Skip to content

Commit 104ac22

Browse files
tarnopolskyitarnopolskyi
authored
Merge pull request #70 from UncoderIO/logrhythm-axon-render
Logrhythm axon render
2 parents f94eec5 + 02845b4 commit 104ac22

File tree

10 files changed

+779
-4
lines changed

10 files changed

+779
-4
lines changed

‎translator/app/translator/core/models/parser_output.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
from app.translator.core.custom_types.meta_info import SeverityType
77
from app.translator.core.mapping import DEFAULT_MAPPING_NAME
8+
from app.translator.core.models.field import Field
89
from app.translator.core.models.functions.base import ParsedFunctions
910

1011

@@ -17,6 +18,7 @@ def __init__(
1718
description: Optional[str] = None,
1819
author: Optional[str] = None,
1920
date: Optional[str] = None,
21+
fields: Optional[list[Field]] = None,
2022
license_: Optional[str] = None,
2123
severity: Optional[str] = None,
2224
references: Optional[list[str]] = None,
@@ -25,20 +27,23 @@ def __init__(
2527
status: Optional[str] = None,
2628
false_positives: Optional[list[str]] = None,
2729
source_mapping_ids: Optional[list[str]] = None,
30+
parsed_logsources: Optional[dict] = None
2831
) -> None:
2932
self.id = id_ or str(uuid.uuid4())
3033
self.title = title or ""
3134
self.description = description or ""
3235
self.author = author or ""
3336
self.date = date or datetime.now().date().strftime("%Y-%m-%d")
3437
self.license = license_ or "DRL 1.1"
38+
self.fields = fields or []
3539
self.severity = severity or SeverityType.low
3640
self.references = references or []
3741
self.tags = tags or []
3842
self.mitre_attack = mitre_attack or {}
3943
self.status = status or "stable"
4044
self.false_positives = false_positives or []
4145
self.source_mapping_ids = source_mapping_ids or [DEFAULT_MAPPING_NAME]
46+
self.parsed_logsources = parsed_logsources or {}
4247

