diff --git a/_meta/fields.generated.yml b/_meta/fields.generated.yml index 813da42..548f1ce 100644 --- a/_meta/fields.generated.yml +++ b/_meta/fields.generated.yml @@ -5,26 +5,26 @@ - name: plugin_id type: long - name: cve - type: text + type: keyword - name: cvss - type: text + type: keyword - name: risk - type: text + type: keyword - name: host - type: text + type: keyword - name: protocol - type: text + type: keyword - name: port type: long - name: name - type: text + type: keyword - name: synopsis - type: text + type: keyword - name: description - type: text + type: keyword - name: solution - type: text + type: keyword - name: see_also - type: text + type: keyword - name: plugin_output - type: text + type: keyword diff --git a/_meta/fields.yml b/_meta/fields.yml index 813da42..548f1ce 100644 --- a/_meta/fields.yml +++ b/_meta/fields.yml @@ -5,26 +5,26 @@ - name: plugin_id type: long - name: cve - type: text + type: keyword - name: cvss - type: text + type: keyword - name: risk - type: text + type: keyword - name: host - type: text + type: keyword - name: protocol - type: text + type: keyword - name: port type: long - name: name - type: text + type: keyword - name: synopsis - type: text + type: keyword - name: description - type: text + type: keyword - name: solution - type: text + type: keyword - name: see_also - type: text + type: keyword - name: plugin_output - type: text + type: keyword diff --git a/_meta/kibana/5.x/index-pattern/nessusbeat.json b/_meta/kibana/5.x/index-pattern/nessusbeat.json new file mode 100644 index 0000000..ffe1107 --- /dev/null +++ b/_meta/kibana/5.x/index-pattern/nessusbeat.json @@ -0,0 +1,6 @@ +{ + "fields": "[{\"name\": \"beat.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.hostname\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.timezone\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.version\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"@timestamp\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"date\"}, {\"name\": \"tags\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"fields\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"error.message\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"error.code\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"error.type\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.provider\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.instance_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.instance_name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.machine_type\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.availability_zone\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.project_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.region\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.image\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.labels\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.pod.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.namespace\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.labels\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.annotations\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.container.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.container.image\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"plugin_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"cve\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"cvss\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"risk\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"host\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"protocol\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"port\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"synopsis\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"description\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"solution\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"see_also\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"plugin_output\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_id\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_type\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"_index\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_score\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"number\"}]", + "fieldFormatMap": "{\"@timestamp\": {\"id\": \"date\"}}", + "timeFieldName": "@timestamp", + "title": "nessusbeat-*" +} \ No newline at end of file diff --git a/_meta/kibana/default/index-pattern/nessusbeat.json b/_meta/kibana/default/index-pattern/nessusbeat.json new file mode 100644 index 0000000..b248a9c --- /dev/null +++ b/_meta/kibana/default/index-pattern/nessusbeat.json @@ -0,0 +1,16 @@ +{ + "version": "7.0.0-alpha1", + "objects": [ + { + "type": "index-pattern", + "id": "nessusbeat-*", + "version": 1, + "attributes": { + "fields": "[{\"name\": \"beat.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.hostname\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.timezone\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.version\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"@timestamp\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"date\"}, {\"name\": \"tags\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"fields\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"error.message\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"error.code\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"error.type\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.provider\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.instance_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.instance_name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.machine_type\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.availability_zone\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.project_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.region\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.image\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"docker.container.labels\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.pod.