGO
|
|
|
|
|
application-rails:
|
|
|
|
|
product: rails
|
|
|
|
|
index: RAILS
|
|
|
|
|
application-spring:
|
|
|
|
|
product: spring
|
2019-07-06 10:56:37 -04:00
|
|
|
index: SPRING
|
2018-12-09 17:55:51 -05:00
|
|
|
# if no index, search in all indexes
|
