Skip to main content

Content packs

Content packs are ready-to-use bundles created for Illuminate which include dashboards, streams, alerts and parsing logic designed to accelerate your log analysis and threat detection.

This section contains a list of articles for each available content pack, each one providing step-by-step instructions on how to install the pack, configure it, and start gaining value from the pre-built components.

The following content packs are currently available:

Apache Tomcat server content pack

This content pack is designed for Apache Tomcat servers running on Ubuntu systems. It parses and configures both Apache Tomcat access logs and Catalina logs.

Supported versions

  • Tested with Apache Tomcat version 11.0.5

Requirements

  • The supported log delivery is via Filebeat with Bitdefender Sidecar.

  • The pack only supports Ubuntu and Linux versions with the same path and file structure.

  • The pack only supports the standard log folder for Ubuntu.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Apache Tomcat Device Messages"

Note

If this stream does not exist prior to the activation of this pack, then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Apache Tomcat Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

What is provided

  • Parsing rules to extract Apache Tomcat logs into Security Data Lake schema-compatible fields. Apache Tomcat logs receive the GIM code 180200 (http.communication).

Log format example

Access Logs

"34.20.30.15 - - [28/Mar/2025:23:34:30 +0000] "PUT /stefan.session HTTP/1.1" 201 -"

"11.20.29.124 - admin [02/Mar/2023:18:58:17 +0530] "POST /host-manager/images/asf-logo.svg HTTP/1.1" 200 20486 X 400 "http://localhost:8080/host-manager/html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" X-Forwarded-For="127.0.0.1"

Catalina logs

26-Mar-2025 15:27:08.188 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina]

Input via Filebeat together with Bitdefender Sidecar

To configure your Security Data Lake server and your client(s), refer to the Sidecar documentation.

You will need to take the following steps:

  1. Create a Beats input.

  2. Create a Security Data Lake REST API token and save it.

  3. Install Bitdefender Sidecar.

  4. Add your client(s), e.g. web server.

These steps are explained in the sections below.

Security Data Lake settings

  1. Create a Beats input in Security Data Lake. For information on how to create and configure this Bitdefender Forwarder input, refer to Beats input.

  2. Create a Security Data Lake REST API access token and save it. For details, refer to Installing Sidecar (Section 1.2, Create an API token).

  3. Create a (Linux) filebeat configuration under System > Sidercars > Configuration , with a filebeat on Linux collector.

  4. Configure the file and add:

    • The correct IP under hosts.

      Important

      You must enter the IP of the Bitdefender Forwarder and the port that you defined in the Beats input profile.

    • The log source configured to the desired value and an event_source_product field with an apache_tomcat value.

    filebeat.inputs:
- input_type: log
  paths:
    - /opt/tomcat/updated/logs/*
  type: filestream
  fields_under_root: true
  fields:
    event_source_product: apache_tomcat

    Important

    There must be two spaces in front of event_source_product and - /opt....

    This setting will pull all logs in the - /opt/tomcat/updated/logs/* folder. If needed, only select access logs or Catalina logs.

  5. Save the configuration to complete setup.

Configure a client with Filebeat and Bitdefender Sidecar

  1. Install, enable and verify Bitdefender Sidecar on the remote machine. For details, refer to Installing Sidecar.

  2. Install Filebeat according to the instructions in the official documentation. Alternatively, you can download and install the OSS-only version of Filebeat.

    • If you install Filebeat manually, use /etc/filebeat as the installation directory.

    • If you install Filebeat via apt-get, then the correct directory is automatically selected.

    Example commands for Ubuntu:

    wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/oss-8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list
sudo apt-get update && sudo apt-get install filebeat
sudo systemctl enable filebeat
sudo systemctl start filebeat
sudo systemctl status filebeat

  3. (Optional) Edit the filebeat.yml file as needed. You can do this via the Sidecar configuration in the Security Data Lake interface.

  4. Start the daemon.

  5. If there is a permission issue, you can resolve it by running the following command:

    sudo chown root filebeat.yml

  6. In Security Data Lake, assign a configuration to your machine.

Warning

This pack was tested on Ubuntu and may not work as designed with other Linux-based systems due to different path and file names. Error logs are not parsed.

Apache web server content pack

This package is intended for an Apache HTTP server on a Linux system. The pack will parse and configure Apache2 access logs. It supports two access log formats: Common and Combined logs. Also, it supports "normal" logs and virtual hosts logs.

Supported versions

  • Version 2.4.

Tested rsyslog version

  • 8.2212.0

What is provided

  • Parsing rules to extract Apache logs into Security Data Lake schema-compatible fields. Apache logs get the GIM code 180200 (http.communication).

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Apache2 Device Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Illuminate: Apache2 Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

Access Logs

[30/Jan/2023:15:06:52 +0000] "GET / HTTP/1.1" 200 3477 "-" “Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0 ::1 - Stefan [07/Feb/2023:16:38:37 +0000] "GET /favicon.ico HTTP/1.1" 404 487 "http://localhost/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"

Error Logs (beta, we support the following formats)

[Sun Jul 01 01:06:13 2022] [error] [client 1.2.3.4] File does not exist: /var/www/html/robots.txt [Wed Feb 01 00:00:01.584207 2023] [mpm_event:notice] [pid 745:tid 539654844431424] AH00999: Apache/9.4.41 (Ubuntu) configured -- resuming [Wed Jul 15 01:34:12.093005 2020] [proxy:error] [pid 139:tid 133316032] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:9000 (127.0.0.1) failed

Supported SSL Log format (beta support)

[13/Aug/2022:05:41:26 +0600] 192.168.0.100 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "GET /bitdefender/helper.php?cmd=gethelper HTTP/1.1" 1375

These SSL logs are custom logs; please configure your system accordingly. The custom file name is: httpd-ssl.log. These are default fields/values. Logs with non-default fields or order will not work.

Requirements

  • Two ways to deliver logs are supported: Filebeat (with Sidecar) and rsyslog.

  • The pack supports a non-standard log folder as long as the name (access.log) does not change.

Input via Filebeat together with Bitdefender Sidecar

To configure your Security Data Lake server and your client(s), refer to the Sidecar documentation.

You will need to take the following steps:

  1. Create a Beats input.

  2. Create a Security Data Lake REST API token and save it.

  3. Install Bitdefender Sidecar.

  4. Add your client(s), e.g. web server.

Security Data Lake settings

  1. Create a Beats input in Security Data Lake. For information on how to create and configure this Bitdefender Forwarder input, refer to Beats input.

  2. Create a Security Data LakeREST API access token and save it. For details, refer to Installing Sidecar(Section 1.2, Create an API token).

  3. Create a (Linux) filebeat configuration under System > Sidercars > Configuration with a filebeat on Linux collector.

  4. Configure the file and add:

    • The correct IP under hosts.

      Important

      You must enter the IP of the Bitdefender Forwarder and the port that you defined in the Beats input profile.

    • The log source configured to the desired value and an event_source_product field with an apache_httpd value.

filebeat.inputs:
- input_type: log
  paths:
    - /var/log/apache2/access.log
    - /var/log/apache2/error.log
    - /var/log/apache2/httpd-ssl.log
  type: filestream
  fields_under_root: true
  fields:
    event_source_product: apache_httpd

Important

There must be two spaces in front of event_source_product and - /var....

