yml files about fortinet-2-elasticsearch HOT 9 CLOSED

yes, we will be updating pipelines and other files in a few weeks. We will include yml files as well

from fortinet-2-elasticsearch.

Thanks! Also an issue for me as well! Much appreciated.

from fortinet-2-elasticsearch.

Correct me if I am wrong but there is no fortiweb, fortimail or fortiauthenticator config yet right?

from fortinet-2-elasticsearch.

We just uploaded fortiweb. We have not translated fortimail dataset because there are no email fields on ECS yet. I dont think we will cover Fortiauthenticator

from fortinet-2-elasticsearch.

Great thanks. Any update on enSilo? I actually have to start parsing these myself ASAP. I could provide you sample logs to create it, mostly since you would never want to use any code I write.

from fortinet-2-elasticsearch.

Ensilo sample logs could definetly help. But it will be better to have the full dataset, similar to a Log Reference Guide

from fortinet-2-elasticsearch.

Could you put the yml files on the translate filters?

filter {

if [observer][ip] {
    ############### OBSERVER #####################
    translate {
        field => "[observer][ip]"
        destination => "[obs_org_csv]"
        dictionary_path => **"/etc/logstash/host_org.yml"**
        fallback => "default_obs_org_csv"
    }

from fortinet-2-elasticsearch.

Hi @sharckerCol , we have uploaded the dictionaries.

from fortinet-2-elasticsearch.

dictionaries have been deprecated 4c40706

just the one for fortiweb_attack_logid is left

from fortinet-2-elasticsearch.