IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Zeek (Bro) Module
editZeek (Bro) Module
editThis is a module for Zeek, which used to be called Bro. It parses logs that are in the Zeek JSON format.
The Zeek SSL fileset will handle fields from these scripts if they are installed in Zeek.
Read the quick start to learn how to configure and run modules.
Compatibility
editThis module has been developed against Zeek 2.6.1, but is expected to work with newer versions of Zeek.
Zeek requires a Unix-like platform, and it currently supports Linux, FreeBSD, and Mac OS X.
capture_loss
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
connection
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dce_rpc
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dhcp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dnp3
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dns
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dpd
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
files
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
ftp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
files
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
http
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
intel
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
irc
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
kerberos
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
modbus
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
mysql
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
notice
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ntls
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ntp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ocsp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
pe
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
radius
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
rdp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
rfb
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
signature
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
sip
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smb_cmd
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smb_files
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smb_mapping
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smtp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
snmp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
socks
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ssh
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ssl
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
stats
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
syslog
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
traceroute
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
tunnel
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
weird
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
x509
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
Example dashboard
editThis module comes with a sample dashboard. For example:
Fields
editFor a description of each field in the module, see the exported fields section.