This will only log Apache access logs, but you can add error logs, etc.

5. Save the configuration to complete setup.

Configure a client with Filebeat and Bitdefender Sidecar

  1. Install, enable and verify Bitdefender Sidecar on the remote machine. For details, refer to  Installing Sidecar.

  2. Install Filebeat according to the instructions in the official documentation. Alternatively, you can download and install the OSS-only version of Filebeat.

    • If you install Filebeat manually, use /etc/filebeat as the installation directory.

    • If you install Filebeat via apt-get, then the correct directory is automatically selected.

    Example commands for Ubuntu:

    wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/oss-8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list
sudo apt-get update && sudo apt-get install filebeat
sudo systemctl enable filebeat
sudo systemctl start filebeat
sudo systemctl status filebeat

  3. (Optional) Edit the filebeat.yml file as needed. You can do this via the Sidecar configuration in the Security Data Lake interface.

  4. Start the daemon. If there is a permission issue, you can resolve it by running the following command:

    sudo chown root filebeat.yml

  5. (recommended) Configure Filebeat to start automatically after reboot.

  6. In Security Data Lake, assign a configuration to your machine.

Requirements for input via rsyslog

  • A configured Syslog UDP or Syslog TCP input under the forwarder input profile.

  • Installation of rsyslog via the official documentation.

  • A configured rsyslog.conf file.

    Example /etc/rsyslog.conf file with a UDP input on IP 192.168.122.52, port 1514:

    # provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 1514
*.* @192.168.122.52:1514;RSYSLOG_SyslogProtocol23Format

  • A configured 02-apache2.conf.

    You might need to create the configuration file by running the following command:

    sudo gedit /etc/rsyslog.d/02-apache2.conf

    If it is in the correct folder, rsyslog will load the file automatically after restarting the rsyslog service.

    Example for 02-apache2.conf to log access, SSL, and error logs:

    module(load="imfile" PollingInterval="10" statefile.directory="/var/spool/rsyslog")
input(type="imfile"
      File="/var/log/apache2/access.log"
      Tag="apache2_http_access"
      Severity="info"
      Facility="local6")
input(type="imfile"
      File="/var/log/apache2/error.log"
      Tag="apache2_http_error"
      Severity="info"
      Facility="local6")
input(type="imfile"
      File="/var/log/apache2/httpd-ssl.log"
      Tag="apache2_http_ssl"
      Severity="info"
      Facility="local6")
local6.access        @192.168.122.40:1514

    Warning

    This configuration is for UDP. UDP is not a reliable protocol, so consider if TCP is a better option for your organization. After installing rsyslog, there might be active default rules (e.g. 50-default.conf) that log system, kernel, and other logs. Deactivate them if not needed.

    Use this command to restart the service on Ubuntu:

    sudo systemctl restart rsyslog

    You can check the status by issuing the following command:

    sudo systemctl status rsyslog

    Note that red lines may indicate problems.

Limitations

  • Error logs are beta; most formats compatible.

Dashboard

Apache Web Server offers a dashboard with 2 tabs: Overview and Error Messages.

AWS Security Lake content pack

Amazon Security Lake is a purpose-built data lake that centralizes security data from AWS environments, SaaS providers, on-premises, and cloud sources. It converts incoming security data logs to the Open Cybersecurity Schema Framework (OCSF) open standard.

Supported versions

  • Tested with AWS Security Lake in January 2024.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:AWS Security Lake Messages"

Note

If this stream does not exist prior to the activation of this pack, then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "AWS Security Lake Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Supported log types

The content pack parses out supported objects. Regardless of the source, if the data is present in the objects listed below, the pack will parse them out. Currently, we support these objects:

actor,anwers,api,attack,cloud,compliance,connection_info,cve,device,dns_answer,dns_query,email,endpoint,file,finding,http_request,http_response,identity,malware,metadata,process,resources,network_proxy,proxy,query,user,dst_endpoint,traffic,src_endpoint.

Note

Fields with sub or subclasses are not fully supported with the Security Data Lake search engine due to complex data types.

Log format example

Route53 logs

{"metadata":{"product":{"version":"1.100000","name":"Route 53","feature":{"name":"Resolver Query Logs"},"vendor_name":"AWS"},"version":"0.26.1"},"cloud":{"account_uid":"67654654","region":"ap-northeast-1","provider":"AWS"},"src_endpoint":{"vpc_uid":"vpc-02c62c77516baa087","ip":"172.31.12.120","port":37554,"instance_uid":"i-018c0e79fa98b93f3"},"time":"1676953179000","query":{"hostname":"motd.ubuntu.com.","type":"A","class":"IN"},"rcode":"NOERROR","answers":[{"type":"A","rdata":"34.243.160.129","class":"IN"},{"type":"A","rdata":"54.217.10.153","class":"IN"},{"type":"A","rdata":"34.254.182.186","class":"IN"},{"type":"A","rdata":"54.171.230.55","class":"IN"},{"type":"A","rdata":"54.247.62.1","class":"IN"}],"connection_info":{"protocol_name":"UDP","direction":"Lateral","direction_id":3},"dst_endpoint":{"instance_uid":"None","interface_uid":"None"},"severity_id":"-1","severity":"Other","class_name":"DNS Activity","class_uid":"4003","category_name":"Network Activity","category_uid":"4","rcode_id":"0","activity_id":"1","activity_name":"Resolved","type_name":"DNS Activity: Resolved","type_uid":"400301","unmapped":"None"}

Requirements

  • This content pack works together with a configured AWS Security Lake input and Security Data Lake.

Configure the AWS Security Lake input

For configuration instructions, refer to AWS Security Lake Input .

What is provided

  • Parsing rules to extract AWS Security Lake logs into Security Data Lake schema-compatible fields.

  • Categorization of the Security Findings, Account Change, Authentication, Network and DNS activities.

  • Dashboards for: Overview, Network, Alerts, Authentication, IAM and DNS Activities.

Security Lake Spotlight content pack

The Security Lake Spotlight content pack contains an Overview dashboard, as well as Network, Alerts, Authentication, IAM, and DNS dashboards.

BIND DNS content pack

Berkeley Internet Name Domain (BIND) is a popular DNS server. BIND is an open-source system free to download and use.

This content pack processes BIND 9 DNS query logs and error logs, providing normalization and enrichment of these events.

Supported versions

  • BIND 9.18.1

Log format example

2023-02-23T21:31:02.205Z queries: info: client @0x7f9bac008aa8 127.0.0.1#57316 (notadomainatall.org): query: notadomainatall.org IN A +E(0)K (127.0.0.1)

2023-02-23T18:27:56.834Z query-errors: info: client @0x7f9ba802c7f8 127.0.0.1#40232 (asldkjfals.topnet): query failed (REFUSED) for asldkjfals.topnet/IN/A at query.c:5590

Requirements

  • Install BIND DNS.

    • You can find information on how to install BIND DNS in the official documentation. Refer to your vendor for specific instructions on downloading BIND based on your operating system.

  • The Illuminate BIND DNS pack requires the following log channel settings for all BIND DNS logs being sent to Security Data Lake:

    - print-category yes; 
- print-severity yes;

  • Configure Filebeat to send BIND logs to the Security Data Lake Forwarder Beats input.