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.namespace\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.labels\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.annotations\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.container.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.container.image\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"plugin_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"cve\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"cvss\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"risk\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"host\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"protocol\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"port\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"synopsis\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"description\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"solution\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"see_also\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"plugin_output\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_id\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_type\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"_index\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_score\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"number\"}]", + "fieldFormatMap": "{\"@timestamp\": {\"id\": \"date\"}}", + "timeFieldName": "@timestamp", + "title": "nessusbeat-*" + } + } + ] +} \ No newline at end of file diff --git a/_meta/kibana/index-pattern/nessusbeat.json b/_meta/kibana/index-pattern/nessusbeat.json index ef1fac4..b407a7e 100644 --- a/_meta/kibana/index-pattern/nessusbeat.json +++ b/_meta/kibana/index-pattern/nessusbeat.json @@ -1,6 +1,6 @@ { - "fields": "[{\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"beat.name\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"beat.hostname\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"beat.timezone\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"beat.version\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"@timestamp\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"date\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"tags\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"fields\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"error.message\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"error.code\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"number\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"error.type\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"meta.cloud.provider\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"meta.cloud.instance_id\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"meta.cloud.instance_name\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"meta.cloud.machine_type\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"meta.cloud.availability_zone\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"meta.cloud.project_id\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"meta.cloud.region\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"kubernetes.pod.name\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"kubernetes.namespace\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"kubernetes.labels\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"kubernetes.annotations\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"kubernetes.container.name\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"kubernetes.container.image\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"plugin_id\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"number\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"cve\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"cvss\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"risk\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"host\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"protocol\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"port\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"number\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"name\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"synopsis\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"description\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"solution\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"see_also\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"plugin_output\", \"searchable\": true, \"indexed\": true, \"doc_values\": true, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"_id\", \"searchable\": false, \"indexed\": false, \"doc_values\": false, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": true, \"name\": \"_type\", \"searchable\": true, \"indexed\": false, \"doc_values\": false, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"_index\", \"searchable\": false, \"indexed\": false, \"doc_values\": false, \"type\": \"string\", \"scripted\": false}, {\"count\": 0, \"analyzed\": false, \"aggregatable\": false, \"name\": \"_score\", \"searchable\": false, \"indexed\": false, \"doc_values\": false, \"type\": \"number\", \"scripted\": false}]", - "fieldFormatMap": "{\"@timestamp\": {\"id\": \"date\"}}", - "timeFieldName": "@timestamp", + "fields": "[{\"name\": \"beat.