зеркало из https://github.com/mozilla/MozDef.git
134 строки
2.9 KiB
JSON
134 строки
2.9 KiB
JSON
{
|
|
"order": 0,
|
|
"index_patterns": [
|
|
["events*", "alerts*"]
|
|
],
|
|
"settings": {},
|
|
"mappings": {
|
|
"_doc": {
|
|
"dynamic_templates": [
|
|
{
|
|
"string_fields": {
|
|
"mapping": {
|
|
"type": "keyword"
|
|
},
|
|
"match": "*",
|
|
"match_mapping_type": "string"
|
|
}
|
|
},
|
|
{
|
|
"binary_fields": {
|
|
"mapping": {
|
|
"type": "keyword"
|
|
},
|
|
"match": "*",
|
|
"match_mapping_type": "binary"
|
|
}
|
|
},
|
|
{
|
|
"double_fields": {
|
|
"mapping": {
|
|
"type": "keyword"
|
|
},
|
|
"match": "*",
|
|
"match_mapping_type": "double"
|
|
}
|
|
},
|
|
{
|
|
"long_fields": {
|
|
"mapping": {
|
|
"type": "keyword"
|
|
},
|
|
"match": "*",
|
|
"match_mapping_type": "long"
|
|
}
|
|
}
|
|
],
|
|
"properties": {
|
|
"type": {
|
|
"type": "keyword"
|
|
},
|
|
"category": {
|
|
"type": "keyword"
|
|
},
|
|
"hostname": {
|
|
"type": "keyword"
|
|
},
|
|
"processid": {
|
|
"type": "keyword"
|
|
},
|
|
"processname": {
|
|
"type": "keyword"
|
|
},
|
|
"severity": {
|
|
"type": "keyword"
|
|
},
|
|
"source": {
|
|
"type": "keyword"
|
|
},
|
|
"summary": {
|
|
"type": "text"
|
|
},
|
|
"details": {
|
|
"properties": {
|
|
"sourceipaddress": {
|
|
"type": "ip"
|
|
},
|
|
"sourceipv4address": {
|
|
"type": "keyword"
|
|
},
|
|
"destinationipaddress": {
|
|
"type": "ip"
|
|
},
|
|
"destinationport": {
|
|
"type": "keyword"
|
|
},
|
|
"destinationipgeopoint": {
|
|
"type": "geo_point"
|
|
},
|
|
"sourceipgeopoint": {
|
|
"type": "geo_point"
|
|
},
|
|
"success": {
|
|
"type": "boolean"
|
|
},
|
|
"sourceport": {
|
|
"type": "keyword"
|
|
},
|
|
"apiversion": {
|
|
"properties": {
|
|
"raw_value": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"requestparameters": {
|
|
"properties": {
|
|
"logstreamname": {
|
|
"properties": {
|
|
"raw_value": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"receivedtimestamp": {
|
|
"format": "dateOptionalTime",
|
|
"type": "date"
|
|
},
|
|
"utctimestamp": {
|
|
"format": "dateOptionalTime",
|
|
"type": "date"
|
|
},
|
|
"version": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"aliases": {}
|
|
}
|