Filebeat setup

Filebeat is a lightweight log shipper that can be used to send logs from a Windows server to a remote logging system like Security Data Lake. Follow the order below to install and connect Filebeat to your Security Data Lake instance:

1. Install Filebeat

Download and install Filebeat for Windows from elastic.co. Choose the required version and download the ZIP file. Follow the installation instructions for filebeat.

2. Create an input in Security Data Lake

  1. Create a Beats input under Enterprise > Forwarders > Input Profiles > New input profile in Security Data Lake, with the desired port number. For more information, refer to Beats Input.

  2. Name and save the input. Make sure that the input status is running.

  3. Configure Filebeat to collect BIND logs. Edit the Filebeat configuration file (filebeat.yml) to specify the location of the BIND logs and any other desired settings. In this file, you'll also need to specify the Security Data Lake output for Filebeat to send the logs to.

    1. In our case below, under “paths,” we added this line to retrieve all the files in the folder: C:\Windows\System32\BIND\*

    2. The “ fields” portion is mandatory, as Security Data Lake uses it to direct the logs into the correct stream.

The sample filebeat.yml file below shows the minimum required sections for a YML file that will send your logs from your BIND server to Security Data Lake, allowing them to be fully imported and parsed. You may choose to add to the file, but both sections (inputs and output) must be present.

# ============================== Filebeat inputs ===============================
filebeat.inputs:# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
# filestream is an input for collecting log messages from files.
- type: filestream  

# Unique ID among all inputs, an ID is required.  
id: <my-filestream-id>    

# Change to true to enable this input configuration.  
enabled: true    

# Paths that should be crawled and fetched. Glob based paths.  
paths:
    - C:\Windows\System32\BIND\ 

# Set the event_source_product field to bind_dns  
fields:     
    event_source_product: bind_dns  
fields_under_root: true  

# ------------------------------ Logstash Output -------------------------------
output.logstash:
    # The Logstash hosts
    hosts: ["<your_forwarder_ip>:5044"]

Stream configuration

This technology pack includes one stream:

"Illuminate: BIND DNS Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

"BIND DNS Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log configuration

Here is how to set up your BIND log configuration:

  1. Back up your configuration.

  2. Configure your BIND instance logging to which you will save query logs:

    /var/log/named/query.log.

  3. Save query error logs to:

    /var/log/named/query-errors.log.

The following is a sample BIND logging configuration section that can be added to your BIND configuration. Verify that this logging configuration works in your environment and make adjustments as necessary.

logging {

        channel named           { file "/var/log/named/named.log"        versions 10 size 20M; severity info;  print-time iso8601-utc; print-category yes; print-severity yes;};

        channel security        { file "/var/log/named/security.log"     versions 10 size 20M; severity info;  print-time iso8601-utc; print-severity yes; };

        channel dnssec          { file "/var/log/named/dnssec.log"       versions 10 size 20M; severity info;  print-time iso8601-utc; print-severity yes; };

        channel resolver        { file "/var/log/named/resolver.log"     versions 10 size 20M; severity info;  print-time iso8601-utc; print-severity yes; };

        channel query_log       { file "/var/log/named/query.log"        versions 10 size 80M; severity debug; print-time iso8601-utc; print-severity yes; };

        channel query-error     { file "/var/log/named/query-errors.log" versions 10 size 20M; severity info;  print-time iso8601-utc; print-severity yes; };

        channel lame_servers    { file "/var/log/named/lame-servers.log" versions 10 size 20M; severity info;  print-time iso8601-utc; print-severity yes; };

        channel capacity        { file "/var/log/named/capacity.log"     versions 10 size 20M; severity info;  print-time iso8601-utc; print-severity yes; };

        channel rpz             { file "/var/log/named/rpz.log"          versions 10 size 20M; severity info;  print-time iso8601-utc; print-severity yes; };



        category default        { default_syslog;  named; };

        category general        { default_syslog;  named; };

        category security       { security; };

        category queries        { query_log; };

        category lame-servers   { lame_servers;};

        category dnssec         { dnssec; };

        category edns-disabled  { default_syslog; };

        category config         { default_syslog; named; };

        category resolver       { resolver; };

        category edns-disabled  { resolver; };

        category cname          { resolver; };

        category serve-stale    { resolver; };

        category spill          { capacity; };

        category rate-limit     { capacity; };

        category database       { capacity; };

        category client         { default_syslog; named; };

        category network        { default_syslog; named; };

        // category dnstap         { dnstap;};

        category unmatched      { named; };

        category network        { named; };

        category delegation-only { named;};

        category dispatch       { named; };

        category trust-anchor-telemetry { named; };

        category rpz            { rpz;};

};

For basic recommendations on the BIND logging configuration, refer to the ISC documentation.

Below is a sample log configuration for BIND. Note that this is an incomplete configuration, which you should adjust based on your environment.

The examples provided below use the /var/log/named/queries and /var/log/named/query-errors paths and files.

Our examples were taken from the example in the basic recommendations, with the following change: print-time yes; to print-time iso8601-utc;

 - example config components (not a complete logging configuration for BIND!):

      channel queries_log {

          file "/var/log/named/queries" versions 600 size 20m;

          print-time iso8601-utc;

          print-category yes;

          print-severity yes;

          severity info;

     };

     channel query-errors_log {

          file "/var/log/named/query-errors" versions 5 size 20m;

          print-time iso8601-utc;

          print-category yes;

          print-severity yes;

          severity dynamic;

     };

     category query-errors {query-errors_log; };

     category queries { queries_log; };

Bitdefender GravityZone content pack

This content pack provides parsing and dashboards for Bitdefender GravityZone Event Push and GravityZone On-Premises (Syslog alerts).

Supported versions

  • GravityZone Version 6.56.0-1

Requirements

  • The Bitdefender GravityZone input must be set up and correctly configured for Push Events.

  • For GravityZone Event Push events, GravityZone must be configured to send CEF-formatted logs to the CEF input.

  • For GravityZone Syslog/Appliance events, GravityZone must be configured to send Syslog-formatted logs to a Syslog UDP input. GravityZone does not support TCP.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Bitdefender Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Bitdefender Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

What is provided

  • GravityZone log parsing (Push Events and GravityZone alerts via Syslog), categorization, and a custom dashboard.

Limitations

  • Only the log types and fields officially documented by Bitdefender for GravityZone version 6.56 are supported in this content pack. Any undocumented fields that may appear are not mapped to the Security Data Lake schema. If such fields exist within a subarray structure, they may not be extracted or parsed by default.

  • Only CEF-formatted logs are supported for Event Push events.

