mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
76 lines
1.6 KiB
YAML
76 lines
1.6 KiB
YAML
name: Bro
|
|
id: c5d9612b-0ffd-44d3-8247-3cf3486ec5e2
|
|
author: Patrick Bareiss, Splunk
|
|
source: bro:http:json
|
|
sourcetype: bro:http:json
|
|
supported_TA: {}
|
|
event_names: []
|
|
fields:
|
|
- _time
|
|
- bytes
|
|
- bytes_in
|
|
- bytes_out
|
|
- dest
|
|
- dest_host
|
|
- dest_ip
|
|
- dest_port
|
|
- direction
|
|
- dvc
|
|
- eventtype
|
|
- flow_id
|
|
- host
|
|
- host_header
|
|
- http_content_type
|
|
- http_method
|
|
- http_user_agent
|
|
- http_user_agent_length
|
|
- id.orig_h
|
|
- id.orig_p
|
|
- id.resp_h
|
|
- id.resp_p
|
|
- id_orig_h
|
|
- id_orig_p
|
|
- id_resp_h
|
|
- index
|
|
- is_broadcast
|
|
- is_dest_internal_ip
|
|
- is_src_internal_ip
|
|
- linecount
|
|
- method
|
|
- product
|
|
- punct
|
|
- request_body_len
|
|
- resp_fuids
|
|
- resp_fuids{}
|
|
- resp_mime_types
|
|
- resp_mime_types{}
|
|
- response_body_len
|
|
- sensor_name
|
|
- site
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- src
|
|
- src_ip
|
|
- src_port
|
|
- status
|
|
- status_code
|
|
- status_msg
|
|
- tag
|
|
- tag::eventtype
|
|
- timestamp
|
|
- trans_depth
|
|
- ts
|
|
- uid
|
|
- uri
|
|
- uri_path
|
|
- uri_query
|
|
- url
|
|
- user_agent
|
|
- vendor
|
|
- vendor_product
|
|
- version
|
|
example_log:
|
|
'{"ts":"2022-10-26T18:00:59.345538Z","uid":"CobZQ21IIZvzswjyjh","id.orig_h":"10.0.1.15","id.orig_p":16976,"id.resp_h":"10.0.1.20","id.resp_p":8080,"trans_depth":1,"method":"GET","host":"10.0.1.20","uri":"/?q=${url:UTF-8:https://10.0.1.20:8080.q.cdcnbmk03o13j77svqvgpu44hdbnhypcq.oast.site}","version":"1.1","user_agent":"Mozilla/5.0
|
|
(Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","request_body_len":0,"response_body_len":121,"status_code":404,"status_msg":"","tags":[],"resp_fuids":["FxuRnn2rNk2RjIfQQ8"],"resp_mime_types":["text/json"]}'
|