adding vuln cve parsing

Cargill · Sep 23, 2024 · 4f7db78 · 4f7db78
1 parent 530ef53
commit 4f7db78
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/config/processors/syslog_security_symantec.endpoint.conf b/config/processors/syslog_security_symantec.endpoint.conf
@@ -531,6 +531,11 @@ filter {
       remove_field => ["[event][name]"]
     }
   }
+  if [rule][name] =~ "^.*?(cve|CVE)-\d+-\d+" {
+    grok {
+    match => { "[rule][name]" => "^.*?(?<[vulnerability][id]>(cve|CVE)-\d+-\d+)" }
+    }
+  }
 }
 output {
   pipeline { send_to => [enrichments] }