Log format examples

The following event types and modules have been verified for use with this content pack (Event Push events):

antiexploit

CEF:0|Bitdefender|GravityZone|6.36.0-1|131234|Exploit Mitigation|10|BitdefenderGZModule=antiexploit BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=TEST_ENDPOINT BitdefenderGZComputerFQDN=sdl-endpoint.dsd.ro dvc=10.10.18.226 deviceExternalId=2e22eba5e8ee8c5b1852a9d7 BitdefenderGZEndpointId=2e22eba5e8ee8c5b1852a9d6 act=kill BitdefenderGZThreatName=EICAR-Test-File (not a virus) dvcpid=2000 BitdefenderGZExploitType=Flash/Generic BitdefenderGZParentProcess=4000 filePath=C:\\\\file15c8ba8b90ea1de127962f464.exe BitdefenderGZParentProcessPath=C:\\\\file25c8ba8b90ea1de127962f464.exe BitdefenderGZDetectionCve=cve string suser=johndoe@company.com BitdefenderGZDetectionTime=2024-10-10T13:58:30.000Z

adcloud

CEF:0|Bitdefender|GravityZone|6.36.0-1|231234|AD Integration Issue|6|BitdefenderGZModule=adcloud BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 BitdefenderGZSyncerId=22e2d9bfa849af3a1465b7e3 BitdefenderGZIssueType=ldap interrogation BitdefenderGZLastAdReportDate=2024-10-10T08:03:49.671Z

aph

CEF:0|Bitdefender|GravityZone|6.36.0-1|40|Antiphishing|9|BitdefenderGZModule=aph BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=FC-EXCHANGE-01 BitdefenderGZComputerFQDN=fc-exchange-01.fc.dom dvc=192.168.0.1 deviceExternalId=22e2d9bfa849af3a1465b7e4 BitdefenderGZEventType=phishing request=http://example.com/account/support/ act=aph_blocked end=2024-10-10T08:49:43.000Z cnt=1

avc

CEF:0|Bitdefender|GravityZone|6.36.0-1|30|Behavioral scanning|9|BitdefenderGZModule=avc BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-Win11 BitdefenderGZComputerFQDN=SDL-Win11 dvc=192.168.0.1 deviceExternalId=59a1604e60369e06732e2222 BitdefenderGZExploitType=AVC Blocked Exploit filePath=C:\\\\Users\\\\admin\\\\Desktop\\\\Tools\\\\avcsim\\\\win32\\\\avcsim32.exe act=Blocked BitdefenderGZDetectionTime=2024-10-10T07:56:33.000Z cnt=1

dp

CEF:0|Bitdefender|GravityZone|6.36.0-1|2000|Data Protection|9|BitdefenderGZModule=dp BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-Win11 BitdefenderGZComputerFQDN=SDL-Win11 dvc=192.168.0.1 deviceExternalId=59a1604e60369e06732e2222 BitdefenderGZTargetType=http BitdefenderGZBlockingRuleName=dv request=http://example.com/ act=data_protection_blocked end=2024-10-10T10:23:43.000Z cnt=1

endpoint moved out

CEF:0|Bitdefender|GravityZone|6.36.0-1|75000|Endpoint moved out|3|BitdefenderGZModule=endpoint-moved-out BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=TEST_ENDPOINT BitdefenderGZComputerFQDN=SDL-endpoint.dsd.ro dvc=10.10.18.226 deviceExternalId=22e2d9bfa849af3a1465b7e4 BitdefenderGZEndpointId=5e2085febf255a545e52276b BitdefenderGZHwId=2e222ef-5b7e43d387ba-54a95

exchange-user-credentials

CEF:0|Bitdefender|GravityZone|6.36.0-1|211234|Invalid Exchange user credentials|3|BitdefenderGZModule=exchange-user-credentials BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 BitdefenderGZEndpointId=22e2d9bfa849af3a1465b7e3

exchange malware

CEF:0|Bitdefender|GravityZone|6.36.0-1|212340|Exchange Malware Detected|9|BitdefenderGZModule=exchange-malware BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=FC-EXCHANGE-01 BitdefenderGZComputerFQDN=fc-exchange-01.fc.dom dvc=192.168.0.1 deviceExternalId=22e2d9bfa849af3a1465b7e4 BitdefenderGZEndpointId=22e2d9bfa849af3a1465b7e3 shost=FC-EXCHANGE-01 BitdefenderGZEmailSender=fc_test01@fc.dom duser=[\"fc_test02@fc.dom\"] BitdefenderGZEmailSubject=Emailing Sending.. WL-cbe100c9f42a20ef9a4b1c20ed1a59f9-0 BitdefenderGZDetectionTime=2024-10-10T14: 20:37.000Z msg=[{\"malwareName\":\"Trojan.Generic.KD.874127\",\"malwareType\":\"virus\",\"actionTaken\":\"quarantine\",\"infectedObject\":\"WL-cbe100c9f42a20ef9a4b1c20ed1a59f9-0\"}]

firewall

CEF:0|Bitdefender|GravityZone|6.36.0-1|50|Firewall|9|BitdefenderGZModule=fw BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-Win11 BitdefenderGZComputerFQDN=SDL-Win11 dvc=192.168.0.1 deviceExternalId=59a1604e60369e06732e2222 act=portscan_blocked BitdefenderGZFwProtocolId=6 BitdefenderGZEventSourceIP=192.168.0.2 end=2024-10-10T12:52:03.000Z cnt=1","CEF:0|Bitdefender|GravityZone|6.36.0-1|73000|Hardware Id Change|3|BitdefenderGZModule=hwid-change BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=A BitdefenderGZComputerFQDN=SDL-endpoint.ro dvc=10.10.18.255 deviceExternalId=2e222ef5b7e43d387ba54a96 BitdefenderGZOldHwid=12341234-1234-1234-1234-406186b5bde7 BitdefenderGZNewHwid=12341234-1234-1234-1234-406186b5bde6 BitdefenderGZEndpointId=2e222ef5b7e43d387ba54a95

hwidchange

CEF:0|Bitdefender|GravityZone|6.36.0-1|73000|Hardware Id Change|3|BitdefenderGZModule=hwid-change BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=A BitdefenderGZComputerFQDN=SDL-endpoint.dsd.ro dvc=10.10.18.255 deviceExternalId=2e222ef5b7e43d387ba54a96 BitdefenderGZOldHwid=12341234-1234-1234-1234-406186b5bde7 BitdefenderGZNewHwid=12341234-1234-1234-1234-406186b5bde6 BitdefenderGZEndpointId=2e222ef5b7e43d387ba54a95

hd

CEF:0|Bitdefender|GravityZone|6.36.0-1|800|HyperDetect Activity|10|BitdefenderGZModule=hd BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=Computer 1 BitdefenderGZComputerFQDN=computer1.local dvc=191.114.235.26 deviceExternalId=5c12612db1a43dc3097b23c6 BitdefenderGZMalwareType=file act=quarantined filePath=/Users/admin/Desktop/ BitdefenderGZAttackType=targeted attack BitdefenderGZDetectionLevel=permissive BitdefenderGZFilelessAttack=0 BitdefenderGZHwId=22574006-79523827-7401-9565-1295-798280775872 BitdefenderGZDetectionTime=2024-10-10T10:01:02.000Z suid=BF410F3B-5F3A-41E1-BF8F-28DE6948A355 suser=admin

install

CEF:0|Bitdefender|GravityZone|6.36.0-1|71000|Install|3|BitdefenderGZModule=install BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=TEST_ENDPOINT BitdefenderGZComputerFQDN=SDL-endpoint.dsd.ro dvc=10.10.18.226 deviceExternalId=2e22eba5e8ee8c5b1852a9d7 BitdefenderGZEndpointId=5e2085febf255a545e52276b BitdefenderGZHwId=12341234-1234-1234-1234-406186b5bdbdzzz50

