We have built a custom parser and mapped some of our fields to additional fields. Parser is active in SecOps. Below are the additional fields mapping. Our requirement is to create a tile in SIEM with the fields dns_host_addr, dns_name, dns_response_time. All these fields have to be included in the table view. Please let us know the steps to create a tabular view with all of these fields.
mutate {
replace => {
"dns_host_addr" => "%{msg.dns_host_addr}"
}
on_error => "DNS_Host_address_replace_error"
}
if ![DNS_Host_address_replace_error] {
mutate {
replace => {
"additional_dnshostaddr" => ""
}
}
mutate {
replace => {
"additional_dnshostaddr.key" => "dns_host_addr"
"additional_dnshostaddr.value.string_value" => "%{dns_host_addr}"
}
on_error => "dns_host_addr_key_value_failed"
}
mutate {
merge => {
"event.idm.read_only_udm.additional.fields" => "additional_dnshostaddr"
}
on_error => "DNS_Host_address_merge_error"
}
}
mutate {
replace => {
"dns_resp_time" => "%{msg.dns_response_time}"
}
on_error => "DNS_Response_time_replace_error"
}
if ![DNS_Response_time_replace_error] {
mutate {
replace => {
"additional_dnsresptime" => ""
}
}
mutate {
replace => {
"additional_dnsresptime.key" => "dns_response_time"
"additional_dnsresptime.value.string_value" => "%{dns_resp_time}"
}
on_error => "dns_resp_time_key_value_replace_failed"
}
mutate {
merge => {
"event.idm.read_only_udm.additional.fields" => "additional_dnsresptime"
}
on_error => "dns_resp_time_merge_error"
}
}
mutate {
replace => {
"dns_name" => "%{msg.dns_name}"
}
on_error => "DNS_Name_replace_error"
}
if ![DNS_Name_replace_error] {
mutate {
replace => {
"additional_dnsname" => ""
}
}
mutate {
replace => {
"additional_dnsname.key" => "dns_name"
"additional_dnsname.value.string_value" => "%{dns_name}"
}
on_error => "dns_name_key_value_replace_failed"
}
mutate {
merge => {
"event.idm.read_only_udm.additional.fields" => "additional_dnsname"
}
on_error => "dns_name_merge_failed"
}
}