4348

4449
@dataclass

‎translator/app/translator/mappings/platforms/logrhythm_axon/default.yml

Lines changed: 304 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,304 @@
1+
platform: LogRhythm Axon
2+
source: default
3+
description: Text that describe current mapping
4+
5+
field_mapping:
6+
EventID: vendor_information.id
7+
Channel: general_information.log_source.type_name
8+
ComputerName: origin.host.name
9+
FileName: object.file.name
10+
ProcessId: object.process.id
11+
Image: object.process.name
12+
AccountEmail: unattributed.account.email_address
13+
ContextInfo: general_information.raw_message
14+
CurrentDirectory: object.process.path
15+
ParentProcessId: object.process.parent_process.id
16+
ParentImage: object.process.parent_process.path
17+
ParentCommandLine: object.process.parent_process.command_line
18+
TargetFilename: object.file.name
19+
SourceIp: origin.host.ip_address.value
20+
SourceHostname: origin.host.name
21+
SourcePort: origin.host.network_port.value
22+
DestinationIp: target.host.ip_address.value
23+
DestinationHostname:
24+
- target.host.name
25+
- target.host.domain
26+
DestinationPort: target.host.network_port.value
27+
DestinationPortName: action.network.protocol.name
28+
ImageLoaded: object.file.path
29+
SignatureStatus: object.process.signature.status
30+
SourceProcessId: object.process.id
31+
SourceImage: object.process.name
32+
Device: object.process.path
33+
Destination: object.process.name
34+
QueryName: action.dns.query
35+
QueryStatus: action.dns.result
36+
CommandName: object.process.command_line
37+
CommandPath: object.process.path
38+
HostApplication: object.script.command_line
39+
HostName: origin.host.name
40+
ScriptName: object.script.name
41+
ScriptBlockText: object.script.command_line
42+
ScriptBlockId: object.script.id
43+
Application: object.process.name
44+
ClientAddress: origin.host.ip_address.value
45+
ClientName: origin.host.domain.name
46+
DestAddress: target.host.ip_address.value
47+
DestPort: target.host.network_port.value
48+
IpAddress: origin.host.ip_address.value
49+
IpPort: origin.host.network_port.value
50+
NewProcessId: object.process.id
51+
NewProcessName: object.process.name
52+
ParentProcessName: object.process.parent_process.name
53+
ProcessName: object.process.name
54+
SourceAddress: origin.host.ip_address.value
55+
WorkstationName: origin.host.name
56+
destination.port: target.host.network_port.value
57+
dst: target.host.ip_address.value
58+
dst_ip: target.host.ip_address.value
59+
dst_port: target.host.network_port.value
60+
network_application:
61+
- action.network.protocol.name
62+
- object.url.protocol
63+
network_protocol: action.network.protocol.name
64+
proto: action.network.protocol.name
65+
src: origin.host.ip_address.value
66+
src_ip: origin.host.ip_address.value
67+
src_port: origin.host.network_port.value
68+
action: action.command
69+
mqtt_action: action.command
70+
smb_action: action.command
71+
tunnel_action: action.command
72+
arg: object.process.command_args
73+
ftp_arg: object.process.command_args
74+
mysql_arg: object.process.command_args
75+
pop3_arg: object.process.command_args
76+
client: origin.host.ip_address.value
77+
command: action.command
78+
ftp_command: action.command
79+
irc_command: action.command
80+
pop3_command: action.command
81+
duration: action.duration
82+
from: origin.account.email_address
83+
kerberos_from: origin.account.email_address
84+
smtp_from: origin.account.email_address
85+
method: action.network.http_method
86+
http_method: action.network.http_method
87+
sip_method: action.network.http_method
88+
name: object.file.name
89+
smb_files_name: object.file.name
90+
software_name: object.file.name
91+
weird_name: object.file.name
92+
path: object.file.path
93+
smb_mapping_path: object.file.path
94+
smb_files_path: object.file.path
95+
smtp_files_path: object.file.path
96+
password: object.file.name
97+
reply_to: target.account.email_address
98+
response_body_len: action.network.byte_information.received
99+
request_body_len: action.network.byte_information.sent
100+
rtt: action.duration
101+
status_code: action.result.code
102+
known_certs_subject: object.certificate.subject
103+
sip_subject: object.email_message.subject
104+
smtp_subject: object.email_message.subject
105+
ssl_subject: object.certificate.subject
106+
username: origin.account.name
107+
uri: object.url.path
108+
user: origin.account.name
109+
user_agent: action.user_agent
110+
http_user_agent: action.user_agent
111+
gquic_user_agent: action.user_agent
112+
sip_user_agent: action.user_agent
113+
smtp_user_agent: action.user_agent
114+
version: object.file.version
115+
gquic_version: object.file.version
116+
http_version: object.file.version
117+
ntp_version: object.file.version
118+
socks_version: object.file.version
119+
snmp_version: object.file.version
120+
ssh_version: object.file.version
121+
tls_version: object.file.version
122+
answer: action.dns.result
123+
question_length: action.network.byte_information.total
124+
record_type: action.dns.record_type
125+
parent_domain: target.host.domain
126+
cs-bytes: action.network.byte_information.received
127+
r-dns: target.host.domain
128+
sc-bytes: action.network.byte_information.received
129+
sc-status: action.result.code
130+
c-uri: object.url.complete
131+
c-uri-extension: object.url.type
132+
c-uri-query: object.url.query
133+
c-uri-stem: object.url.complete
134+
c-useragent: action.user_agent
135+
cs-host:
136+
- target.host.name
137+
- target.host.domain
138+
cs-method: action.network.http_method
139+
cs-version: object.file.version
140+
uid: action.session.id
141+
endpoint: origin.host.name
142+
domain: target.host.domain
143+
host_name: target.host.name
144+
client_fqdn: origin.host.name
145+
requested_addr: target.host.ip_address.value
146+
server_addr: target.host.ip_address.value
147+
qtype: action.dns.record_type
148+
qtype_name: action.dns.record_type
149+
query: action.dns.query
150+
rcode_name: action.dns.result
151+
md5: unattributed.hash.md5
152+
sha1: unattributed.hash.sha1
153+
sha256: unattributed.hash.sha256
154+
sha512: unattributed.hash.sha512
155+
filename: object.file.name
156+
host:
157+
- unattributed.host.name
158+
- unattributed.host.ip_address.value
159+
domainname: unattributed.host.name
160+
hostname: unattributed.host.name
161+
server_nb_computer_name: unattributed.host.name
162+
server_tree_name: unattributed.host.name
163+
server_dns_computer_name: unattributed.host.name
164+
machine: unattributed.host.name
165+
os: origin.host.os.platform
166+
mac: unattributed.host.mac_address
167+
result:
168+
- action.result.message
169+
- action.result.code
170+
- action.result.reason
171+
mailfrom: origin.account.email_address
172+
rcptto: target.account.email_address
173+
second_received: target.account.email_address
174+
server_name: unattributed.host.name
175+
c-ip: origin.host.ip_address.value
176+
cs-uri: object.url.path
177+
cs-uri-query: object.url.query
178+
cs-uri-stem: object.url.complete
179+
clientip: origin.host.ip_address.value
180+
clientIP: origin.host.ip_address.value
181+
dest_domain:
182+
- target.host.name
183+
- target.host.domain
184+
dest_ip: target.host.ip_address.value
185+
dest_port: target.host.network_port.value
186+
agent.version: object.file.version
187+
destination.hostname:
188+
- target.host.name
189+
- target.host.domain
190+
DestinationAddress:
191+
- target.host.name
192+
- target.host.domain
193+
- target.host.ip_address.value
194+
DestinationIP: target.host.ip_address.value
195+
dst-ip: target.host.ip_address.value
196+
dstip: target.host.ip_address.value
197+
dstport: target.host.ip_address.value
198+
Host: target.host.name
199+
HostVersion: object.file.version
200+
http_host:
201+
- target.host.name
202+
- target.host.domain
203+
- target.host.ip_address.value
204+
http_uri: object.url.path
205+
http_url: object.url.complete
206+
http.request.url-query-params: object.url.query
207+
HttpMethod: action.network.http_method
208+
in_url: object.url.path
209+
post_url_parameter: object.url.path
210+
Request_Url: object.url.complete
211+
request_url: object.url.complete
212+
request_URL: object.url.complete
213+
RequestUrl: object.url.complete
214+
resource.url: object.url.path
215+
resource.URL: object.url.path
216+
sc_status: action.result.code
217+
sender_domain:
218+
- target.host.name
219+
- target.host.domain
220+
service.response_code: action.result.code
221+
source:
222+
- origin.host.name
223+
- origin.host.domain.name
224+
- origin.host.ip_address.value
225+
SourceAddr: origin.host.ip_address.value
226+
SourceIP: origin.host.ip_address.value
227+
SourceNetworkAddress: origin.host.ip_address.value
228+
srcip: origin.host.ip_address.value
229+
Status: action.result.code
230+
status: action.result.code
231+
url: object.url.path
232+
URL: object.url.path
233+
url_query: object.url.query
234+
url.query: object.url.query
235+
uri_path: object.url.path
236+
user_agent.name: action.user_agent
237+
user-agent: action.user_agent
238+
User-Agent: action.user_agent
239+
useragent: action.user_agent
240+
UserAgent: action.user_agent
241+
User_Agent: action.user_agent
242+
web_dest:
243+
- target.host.name
244+
- target.host.domain
245+
- target.host.ip_address.value
246+
- object.url.domain
247+
web.dest:
248+
- target.host.name
249+
- target.host.domain
250+
- target.host.ip_address.value
251+
- object.url.domain
252+
Web.dest:
253+
- target.host.name
254+
- target.host.domain
255+
- target.host.ip_address.value
256+
- object.url.domain
257+
web.host:
258+
- target.host.name
259+
- target.host.domain
260+
- target.host.ip_address.value
261+
- object.url.domain
262+
Web.host:
263+
- target.host.name
264+
- target.host.domain
265+
- target.host.ip_address.value
266+
- object.url.domain
267+
web_method: action.network.http_method
268+
Web_method: action.network.http_method
269+
web.method: action.network.http_method
270+
Web.method: action.network.http_method
271+
web_src: origin.host.ip_address.value
272+
web_status: action.result.code
273+
Web_status: action.result.code
274+
web.status: action.result.code
275+
Web.status: action.result.code
276+
web_uri: object.url.path
277+
web_url: object.url.complete
278+
destination.ip: target.host.ip_address.value
279+
source.ip: origin.host.ip_address.value
280+
source.port: origin.host.ip_address.value
281+
Computer:
282+
- target.host.name
283+
- target.host.domain
284+
- target.host.ip_address.value
285+
OriginalFileName: object.file.name
286+
User: origin.account.name
287+
EventType: action.command
288+
TargetObject:
289+
- object.registry_object.key
290+
- object.registry_object.path
291+
- object.resource.name
292+
CommandLine: object.process.command_line
293+
type:
294+
- action.command
295+
- action.type
296+
- action.session.type
297+
a0:
298+
- object.process.command_line
299+
- object.process.command_args
300+
- object.process.name
301+
cs-user-agent: action.user_agent
302+
blocked:
303+
- action.message
304+
- action.result.reason