modules

CEF:0|Bitdefender|GravityZone|6.36.0-1|35|Product Modules Status|5|BitdefenderGZModule=modules BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-Win11 BitdefenderGZComputerFQDN=SDL-Win11 dvc=192.168.0.1 deviceExternalId=59a1604e60369e06732e2222 BitdefenderGZMalwareModuleStatus=enabled BitdefenderGZAntiphishingModuleStatus=enabled BitdefenderGZFirewallModuleStatus=enabled BitdefenderGZBehavioralScanAVCModuleStatus=enabled BitdefenderGZWebAccessControlModuleStatus=disabled BitdefenderGZWebCategoryScanModuleStatus=disabled BitdefenderGZUserControlApplicationFilteringModuleStatus=disabled BitdefenderGZDataProtectionModuleStatus=disabled BitdefenderGZPowerUserModuleStatus=enabled BitdefenderGZDataLossPreventionModuleStatus=disabled

moved in

CEF:0|Bitdefender|GravityZone|6.36.0-1|74000|Endpoint moved in|3|BitdefenderGZModule=endpoint-moved-in BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=TEST_ENDPOINT BitdefenderGZComputerFQDN=SDL-endpoint.dsd.ro dvc=10.10.18.226 deviceExternalId=22e2d9bfa849af3a1465b7e3 BitdefenderGZEndpointId=5e2085febf255a545e52276a BitdefenderGZHwId=2e222ef-5b7e43d387ba-54a95

network-sandboxing

CEF:0|Bitdefender|GravityZone|6.36.0-1|121234|Sandbox Analyzer Detection|7|BitdefenderGZModule=network-sandboxing BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 BitdefenderGZEndpointId=59a1604e60369e06733f8aba dvchost=SDL-Win11 dvc=192.168.0.1 BitdefenderGZDetectionTime=2024-10-10T11:02:49.000Z BitdefenderGZMalwareType=RANSOMWARE BitdefenderGZFilePaths=[\"C:\\\\\\\\Users\\\\\\\\Administrator\\\\\\\\Documents\\\\\\\\installer.xml\",\"D:\\\\\\\\opt\\\\\\\\bitdefender\\\\\\\\installer2.xml\",\"D:\\\\\\\\sources\\\\\\\\console\\\\\\\\CommonConsole\\\\\\\\app\\\\\\\\modules\\\\\\\\policies\\\\\\\\view\\\\\\\\endpoints\\\\\\\\networkSandboxing\\\\\\\\installer3.xml\"] BitdefenderGZFileSizes=[\"2614\",\"2615\",\"2616\"] BitdefenderGZRemediationActions=[\"1\",\"\",\"1\"]

registration

CEF:0|Bitdefender|GravityZone|6.36.0-1|71234|Registration|3|BitdefenderGZModule=registration BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-EXCHANGE-01 BitdefenderGZComputerFQDN=fc-exchange-01.fc.dom dvc=192.168.0.1 deviceExternalId=22e2d9bfa849af3a1465b7e4 BitdefenderGZStatus=registered

ransomware-mitigation

CEF:0|Bitdefender|GravityZone|6.36.0-1|141234|Ransomware Detection|9|BitdefenderGZModule=ransomware-mitigation BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=DC-Nebula BitdefenderGZComputerFQDN=undefined dvc=10.17.16.10 deviceExternalId=5ed4d2fef23f7325715dbb22 BitdefenderGZCompanyName=SDL BitdefenderGZAttackType=remote cnt=23 BitdefenderGZDetectionTime=2024-10-10T10:33:14.000Z BitdefenderGZAttackSource=10.10.20.120 suser=user suid=S-11-22-33

security container

CEF:0|Bitdefender|GravityZone|6.36.0-1|18000|Security Container Update Available|2|BitdefenderGZModule=security-container-update-available BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=security-container-x BitdefenderGZComputerFQDN=security-container-x-containers-host.dsd.ro dvc=10.17.15.247 deviceExternalId=60f6ba5e1b3272cce33c3281 BitdefenderGZHostName=TEST_ENDPOINT_2

sva-load

CEF:0|Bitdefender|GravityZone|6.36.0-1|111234|Overloaded SVA|8|BitdefenderGZModule=sva-load BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=bitdefender-sva BitdefenderGZComputerFQDN=bitdefender-sva dvc=192.168.0.1 deviceExternalId=59b8f3aba849af3a1465b81e BitdefenderGZLoadAverage=1 BitdefenderGZCpuUsage=48 BitdefenderGZMemoryUsage=32 BitdefenderGZNetworkUsage=0 BitdefenderGZOverallUsage=48

sva

CEF:0|Bitdefender|GravityZone|6.36.0-1|112340|SVA status|4|BitdefenderGZModule=sva BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=bitdefender-sva BitdefenderGZComputerFQDN=bitdefender-sva dvc=192.168.0.1 deviceExternalId=59b8f3aba849af3a1465b81e BitdefenderGZSVAPoweredOff=0 BitdefenderGZSVAUpdateAvailable=1 BitdefenderGZSVARebootRequired=0 BitdefenderGZSVASignatureVersion=7.72479

supa update status

CEF:0|Bitdefender|GravityZone|6.36.0-1|12000|Outdated update server|2|BitdefenderGZFromSupa=1 BitdefenderGZModule=supa-update-status BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-Win11 BitdefenderGZComputerFQDN=SDL-Win11 dvc=192.168.0.1 deviceExternalId=59a1604e60369e06732e2222 BitdefenderGZStatus=outdated

troubleshooting-activity

CEF:0|Bitdefender|GravityZone|6.36.0-1|161234|Troubleshooting Activity|4|BitdefenderGZModule=troubleshooting-activity start=2020-06-24T06:06:48.000Z suser=test@test.com BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=TEST_ENDPOINT_WINDOWS_10 BitdefenderGZComputerFQDN=SDL-endpoint.dsd.ro dvc=10.10.0.101 deviceExternalId=5ee30e2b29a4e218489442b6 BitdefenderGZTaskId=5eea0105f23f731302405833 BitdefenderGZTaskType=Debug Session BitdefenderGZErrorCode=3 BitdefenderGZLocalPath=/test/dir BitdefenderGZNetworkSharePath=//1.2.3.4/dir BitdefenderGZSaveToBitdefenderCloud=false BitdefenderGZStatus=Finished BitdefenderGZStopReason=Partial Delivery BitdefenderGZFailedStorageType=Target Machine end=2024-10-24T06:09:28.000Z

task-status

CEF:0|Bitdefender|GravityZone|6.36.0-1|21234|Task Status|4|BitdefenderGZModule=task-status BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-Win11 BitdefenderGZComputerFQDN=SDL-Win11 dvc=192.168.0.1 deviceExternalId=59a1604e60369e06732e2222 suid=59a14b2b1da197c6108b4568 BitdefenderGZTaskId=59b28dc81da19711058b4568 msg=Quick Scan 2024-10-10(sub-task) BitdefenderGZTaskType=272 dhost=SDL-Win11 BitdefenderGZTaskSuccessful=1 BitdefenderGZStatus=processed BitdefenderGZErrorCode=0