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.hostname\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.timezone\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"beat.version\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"@timestamp\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"date\"}, {\"name\": \"tags\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"fields\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"error.message\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"error.code\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"error.type\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.provider\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.instance_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.instance_name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.machine_type\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.availability_zone\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.project_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"meta.cloud.region\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.pod.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.namespace\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.labels\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.annotations\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true}, {\"name\": \"kubernetes.container.name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"kubernetes.container.image\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"plugin_id\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"cve\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"cvss\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"risk\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"host\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"protocol\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"port\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"number\"}, {\"name\": \"name\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"synopsis\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"description\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"solution\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"see_also\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"plugin_output\", \"count\": 0, \"scripted\": false, \"indexed\": true, \"analyzed\": false, \"doc_values\": true, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"_id\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_type\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": true, \"aggregatable\": true, \"type\": \"string\"}, {\"name\": \"_index\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"string\"}, {\"name\": \"_score\", \"count\": 0, \"scripted\": false, \"indexed\": false, \"analyzed\": false, \"doc_values\": false, \"searchable\": false, \"aggregatable\": false, \"type\": \"number\"}]", + "fieldFormatMap": "{\"@timestamp\": {\"id\": \"date\"}}", + "timeFieldName": "@timestamp", "title": "nessusbeat-*" } \ No newline at end of file diff --git a/docs/fields.asciidoc b/docs/fields.asciidoc index 10dfcbd..7c7f38b 100644 --- a/docs/fields.asciidoc +++ b/docs/fields.asciidoc @@ -236,27 +236,27 @@ type: long [float] === cve -type: text +type: keyword [float] === cvss -type: text +type: keyword [float] === risk -type: text +type: keyword [float] === host -type: text +type: keyword [float] === protocol -type: text +type: keyword [float] === port @@ -266,30 +266,30 @@ type: long [float] === name -type: text +type: keyword [float] === synopsis -type: text +type: keyword [float] === description -type: text +type: keyword [float] === solution -type: text +type: keyword [float] === see_also -type: text +type: keyword [float] === plugin_output -type: text +type: keyword diff --git a/fields.yml b/fields.yml index 8f579ef..026b926 100644 --- a/fields.yml +++ b/fields.yml @@ -144,26 +144,26 @@ - name: plugin_id type: long - name: cve - type: text + type: keyword - name: cvss - type: text + type: keyword - name: risk - type: text + type: keyword - name: host - type: text + type: keyword - name: protocol - type: text + type: keyword - name: port type: long - name: name - type: text + type: keyword - name: synopsis - type: text + type: keyword - name: description - type: text + type: keyword - name: solution - type: text + type: keyword - name: see_also - type: text + type: keyword - name: plugin_output - type: text + type: keyword diff --git a/nessusbeat.full.yml b/nessusbeat.full.yml index 1286b51..63a7fcb 100644 --- a/nessusbeat.full.yml +++ b/nessusbeat.full.yml @@ -8,7 +8,6 @@ nessusbeat: #api_url: #api_username: #api_password: - #timestamp_fields: name: nessusbeat diff --git a/nessusbeat.reference.yml b/nessusbeat.reference.yml new file mode 100644 index 0000000..eebb298 --- /dev/null +++ b/nessusbeat.reference.yml @@ -0,0 +1,767 @@ +################### Nessusbeat Configuration Example ######################### + +############################# Nessusbeat ###################################### + +nessusbeat: + report_path: /opt/nessus/var/nessus/users/admin/reports + #cacert_path: + #api_url: + #api_username: + #api_password: + +name: nessusbeat + +#================================ General ====================================== + +# The name of the shipper that publishes the network data. It can be used to group +# all the transactions sent