Merge pull request #539 from Cargill/cve_vuln_sep

adding vuln cve parsing
Cargill · Sep 23, 2024 · ff8c4e2 · ff8c4e2
2 parents 530ef53 + 4f7db78
commit ff8c4e2
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/config/processors/syslog_security_symantec.endpoint.conf b/config/processors/syslog_security_symantec.endpoint.conf
@@ -531,6 +531,11 @@ filter {
       remove_field => ["[event][name]"]
     }
   }
+  if [rule][name] =~ "^.*?(cve|CVE)-\d+-\d+" {
+    grok {
+    match => { "[rule][name]" => "^.*?(?<[vulnerability][id]>(cve|CVE)-\d+-\d+)" }
+    }
+  }
 }
 output {
   pipeline { send_to => [enrichments] }