/
pipeline.tee.no_elk.json
47 lines (47 loc) · 1.22 KB
/
pipeline.tee.no_elk.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
{
"pipeline":[
{
"processor": "sysflowreader",
"handler": "flattener",
"in": "sysflow sysflowchan",
"out": ["flat flattenerchan", "flatraw flattenerchan"]
},
{
"processor": "policyengine",
"in": "flat flattenerchan",
"out": "evt eventchan",
"mode": "alert",
"policies": "/usr/local/sysflow/resources/elk/policies/ttps.yaml"
},
{
"processor": "policyengine",
"in": "flatraw flattenerchan",
"out": "evtraw eventchan",
"mode": "bypass"
},
{
"processor": "exporter",
"in": "evt eventchan",
"export": "es",
"format": "ecs",
"es.addresses": "https://172.17.0.1:9200",
"es.index": "sysflow-alerts",
"es.username": "elastic",
"es.password": "changeme",
"es.bulk.numWorkers": "1",
"buffer": "50"
},
{
"processor": "exporter",
"in": "evtraw eventchan",
"export": "es",
"format": "ecs",
"es.addresses": "https://172.17.0.1:9200",
"es.index": "sysflow-events",
"es.username": "elastic",
"es.password": "changeme",
"es.bulk.numWorkers": "1",
"buffer": "1000"
}
]
}