uninstall

CEF:0|Bitdefender|GravityZone|6.36.0-1|72000|Uninstall|9|BitdefenderGZModule=uninstall BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=TEST_ENDPOINT BitdefenderGZComputerFQDN=SDL-endpoint.dsd.ro dvc=10.10.18.226 deviceExternalId=22e2d9bfa849af3a1465b7e4 BitdefenderGZEndpointId=5e2085febf255a545e52276b reason=local uninstall

uc

CEF:0|Bitdefender|GravityZone|6.36.0-1|1000|Web Control|9|BitdefenderGZModule=uc BitdefenderGZCompanyId=2e222e8fb12fb8700396d6375 dvchost=SDL-Win11 BitdefenderGZComputerFQDN=SDL-Win11 dvc=192.168.0.1 deviceExternalId=59a1604e60369e06732e2222 BitdefenderGZApplicationControlType=http request=http://192.168.0.1:2869/SDL/udhisapi.dll BitdefenderGZApplicationControlBlockType=http_timelimiter act=uc_site_blocked end=2024-10-10T12:46:30.000Z cnt=1

Configure the Bitdefender GravityZone input in Security Data Lake

For information on configuring this input, refer to Bitdefender GravityZone input.

Note

The authorization header name must be authorization.

Prepare Bitdefender GravityZone to route data

For official guidance on setting up GravityZone to route logs externally, refer to Generic integrations for SIEM platforms without HTTPS listeners.

Please note that:

  • A valid server URL and port are required, for example: https://mydomain_name.dev:5555/bitdefender. In this example the port is 5555. In a local instance or with a static IP, it is possible an IP may work.

  • The authorization header name must be authorization.

  • The service type must be cef.

The following is an example API call that may be generated:

curl --tlsv1.2 -sS -k -X POST https://cloud.gravityzone.bitdefender.com/api/v1.0/jsonrpc/push -H 'authorization: Basic 222jZDYwMDg4ZWRjNjdk2WZlYWZkYTk3O2I4ZGUw2DYwNzI4ODU2OWJhZm2kNTgzNjBhMTJ2MTJkY2Y52WYxMjo=' -H 'cache-control: no-cache' -H 'content-type: application/json' -d '{
"id": "1",
"jsonrpc": "2.0",
"method": "setPushEventSettings",
"params": {
"serviceSettings": {
"requireValidSslCertificate": true,
"authorization": "test",
"url": " https://mydomain_name.dev:5555/bitdefender"
},
"serviceType": "cef",
"status": 1,
"subscribeToEventTypes": {
"modules": true,
"sva": true,
"registration": true,
"supa-update-status": true,
"av": true,
"aph": true,
"fw": true,
"avc": true,
"uc": true,
"dp": true,
"device-control": true,
"hd": true,
"sva-load": true,
"task-status": true,
"exchange-malware": true,
"network-sandboxing": true,
"partner-changed": true,
"adcloud": true,
"exchange-user-credentials": true,
"exchange-organization-info": true,
"endpoint-moved-out": true,
"endpoint-moved-in": true,
"troubleshooting-activity": true,
"uninstall": true,
"install": true,
"hwid-change": true,
"new-incident": true,
"antiexploit": true,
"network-monitor": true,
"ransomware-mitigation": true,
"supa-update-status": true,
"storage-antimalware": true,
"security-container-update-available": true,
"uninstall": true,
"activity": true
}'} }

The result should be:

{"id":"1","jsonrpc":"2.0","result":true}

Error messages can look like the following:

{"id":"1","jsonrpc":"2.0","error":{"code":-32000,"message":"Server error","data":{"details":"Invalid API key. Please generate an API key in Control Center."}}}

In this case, generate a correct API key or check that the format is correct.

Wait at least 10 minutes for the new configuration settings to take effect.

Note

GravityZone requires a TLS 1.2 connection. Your server must be configured to support TLS connection.

Message fields included in this pack

Most fields are renamed. The prefix BitdefenderGZ may be substituted with vendor_. Other fields are mapped to Security Data Lake schema fields.

Field Name

Mapped From

Example Value(s)

Field Type

Description

alert_category

BitdefenderGZAttackType(s)