by a single shipper in the web interface. +# If this options is not defined, the hostname is used. +#name: + +# The tags of the shipper are included in their own field with each +# transaction published. Tags make it easy to group servers by different +# logical properties. +#tags: ["service-X", "web-tier"] + +# Optional fields that you can specify to add additional information to the +# output. Fields can be scalar values, arrays, dictionaries, or any nested +# combination of these. +#fields: +# env: staging + +# If this option is set to true, the custom fields are stored as top-level +# fields in the output document instead of being grouped under a fields +# sub-dictionary. Default is false. +#fields_under_root: false + +# Internal queue configuration for buffering events to be published. +#queue: + # Queue type by name (default 'mem') + # The memory queue will present all available events (up to the outputs + # bulk_max_size) to the output, the moment the output is ready to server + # another batch of events. + #mem: + # Max number of events the queue can buffer. + #events: 4096 + + # Hints the minimum number of events stored in the queue, + # before providing a batch of events to the outputs. + # A value of 0 (the default) ensures events are immediately available + # to be sent to the outputs. + #flush.min_events: 2048 + + # Maximum duration after which events are available to the outputs, + # if the number of events stored in the queue is < min_flush_events. + #flush.timeout: 1s + +# Sets the maximum number of CPUs that can be executing simultaneously. The +# default is the number of logical CPUs available in the system. +#max_procs: + +#================================ Processors =================================== + +# Processors are used to reduce the number of fields in the exported event or to +# enhance the event with external metadata. This section defines a list of +# processors that are applied one by one and the first one receives the initial +# event: +# +# event -> filter1 -> event1 -> filter2 ->event2 ... +# +# The supported processors are drop_fields, drop_event, include_fields, and +# add_cloud_metadata. +# +# For example, you can use the following processors to keep the fields that +# contain CPU load percentages, but remove the fields that contain CPU ticks +# values: +# +#processors: +#- include_fields: +# fields: ["cpu"] +#- drop_fields: +# fields: ["cpu.user", "cpu.system"] +# +# The following example drops the events that have the HTTP response code 200: +# +#processors: +#- drop_event: +# when: +# equals: +# http.code: 200 +# +# The following example enriches each event with metadata from the cloud +# provider about the host machine. It works on EC2, GCE, DigitalOcean, +# Tencent Cloud, and Alibaba Cloud. +# +#processors: +#- add_cloud_metadata: ~ +# +# The following example enriches each event with the machine's local time zone +# offset from UTC. +# +#processors: +#- add_locale: +# format: offset +# +# The following example enriches each event with docker metadata, it matches +# given fields to an existing container id and adds info from that container: +# +#processors: +#- add_docker_metadata: +# host: "unix:///var/run/docker.sock" +# match_fields: ["system.process.cgroup.id"] +# # To connect to Docker over TLS you must specify a client and CA certificate. +# #ssl: +# # certificate_authority: "/etc/pki/root/ca.pem" +# # certificate: "/etc/pki/client/cert.pem" +# # key: "/etc/pki/client/cert.key" +# +# The following example enriches each event with docker metadata, it matches +# container id from log path available in `source` field (by default it expects +# it to be /var/lib/docker/containers/*/*.log). +# +#processors: +#- add_docker_metadata: ~ + +#============================= Elastic Cloud ================================== + +# These settings simplify using nessusbeat with the Elastic Cloud (https://cloud.elastic.co/). + +# The cloud.id setting overwrites the `output.elasticsearch.hosts` and +# `setup.kibana.host` options. +# You can find the `cloud.id` in the Elastic Cloud web UI. +#cloud.id: + +# The cloud.auth setting overwrites the `output.elasticsearch.username` and +# `output.elasticsearch.password` settings. The format is `:`. +#cloud.auth: + +#================================ Outputs ====================================== + +# Configure what output to use when sending the data collected by the beat. + +#-------------------------- Elasticsearch output ------------------------------- +output.elasticsearch: + # Boolean flag to enable or disable the output module. + #enabled: true + + # Array of hosts to connect to. + # Scheme and port can be left out and will be set to the default (http and 9200) + # In case you specify and additional path, the scheme is required: http://localhost:9200/path + # IPv6 addresses should always be defined as: https://[2001:db8::1]:9200 + hosts: ["localhost:9200"] + + # Set gzip compression level. + #compression_level: 0 + + # Optional protocol and basic auth credentials. + #protocol: "https" + #username: "elastic" + #password: "changeme" + + # Dictionary of HTTP parameters to pass within the url with index operations. + #parameters: + #param1: value1 + #param2: value2 + + # Number of workers per Elasticsearch host. + #worker: 1 + + # Optional index name. The default is "nessusbeat" plus date + # and generates [nessusbeat-]YYYY.MM.DD keys. + # In case you modify this pattern you must update setup.template.name and setup.template.pattern accordingly. + #index: "nessusbeat-%{[beat.version]}-%{+yyyy.MM.dd}" + + # Optional ingest node pipeline. By