-
Notifications
You must be signed in to change notification settings - Fork 136
/
machinetag.json
67 lines (67 loc) · 1.53 KB
/
machinetag.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
{
"namespace": "retention",
"expanded": "retention",
"description": "Add a retenion time to events to automatically remove the IDS-flag on ip-dst or ip-src attributes. We calculate the time elapsed based on the date of the event. Supported time units are: d(ays), w(eeks), m(onths), y(ears). The numerical_value is just for sorting in the web-interface and is not used for calculations.",
"version": 3,
"exclusive": true,
"refs": [
"https://en.wikipedia.org/wiki/Retention_period"
],
"predicates": [
{
"value": "expired",
"expanded": "Set when the retention period has expired",
"numerical_value": 0
},
{
"value": "1d",
"expanded": "1 day",
"numerical_value": 1
},
{
"value": "2d",
"expanded": "2 days",
"numerical_value": 2
},
{
"value": "7d",
"expanded": "7 days",
"numerical_value": 7
},
{
"value": "2w",
"expanded": "2 weeks",
"numerical_value": 14
},
{
"value": "1m",
"expanded": "1 month",
"numerical_value": 30
},
{
"value": "2m",
"expanded": "2 months",
"numerical_value": 60
},
{
"value": "3m",
"expanded": "3 months",
"numerical_value": 90
},
{
"value": "6m",
"expanded": "6 months",
"numerical_value": 180
},
{
"value": "1y",
"expanded": "1 year",
"numerical_value": 365
},
{
"value": "10y",
"expanded": "10 year",
"numerical_value": 3650
}
]
}