remote

alert_category

BitdefenderGZExploitType

AVC Blocked

alert_category

BitdefenderGZMalwareType

file

alert_category

BitdefenderGZTargetType

http

alert_signature

BitdefenderGZAttackType,

remote

Only if MalwareName does not exist

alert_signature

BitdefenderGZDetectionName

alert_signature

BitdefenderGZExploitTechnique

alert_signature

BitdefenderGZMalwareName

alert_signature

detection_exploitTechnique

alert_signature

detection_threatName

EICAR-Test-File

attacks_tactic_uid

BitdefenderGZAttCkId

destination_ip

dvc

10.10.10.10

email_from

BitdefenderGZEmailSender

stefan@example.com

email_subject

BitdefenderGZEmailSubject

Welcome

event_created

BitdefenderGZDate

2024-09-14T08:03:49.671Z

date

event_created

BitdefenderGZDetectionTime

2024-09-14T08:03:49.671Z

date

event_created

BitdefenderGZEventCreated

2024-09-14T08:03:49.671Z

date

event_created

start

2024-09-14T08:03:49.671Z

date

file_name

fname

example.exe

file_path

BitdefenderGZDetectionPath

c:\\myfile

file_path

BitdefenderGZFilePath

c:\\myfile

file_path

BitdefenderGZLocalPath

c:\\myfile

file_path

filePath

c:\\myfile

file_size

BitdefenderGZFileSize

257

hash

fileHash

hash_sha256

BitdefenderGZFileHashSha256

host_hostname

BitdefenderGZComputerFQDN

test-inst@example.com

host_hostname

BitdefenderGZHostName

test-inst

host_hostname

computer_name

test-inst

host_hostname

dvchost

test-inst

host_hostname

shost

test-inst

host_id

BitdefenderGZEndpointId

5e2285febf225a545e22272b

http_request_path

BitdefenderGZRequest

http://example.com/account/support/

http_request_path

BitdefenderGZUrl

http://example.com/account/support/

network_iana_number

BitdefenderGZFwProtocolId

6

process_parent_path

sproc

source_id

BitdefenderGZComputerId

623c18fb122b8700396d6322

source_ip

BitdefenderGZComputerIp

10.10.10.10

source_ip

BitdefenderGZEventSourceIP

10.10.10.10

source_ip

BitdefenderGZSourceIp

10.10.10.10

source_user_name

BitdefenderGZSUser

stefan

source_user_name

suser

stefanadmin

user_name

BitdefenderGZSDetectionUsername

stefan

user_name

BitdefenderGZSUserName

stefan

user_name

detection_username

Administrator

user_name

duser

stefan

vendor_attack_source

BitdefenderGZAttackSource

12.12.12.23

vendor_company_id

BitdefenderGZCompanyId

623228fb12f28700396d6222

vendor_company_name

BitdefenderGZCompanyName

Bitdefender

vendor_computer_fqdn

BitdefenderGZComputerFQDN

test@bitdefender.com

vendor_computer_name

BitdefenderGZComputerName

test-machine

vendor_control_block_type

BitdefenderGZApplicationControlBlockType

http_timelimiter

vendor_control_type

BitdefenderGZApplicationControlType

http

vendor_count

BitdefenderGZCount

2

vendor_count

cnt

3

vendor_detection_level

BitdefenderGZDetectionLevel

2

vendor_detection_time

BitdefenderGZDetectionTime

2024-06-01T10:22:12.000Z

date

vendor_event_action

BitdefenderGZActionTaken

quarantine

array

vendor_event_action

BitdefenderGZDetectionAction

vendor_event_action

BitdefenderGZFinalStatus

vendor_event_action

BitdefenderGZMainAction

vendor_event_action

act

vendor_event_action

detection_action

vendor_event_description

BitdefenderName

vendor_event_end_date

BitdefenderGZEnd

2024-02-11T10:22:43.000Z

vendor_event_module

BitdefenderGZModule

vendor_event_module

BitdefenderName

If module does not exist

vendor_event_severity_level

severity

3

long

0 to 10

vendor_event_type

BitdefenderGZEventType

vendor_incident_id

BitdefenderGZIncidentId

vendor_severity_score

BitdefenderGZSeverityScore

23

Categorization

The following event types and modules are currently categorized:

vendor_event_module

GIM Event Type Code

GIM Event Type

antiexploit

171000

Malware Alert

avc

171000

Malware Alert

exchange-malware

171000

Malware Alert

fw

129999

Network Messages

new-incident

179999

Alert Default

Bitdefender syslog/application control events from Bitdefender GravityZone on premises

Bitdefender Syslog events are very similar to Event Push events. If possible, the same or an adjusted field mapping is used. Syslog Log fields may not have the BitdefenderGZ prefix.

Example application control configuration steps

  1. In GravityZone, go to Policies > Enable Application Control > Add Rule.

  2. Define the rule parameters:

    • Rule Type

    • File Path

    • Application Name

    • Users

    • Set an Action

  3. Syslog notifications are generated by events that also trigger a Notification to be sent to Syslog.

  4. Access the bell icon in the top-right corner of your web console, then select Notifications settings.

  5. Enable Blocked Application and activate Log to syslog server under Visibility to ensure the notification is sent to Security Data Lake.

  6. Go to Configuration > Miscellaneous. Enable Syslog and add the SIEM Hostname/IP, Protocol- UDP, Input Port, and Event Format. Note that you must enter the Bitdefender Forwarder IP address and the port number you set in the Forwarder input profile configuration.

  7. Launch the Syslog UDP input in Security Data Lake with the port number mentioned above.

Bitdefender syslog events message identification

These Syslog events emit a prefilled application_name but may have a header with gravityzone:. The pack should detect it and route the message into the correct stream. If the message does not have such a header, a static device_product input field with the value GravityZone can be used.

Filebeat is currently not supported but an identification rule exists. Add the event_source_product static field in the Filebeat configuration file with the value GravityZone. Messages will go into the correct stream, but parsing may not work, unless the facility field exists.

Example syslog event

gravityzone: [application-control] {"module":"application-control","product_installed":"BEST","user":{"id":"S-1-5-13","name":"SYSTEM"},"computer_name":"DESKTOP-TEST","computer_fqdn":"desktop-test","computer_ip":"192.168.40.11","computer_id":"222ab2a1d494e8a20f299845","mode":1,"scanMode":"production","filePath":"C:\\Users\\Defender\\Downloads\\AnyDesk.exe","fileVersion":"","productName":"","productVersion":"","publisher":"","fingerprint":"D99F9F19173473FF515A6956BC61BC22E84389","thumbprints":[],"ruleName":"","date":"2025-06-12T06:27:37.258Z","count":1}

Dashboard

Bitdefender GravityZone offers a dashboard with 3 tabs: Overview, New Incident, and HyperDetect Activity.

Bitdefender telemetry content pack

Bitdefender telemetry data aggregates threat indicators, system events, and configuration details from endpoints. This pack parses EDR/raw events from BEST endpoints, providing normalization and enrichment of endpoint activity events, including file operations, process events, network connections, registry changes, and authentication events.

Requirements

  • Bitdefender GravityZone cloud or on-prem with a policy configured under Agent > Security Telemetry using Syslog (JSON) as the SIEM solution and the Bitdefender Forwarder IP and port as the Hostname/IP and Port, respectively. This ensures that BEST agents submit events to the Bitdefender Forwarder. For more information, refer to Security Telemetry.

  • Bitdefender EDR license

Log collection and delivery

Bitdefender telemetry events are delivered to Security Data Lake via syslog. Only syslog-formatted logs are supported. TLS 1.2 is required for the syslog connection.

Syslog input configuration

Configure Security Data Lake to receive Bitdefender telemetry:

  1. Create a syslog input (TCP recommended), with TLS enabled. For details, refer to Syslog Inputs.

  2. Enable Store full message only if you need complete message retention for debugging purposes. Otherwise, enabling this option will significantly impact the daily ingestion volume.

Bitdefender GravityZone configuration

Configure GravityZone to export telemetry:

  1. In the GravityZone console, follow the instructions in Security Telemetry to configure syslog telemetry exporting. Enter the Bitdefender Forwarder IP address and port values in the Hostname/IP and Port fields, respectively.

  2. Enable telemetry event exporting for the desired event types.

  3. Verify TLS 1.2 connectivity.

Stream configuration

This technology pack includes 1 stream:

  • Illuminate:Bitdefender Telemetry Messages

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • Bitdefender Telemetry Logs

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

What is provided

  • Parsing rules to extract Bitdefender telemetry events into Security Data Lake schema-compatible fields

  • Security Data Lake Information Model message categorization for authentication, network, file, process, and registry events

  • Security Core support for endpoint telemetry categorization

  • An Illuminate Spotlight dashboard with five tabs: Overview, Network Activity, File Activity, Process Activity, and User Activity

GIM categorization

GIM categorization is provided for the following event types:

Event type

gim_event_type_code

gim_event_category

gim_event_subcategory

gim_event_type

log_on

100000

authentication

authentication.logon

logon

log_out

102500

authentication

authentication.logoff

logoff

network_connection (connect)

120200

network

network.open

network connection initiated

network_connection (disconnect)

120300

network

network.close

network connection ended

process_create

190000

process

process.execute

process started

terminate_process

190100

process

process.stop

process stopped

file_create

200000

file

file.create

file created

file_delete

200100

file

file.delete

file deleted

file_modify

201000

file

file.modify

file modified

file_read, file_move

209999

file

file.default

file event

file_access

201500

file

file.access

file accessed

reg_create_key

250500

registry

registry.key_change

registry key added

reg_delete_key

250501

registry

registry.key_change

registry key deleted

reg_delete_value

250002

registry

registry.value_change

registry value deleted

reg_modify_value

250003

registry

registry.value_change

registry value modified

Bitdefender Telemetry Spotlight content pack

The package offers a dashboard with five tabs: Overview, Network Activity, File Activity, Process Activity, and User Activity.

Caddy Webserver content pack

This content pack is designed for Caddy Webservers running on Ubuntu systems. It parses Caddy access logs.

Supported versions

  • Tested with Caddy version 2.7.x

Requirements

  • The supported log delivery is via Filebeat with Bitdefender Sidecar.