default no pipeline will be used. + #pipeline: "" + + # Optional HTTP Path + #path: "/elasticsearch" + + # Custom HTTP headers to add to each request + #headers: + # X-My-Header: Contents of the header + + # Proxy server url + #proxy_url: http://proxy:3128 + + # The number of times a particular Elasticsearch index operation is attempted. If + # the indexing operation doesn't succeed after this many retries, the events are + # dropped. The default is 3. + #max_retries: 3 + + # The maximum number of events to bulk in a single Elasticsearch bulk API index request. + # The default is 50. + #bulk_max_size: 50 + + # Configure http request timeout before failing an request to Elasticsearch. + #timeout: 90 + + # Use SSL settings for HTTPS. Default is true. + #ssl.enabled: true + + # Configure SSL verification mode. If `none` is configured, all server hosts + # and certificates will be accepted. In this mode, SSL based connections are + # susceptible to man-in-the-middle attacks. Use only for testing. Default is + # `full`. + #ssl.verification_mode: full + + # List of supported/valid TLS versions. By default all TLS versions 1.0 up to + # 1.2 are enabled. + #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2] + + # SSL configuration. By default is off. + # List of root certificates for HTTPS server verifications + #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for SSL client authentication + #ssl.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #ssl.key: "/etc/pki/client/cert.key" + + # Optional passphrase for decrypting the Certificate Key. + #ssl.key_passphrase: '' + + # Configure cipher suites to be used for SSL connections + #ssl.cipher_suites: [] + + # Configure curve types for ECDHE based cipher suites + #ssl.curve_types: [] + + +#----------------------------- Logstash output --------------------------------- +#output.logstash: + # Boolean flag to enable or disable the output module. + #enabled: true + + # The Logstash hosts + #hosts: ["localhost:5044"] + + # Number of workers per Logstash host. + #worker: 1 + + # Set gzip compression level. + #compression_level: 3 + + # Optional maximum time to live for a connection to Logstash, after which the + # connection will be re-established. A value of `0s` (the default) will + # disable this feature. + # + # Not yet supported for async connections (i.e. with the "pipelining" option set) + #ttl: 30s + + # Optional load balance the events between the Logstash hosts + #loadbalance: true + + # Number of batches to be sent asynchronously to logstash while processing + # new batches. + #pipelining: 5 + + # If enabled only a subset of events in a batch of events is transfered per + # transaction. The number of events to sent increases up to `bulk_max_size` + # if no error is encountered. + #slow_start: false + + # Optional index name. The default index name is set to nessusbeat + # in all lowercase. + #index: 'nessusbeat' + + # SOCKS5 proxy server URL + #proxy_url: socks5://user:password@socks5-server:2233 + + # Resolve names locally when using a proxy server. Defaults to false. + #proxy_use_local_resolver: false + + # Enable SSL support. SSL is automatically enabled, if any SSL setting is set. + #ssl.enabled: true + + # Configure SSL verification mode. If `none` is configured, all server hosts + # and certificates will be accepted. In this mode, SSL based connections are + # susceptible to man-in-the-middle attacks. Use only for testing. Default is + # `full`. + #ssl.verification_mode: full + + # List of supported/valid TLS versions. By default all TLS versions 1.0 up to + # 1.2 are enabled. + #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2] + + # Optional SSL configuration options. SSL is off by default. + # List of root certificates for HTTPS server verifications + #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for SSL client authentication + #ssl.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #ssl.key: "/etc/pki/client/cert.key" + + # Optional passphrase for decrypting the Certificate Key. + #ssl.key_passphrase: '' + + # Configure cipher suites to be used for SSL connections + #ssl.cipher_suites: [] + + # Configure curve types for ECDHE based cipher suites + #ssl.curve_types: [] + +#------------------------------- Kafka output ---------------------------------- +#output.kafka: + # Boolean flag to enable or disable the output module. + #enabled: true + + # The list of Kafka broker addresses from where to fetch the cluster metadata. + # The cluster metadata contain the actual Kafka brokers events are published + # to. + #hosts: ["localhost:9092"] + + # The Kafka topic used for produced events. The setting can be a format string + # using any event field. To set the topic from document type use `%{[type]}`. + #topic: beats + + # The Kafka event key setting. Use format string to create unique event key. + # By default no event key will be generated. + #key: '' + + # The Kafka event partitioning strategy. Default hashing strategy is `hash` + # using the `output.kafka.key` setting or randomly distributes events if + # `output.kafka.key` is not configured. + #partition.hash: + # If enabled, events will only be published to partitions with reachable + # leaders. Default is false. + #reachable_only: false + + # Configure alternative event field names used to compute the hash value. + # If empty `output.kafka.key` setting will be used. + # Default value is empty list. + #hash: [] + + # Authentication details. Password is required if username is set. + #username: '' + #password: '' + + # Kafka version nessusbeat is assumed to run