‎translator/app/translator/platforms/__init__.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
from app.translator.platforms.graylog.renders.graylog import GraylogRender
2525
from app.translator.platforms.graylog.renders.graylog_cti import GraylogCTI
2626
from app.translator.platforms.logpoint.renders.logpoint_cti import LogpointCTI
27+
from app.translator.platforms.logrhythm_axon.renders.logrhythm_axon_query import LogRhythmAxonQueryRender
28+
from app.translator.platforms.logrhythm_axon.renders.logrhythm_axon_rule import LogRhythmAxonRuleRender
2729
from app.translator.platforms.logscale.parsers.logscale import LogScaleParser
2830
from app.translator.platforms.logscale.parsers.logscale_alert import LogScaleAlertParser
2931
from app.translator.platforms.logscale.renders.logscale_cti import LogScaleCTI
@@ -71,6 +73,8 @@
7173
ChronicleSecurityRuleRender(),
7274
AthenaQueryRender(),
7375
ElasticSearchQueryRender(),
76+
LogRhythmAxonQueryRender(),
77+
LogRhythmAxonRuleRender(),
7478
LogScaleQueryRender(),
7579
LogScaleAlertRender(),
7680
ElasticSearchRuleRender(),

‎translator/app/translator/platforms/logrhythm_axon/__init__.py

Whitespace-only changes.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy