Cargill/OpenSIEM-Logstash-Parsing

Issues

• Field mapping for translating sigma rules to elastalert rules

  #15 opened a year ago by aminemirat
  7

• Mcafee EPO Logstash Pattern required

  #290 opened a year ago by loloprime
  1

• Vector as a Replacement for Logstash

  #444 opened a year ago by saeed-mcu
  0

• GeoLitePrivate2-City.mmdb doesn't exist

  #366 opened a year ago by anubisg1
  3

• [[enrichments]>worker22] ruby - Ruby exception occurred: no implicit conversion of nil into String

  #374 opened a year ago by anubisg1
  4

• cisco processor fails because of missing hostname and lowercase date

  #373 opened 2 years ago by anubisg1
  1

• logstash-filter-verifier

  #33 opened 3 years ago by nnovaes
  0

• [Help / Documentation] - how to classify incoming syslog messages

  #365 opened 2 years ago by anubisg1
  2

• Cisco DNA center timestamps are incorrect

  #46 opened 2 years ago by nnovaes
  0

• Feature Request: Add known applications + risk score field based off destination.port fields

  #78 opened 2 years ago by ryanpodonnell1
  2

• Meraki parsing errors

  #85 opened 2 years ago by nnovaes
  1

• host split enrichment error

  #312 opened 2 years ago by nnovaes
  2

• AWS WAF logtash Pattern Required

  #289 opened 3 years ago by loloprime
  1

• Fix deprecation warnings

  #171 opened 3 years ago by KrishnanandSingh
  2

• Add fields in all configs to enable coverage report

  #172 opened 3 years ago by KrishnanandSingh
  1

• Add grok timeouts

  #200 opened 3 years ago by KrishnanandSingh
  0

• Create instruction for using this code to create automated pipeline

  #5 opened 3 years ago by brian-grabau
  0

• Enable DNS enrichment

  #26 opened 3 years ago by KrishnanandSingh
  0

• Validate ECS fields

  #44 opened 3 years ago by nnovaes
  0

• syslog_log_security_mcafee.net.security.mgr causes elastic to reject events

  #31 opened 3 years ago by KrishnanandSingh
  0

• Update ecs data type enrichment as per our updated ecs 1.9

  #27 opened 3 years ago by KrishnanandSingh
  0

• miter attack framework lookup do not include deprecated id's

  #6 opened 4 years ago by brian-grabau
  0