against. Defaults to the oldest + # supported stable version (currently version 0.8.2.0) + #version: 0.8.2 + + # Metadata update configuration. Metadata do contain leader information + # deciding which broker to use when publishing. + #metadata: + # Max metadata request retry attempts when cluster is in middle of leader + # election. Defaults to 3 retries. + #retry.max: 3 + + # Waiting time between retries during leader elections. Default is 250ms. + #retry.backoff: 250ms + + # Refresh metadata interval. Defaults to every 10 minutes. + #refresh_frequency: 10m + + # The number of concurrent load-balanced Kafka output workers. + #worker: 1 + + # The number of times to retry publishing an event after a publishing failure. + # After the specified number of retries, the events are typically dropped. + # Some Beats, such as Filebeat, ignore the max_retries setting and retry until + # all events are published. Set max_retries to a value less than 0 to retry + # until all events are published. The default is 3. + #max_retries: 3 + + # The maximum number of events to bulk in a single Kafka request. The default + # is 2048. + #bulk_max_size: 2048 + + # The number of seconds to wait for responses from the Kafka brokers before + # timing out. The default is 30s. + #timeout: 30s + + # The maximum duration a broker will wait for number of required ACKs. The + # default is 10s. + #broker_timeout: 10s + + # The number of messages buffered for each Kafka broker. The default is 256. + #channel_buffer_size: 256 + + # The keep-alive period for an active network connection. If 0s, keep-alives + # are disabled. The default is 0 seconds. + #keep_alive: 0 + + # Sets the output compression codec. Must be one of none, snappy and gzip. The + # default is gzip. + #compression: gzip + + # The maximum permitted size of JSON-encoded messages. Bigger messages will be + # dropped. The default value is 1000000 (bytes). This value should be equal to + # or less than the broker's message.max.bytes. + #max_message_bytes: 1000000 + + # The ACK reliability level required from broker. 0=no response, 1=wait for + # local commit, -1=wait for all replicas to commit. The default is 1. Note: + # If set to 0, no ACKs are returned by Kafka. Messages might be lost silently + # on error. + #required_acks: 1 + + # The configurable ClientID used for logging, debugging, and auditing + # purposes. The default is "beats". + #client_id: beats + + # Enable SSL support. SSL is automatically enabled, if any SSL setting is set. + #ssl.enabled: true + + # Optional SSL configuration options. SSL is off by default. + # List of root certificates for HTTPS server verifications + #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Configure SSL verification mode. If `none` is configured, all server hosts + # and certificates will be accepted. In this mode, SSL based connections are + # susceptible to man-in-the-middle attacks. Use only for testing. Default is + # `full`. + #ssl.verification_mode: full + + # List of supported/valid TLS versions. By default all TLS versions 1.0 up to + # 1.2 are enabled. + #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2] + + # Certificate for SSL client authentication + #ssl.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #ssl.key: "/etc/pki/client/cert.key" + + # Optional passphrase for decrypting the Certificate Key. + #ssl.key_passphrase: '' + + # Configure cipher suites to be used for SSL connections + #ssl.cipher_suites: [] + + # Configure curve types for ECDHE based cipher suites + #ssl.curve_types: [] + +#------------------------------- Redis output ---------------------------------- +#output.redis: + # Boolean flag to enable or disable the output module. + #enabled: true + + # The list of Redis servers to connect to. If load balancing is enabled, the + # events are distributed to the servers in the list. If one server becomes + # unreachable, the events are distributed to the reachable servers only. + #hosts: ["localhost:6379"] + + # The Redis port to use if hosts does not contain a port number. The default + # is 6379. + #port: 6379 + + # The name of the Redis list or channel the events are published to. The + # default is nessusbeat. + #key: nessusbeat + + # The password to authenticate with. The default is no authentication. + #password: + + # The Redis database number where the events are published. The default is 0. + #db: 0 + + # The Redis data type to use for publishing events. If the data type is list, + # the Redis RPUSH command is used. If the data type is channel, the Redis + # PUBLISH command is used. The default value is list. + #datatype: list + + # The number of workers to use for each host configured to publish events to + # Redis. Use this setting along with the loadbalance option. For example, if + # you have 2 hosts and 3 workers, in total 6 workers are started (3 for each + # host). + #worker: 1 + + # If set to true and multiple hosts or workers are configured, the output + # plugin load balances published events onto all Redis hosts. If set to false, + # the output plugin sends all events to only one host (determined at random) + # and will switch to another host if the currently selected one becomes + # unreachable. The default value is true. + #loadbalance: true + + # The Redis connection timeout in seconds. The default is 5 seconds. + #timeout: 5s + + # The number of times to retry publishing an event after a publishing failure. + # After the specified number of retries, the events are typically dropped. + # Some Beats, such as Filebeat, ignore the max_retries setting and retry until + # all events