[Rule Tuning] Add Packetbeat Index to Network Rules

[peasead]

Description

The Packetbeat Index needs to be added to network SIEM rules.

Filebeat was originally used to take advantage of the Zeek and Suricata network data modules. While Packetbeat is not a full-fledged protocol analyzer like Zeek, or even Suricata, it can act as a data source for these rules.

Example Data

Existing Index designation: index = ["filebeat-*"]
Suggested Index designation: index = ["filebeat-*", "packetbeat-*"]

[ghost]

You probably also want to add the auditbeat-* index as well. We dont run packetbeat on every host, but we do run auditbeat, which is actually where we get more hits (thanks so its socket module)

See this tweet for details

[peasead]

Thanks for the feedback, @Ares3266

I agree, adding auditbeat-* is a great idea. I can circle back on this with a fresh Issue/PR in the future, or please feel free to contribute it.

[rw-access]

@Ares3266 I created #35 for adding auditbeat to the rules