Merge branch '1.0' into pp_file_mime

Cargill · Nov 5, 2024 · d6de905 · d6de905
2 parents 9442ee6 + 6edc54a
commit d6de905
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/config/processors/api_security_aws.guardduty.conf b/config/processors/api_security_aws.guardduty.conf
@@ -10,11 +10,13 @@ filter {
     source => "message"
     target => "guard"
   }
+  mutate {
+   remove_field => [ "host", "event" ]
+  }
   mutate {
     add_field => { "[cloud][provider]" => "aws" }
     add_field => { "[event][module]" => "aws" }
     add_field => { "[event][dataset]" => "aws.guardduty" } 
-    remove_field => [ "host", "event" ]   
   }
   ruby {
     init => '@ignore = [ "path", "@timestamp", "@metadata", "host", "@version" ]'

diff --git a/config/processors/syslog_security_symantec.endpoint.conf b/config/processors/syslog_security_symantec.endpoint.conf
@@ -410,7 +410,7 @@ filter {
     rename => {"[sepm][Source]" => "[log][logger]"}
     rename => {"[sepm][Disposition]" => "[error][type]"}
     rename => {"[sepm][Event Type]" => "[event][category]"}
-    remove_field => ["[log][date_time]", "[event][created]", "[received][date_time]", "actual_msg"]
+    remove_field => ["[log][date_time]", "[received][date_time]", "actual_msg"]
   }
   if [rule][id] {
     mutate {
@@ -468,7 +468,7 @@ filter {
 
   if [event][start] {
     date {
-      match => ["[event][start]" , "yyyy-MM-dd HH:mm:ss"]
+      match => ["[event][start]", "ISO8601", "yyyy-MM-dd HH:mm:ss", "MMM dd HH:mm:ss"]
       timezone => "GMT"
       locale => "en"
       target => "[event][start]"
@@ -482,7 +482,7 @@ filter {
   }
   if [event][end] {
     date {
-      match => ["[event][end]" , "yyyy-MM-dd HH:mm:ss"]
+      match => ["[event][end]", "ISO8601", "yyyy-MM-dd HH:mm:ss", "MMM dd HH:mm:ss"]
       timezone => "GMT"
       locale => "en"
       target => "[event][end]"