are published. Set max_retries to a value less than 0 to retry + # until all events are published. The default is 3. + #max_retries: 3 + + # The maximum number of events to bulk in a single Redis request or pipeline. + # The default is 2048. + #bulk_max_size: 2048 + + # The URL of the SOCKS5 proxy to use when connecting to the Redis servers. The + # value must be a URL with a scheme of socks5://. + #proxy_url: + + # This option determines whether Redis hostnames are resolved locally when + # using a proxy. The default value is false, which means that name resolution + # occurs on the proxy server. + #proxy_use_local_resolver: false + + # Enable SSL support. SSL is automatically enabled, if any SSL setting is set. + #ssl.enabled: true + + # Configure SSL verification mode. If `none` is configured, all server hosts + # and certificates will be accepted. In this mode, SSL based connections are + # susceptible to man-in-the-middle attacks. Use only for testing. Default is + # `full`. + #ssl.verification_mode: full + + # List of supported/valid TLS versions. By default all TLS versions 1.0 up to + # 1.2 are enabled. + #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2] + + # Optional SSL configuration options. SSL is off by default. + # List of root certificates for HTTPS server verifications + #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for SSL client authentication + #ssl.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #ssl.key: "/etc/pki/client/cert.key" + + # Optional passphrase for decrypting the Certificate Key. + #ssl.key_passphrase: '' + + # Configure cipher suites to be used for SSL connections + #ssl.cipher_suites: [] + + # Configure curve types for ECDHE based cipher suites + #ssl.curve_types: [] + + +#------------------------------- File output ----------------------------------- +#output.file: + # Boolean flag to enable or disable the output module. + #enabled: true + + # Path to the directory where to save the generated files. The option is + # mandatory. + #path: "/tmp/nessusbeat" + + # Name of the generated files. The default is `nessusbeat` and it generates + # files: `nessusbeat`, `nessusbeat.1`, `nessusbeat.2`, etc. + #filename: nessusbeat + + # Maximum size in kilobytes of each file. When this size is reached, and on + # every nessusbeat restart, the files are rotated. The default value is 10240 + # kB. + #rotate_every_kb: 10000 + + # Maximum number of files under path. When this number of files is reached, + # the oldest file is deleted and the rest are shifted from last to first. The + # default is 7 files. + #number_of_files: 7 + + +#----------------------------- Console output --------------------------------- +#output.console: + # Boolean flag to enable or disable the output module. + #enabled: true + + # Pretty print json event + #pretty: false + +#================================= Paths ====================================== + +# The home path for the nessusbeat installation. This is the default base path +# for all other path settings and for miscellaneous files that come with the +# distribution (for example, the sample dashboards). +# If not set by a CLI flag or in the configuration file, the default for the +# home path is the location of the binary. +#path.home: + +# The configuration path for the nessusbeat installation. This is the default +# base path for configuration files, including the main YAML configuration file +# and the Elasticsearch template file. If not set by a CLI flag or in the +# configuration file, the default for the configuration path is the home path. +#path.config: ${path.home} + +# The data path for the nessusbeat installation. This is the default base path +# for all the files in which nessusbeat needs to store its data. If not set by a +# CLI flag or in the configuration file, the default for the data path is a data +# subdirectory inside the home path. +#path.data: ${path.home}/data + +# The logs path for a nessusbeat installation. This is the default location for +# the Beat's log files. If not set by a CLI flag or in the configuration file, +# the default for the logs path is a logs subdirectory inside the home path. +#path.logs: ${path.home}/logs + +#============================== Dashboards ===================================== +# These settings control loading the sample dashboards to the Kibana index. Loading +# the dashboards is disabled by default and can be enabled either by setting the +# options here, or by using the `-setup` CLI flag or the `setup` command. +#setup.dashboards.enabled: false + +# The directory from where to read the dashboards. The default is the `kibana` +# folder in the home path. +#setup.dashboards.directory: ${path.home}/kibana + +# The URL from where to download the dashboards archive. It is used instead of +# the directory if it has a value. +#setup.dashboards.url: + +# The file archive (zip file) from where to read the dashboards. It is used instead +# of the directory when it has a value. +#setup.dashboards.file: + +# In case the archive contains the dashboards from multiple Beats, this lets you +# select which one to load. You can load all the dashboards in the archive by +# setting this to the empty string. +#setup.dashboards.beat: nessusbeat + +# The name of the Kibana index to use for setting the configuration. Default is ".kibana" +#setup.dashboards.kibana_index: .kibana + +# The Elasticsearch index name. This overwrites the index name defined in the +# dashboards and index pattern. Example: testbeat-* +#setup.dashboards.index: + +#============================== Template ===================================== + +# A template is used to set the mapping in Elasticsearch +# By default template loading is enabled and the template is loaded. +# These settings can be adjusted to load your own template or overwrite existing ones. + +# Set to false to disable template loading. +#setup.template.enabled: true + +# Template name. By default the template name is "nessusbeat-%{[beat.version]}" +# The template name and pattern has to be set in case the elasticsearch index pattern is modified. +#setup.template.name: "nessusbeat-%{[beat.version]}" + +# Template patttern. By default the template pattern is "-%{[beat.version]}-*" to apply to the default index settings. +# The first part is the version of the beat and then -* is used to match all daily indicies. +# The template name and pattern has to be set in case the elasticsearch index pattern is modified. +#setup.template.pattern: "nessusbeat-%{[beat.version]}-*" + +# Path to fields.yml file to generate the template +#setup.template.fields: "${path.config}/fields.yml" + +# Overwrite existing template +#setup.template.overwrite: false + +# Elasticsearch template settings +setup.template.settings: + + # A dictionary of settings to place into the settings.index dictionary + # of the Elasticsearch template. For more details, please check + # https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html + #index: + #number_of_shards: 1 + #codec: best_compression + + # A dictionary of settings for the _source field. For more details, please check + # https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-source-field.html + #_source: + #enabled: false + +#============================== Kibana ===================================== + +# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API. +# This requires a Kibana endpoint configuration. +setup.kibana: + + # Kibana Host + # Scheme and port can be left out and will be set to the default (http and 5601) + # In case you specify and additional path, the scheme is required: http://localhost:5601/path + # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601 + #host: "localhost:5601" + + # Optional protocol and basic auth crendentials. + #protocol: "https" + #username: "elastic" + #password: "changeme" + + # Optional HTTP Path + #path: "" + + # Use SSL settings for HTTPS. Default is true. + #ssl.enabled: true + + # Configure SSL verification mode. If `none` is configured, all server hosts + # and certificates will be accepted. In this mode, SSL based connections are + # susceptible to man-in-the-middle attacks. Use only for testing. Default is + # `full`. + #ssl.verification_mode: full + + # List of supported/valid TLS versions. By default all TLS versions 1.0 up to + # 1.2 are enabled. + #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2] + + # SSL configuration. By default is off. + # List of root certificates for HTTPS server verifications + #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for SSL client authentication + #ssl.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #ssl.key: "/etc/pki/client/cert.key" + + # Optional passphrase for decrypting the Certificate Key. + #ssl.key_passphrase: '' + + # Configure cipher suites to be used for SSL connections + #ssl.cipher_suites: [] + + # Configure curve types for ECDHE based cipher suites + #ssl.curve_types: [] + + + +#================================ Logging ====================================== +# There are three options for the log output: syslog, file, stderr. +# Under Windows systems, the log files are per default sent to the file output, +# under all other system per default to syslog. + +# Sets log level. The default log level is info. +# Available log levels are: critical, error, warning, info, debug +#logging.level: info + +# Enable debug output for selected components. To enable all selectors use ["*"] +# Other available selectors are "beat", "publish", "service" +# Multiple selectors can be chained. +#logging.selectors: [ ] + +# Send all logging output to syslog. The default is false. +#logging.to_syslog: true + +# If enabled, nessusbeat periodically logs its internal metrics that have changed +# in the last period. For each metric that changed, the delta from the value at +# the beginning of the period is logged. Also, the total values for +# all non-zero internal metrics are logged on shutdown. The default is true. +#logging.metrics.enabled: true + +# The period after which to log the internal metrics. The default is 30s. +#logging.metrics.period: 30s + +# Logging to rotating files files. Set logging.to_files to false to disable logging to +# files. +logging.to_files: true +logging.files: + # Configure the path where the logs are written. The default is the logs directory + # under the home path (the binary location). + #path: /var/log/nessusbeat + + # The name of the files where the logs are written to. + #name: nessusbeat + + # Configure log file size limit. If limit is reached, log file will be + # automatically rotated + #rotateeverybytes: 10485760 # = 10MB + + # Number of rotated log files to keep. Oldest files will be deleted first. + #keepfiles: 7 + + # The permissions mask to apply when rotating log files. The default value is 0600. + # Must be a valid Unix-style file permissions mask expressed in octal notation. + #permissions: 0600 + +# Set to true to log messages in json format. +#logging.json: false diff --git a/nessusbeat.yml b/nessusbeat.yml index ccefc62..7b2cbf5 100644 --- a/nessusbeat.yml +++ b/nessusbeat.yml @@ -8,7 +8,6 @@ nessusbeat: #api_url: #api_username: #api_password: - #timestamp_fields: name: nessusbeat