  • The pack only supports Ubuntu and Linux versions with the same path and file structure.

  • The pack only supports the standard log folder for Ubuntu.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Caddy Webserver Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Caddy Webserver Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

What is provided

  • Parsing rules to extract Caddy Webserver logs into Security Data Lake schema-compatible fields. Caddy Webserver logs receive the GIM code 180200 (http.communication).

Log format example

Access logs

"level":"info","ts":1743966522.1211624,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.168.156.55","remote_port":"60128","client_ip":"192.168.156.34","proto":"HTTP/1.1","method":"GET","host":"20.20.232.216:80","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"],"Accept-Encoding":["gzip, deflate","gzip, deflate"],"Connection":["keep-alive"],"Content-Type":["application/x-www-form-urlencoded; charset=UTF-8"],"Accept":["/"],"X-Requested-With":["XMLHttpRequest"],"Accept-Language":["en US,en;q=0.9,sv;q=0.8"]}},"bytes_read":110,"user_id":"","duration":0.000018081,"size":20,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://20.20.222.216/"],"Content-Type":[]}

Input via Filebeat together with Bitdefender Sidecar

To configure your Security Data Lake server and your client(s), refer to the Sidecar documentation.

  1. Create a Beats input.

  2. Create a Security Data Lake REST API token and save it.

  3. Install Bitdefender Sidecar.

  4. Add your client(s), e.g. web server.

These steps are explained in the sections below.

Security Data Lake settings

  1. Create a Beats input in Security Data Lake. For information on how to create and configure the input, refer to Beats input.

  2. Create a Security Data Lake REST API access token and save it. For details, refer to Installing Sidecar (Section 1.2, Create an API token).

  3. Create a (Linux) filebeat configuration under System > Sidercars > Configuration , with a filebeat on Linux collector.

  4. Configure the file and add:

    • The correct IP under hosts.

      Important

      You must enter the IP of the Forwarder and the port that you defined in the Beats input profile.

    • The log source configured to the desired value and an event_source_product field with a caddy_webserver value.

    filebeat.inputs:
- input_type: log
  paths:
    - /var/log/caddy/*
  type: filestream
  fields_under_root: true
  fields:
    event_source_product: caddy_webserver

    Important

    There must be two spaces in front of event_source_product and - /var....

    This setting will pull all logs in the - /var/log/caddy/* folder. If needed, adjust the Caddy configuration file to store the logs locally and choose the desired path.

  5. Save the configuration to complete setup.

Configure a client with Filebeat and Security Data Lake Sidecar

  1. Install, enable and verify Bitdefender Sidecar. For details, refer to Installing Sidecar.

  2. Install Filebeat according to the instructions in the official documentation. Alternatively, you can download and install the OSS-only version of Filebeat.

    • If you install Filebeat manually, use /etc/filebeat as the installation directory.

    • If you install Filebeat via apt-get, then the correct directory is automatically selected.

    Example commands for Ubuntu:

    wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/oss-8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list
sudo apt-get update && sudo apt-get install filebeat
sudo systemctl enable filebeat
sudo systemctl start filebeat
sudo systemctl status filebeat

  3. (Optional) Edit the filebeat.yml file as needed. You do this via the Sidecar configuration in the Security Data Lake interface.

  4. Start the daemon.

  5. If there is a permission issue, you can resolve it by running the following command:

    sudo chown root filebeat.yml

  6. In Security Data Lake, assign a configuration to your machine.

    Warning

    This pack was tested on Ubuntu and may not work as designed with other Linux-based systems due to different path and file names. Error logs are not parsed.

Field mapping

Caddy Webserver Spotlight content pack

Caddy Webserver offers a dashboard with one tab: Caddy Webserver Overview

Carbon Black CB Defense content pack

Carbon Black Defense is a next-gen antivirus (NGAV) and an endpoint detection and response solution (EDR) that allows security teams to monitor and instantly detect threats against their companies' devices, while at the same time providing the user with a suite of tools that protect against most attacks, including malware, ransomware, zero-day, and non-malware. This technology pack will process Carbon Black Defense logs, providing normalization and enrichment of common events of interest.

Supported versions

  • CB Defense does not have version numbers. Only real-world testing can confirm if this content pack is compatible with the product at any given time.

Stream configuration

This technology pack includes one stream:

  • Illuminate:Carbon Black Defense Messages

Index set configuration

This technology pack includes one index set definition:

  • Carbon Black Defense Event Log Messages

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

cbdefense1 CEF:0|CarbonBlack|CbDefense_Syslog_Connector|2.0|Active_Threat|A known virus (iWorm) is actively attempting a network connection.|7|rt="Apr 15 2016 13:11:37" sntdom=mycompany dvchost=iworm_test duser=iworm_test dvc= cs3Label="Link" cs3="https://testserver.company.net/ui#investigate/events/device/2004121/incident/UHMZ3" cs4Label="Threat_ID" cs4="UHMZ3" act=Alert

Requirements

What is provided

  • Parsing rules to extract Carbon Black logs into Security Data Lake schema compatible fields

Checkpoint Next Generation Firewall content pack

Checkpoint Next Generation Firewall (NGFW) is an advanced security solution that combines traditional firewall features with intrusion prevention, antivirus, and application control capabilities to enhance network security. It inspects traffic at both the network and application levels, providing granular control over network traffic and preventing the spread of malware and cyber threats. Checkpoint NGFWs are highly scalable and easy to manage, making them a popular choice for organizations of all sizes seeking advanced network security features. This technology pack will process Checkpoint Next Generation Firewall (NGFW) logs, providing normalization and enrichment of those events.

Requirements

  • Checkpoint NGFW version R81.x.

Supported versions

  • Checkpoint R81.2.0

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Checkpoint Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Checkpoint Logs”

Log collection

  • Sending logs via Syslog

Log format example

[flags:"147456"; ifdir:"inbound"; loguid:"{0x5b691e76,0xf,0x670111ac,0xc0000017}"; origin:"192.168.10.75"; originsicname:"cn=cp_mgmt,o=CHKP_R81..b792qm"; sequencenum:"11"; time:"1677752746"; version:"5"; attack:"Security Products Enforcement Violation"; attack_info:"Netis/Netcore Router Hard-Coded Backdoor"; confidence_level:"5"; description_url:"NETIS_R_help.html"; performance_impact:"3"; product:"SmartDefense"; protection_id:"asm_dynamic_prop_NETIS_R"; protection_name:"Netis/Netcore Router Hard-Coded Backdoor"; protection_type:"IPS"; severity:"3"; smartdefense_profile:"Optimized"; src:"192.168.11.55"]

[action:"Drop"; flags:"393216"; ifdir:"inbound"; ifname:"eth1"; logid:"0"; loguid:"{0x641438da,0x1,0x4b0aa8c0,0x13dca7b3}"; origin:"192.168.10.75"; originsicname:"cn=cp_mgmt,o=gw-chkp..2hw9xr"; sequencenum:"2"; time:"1679046874"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={5F246403-00BB-E743-9690-C36A9C7FE416};mgmt=gw-chkp;date=1679046655;policy_name=Standard\]"; dst:"142.250.192.13"; layer_name:"Network"; layer_uuid:"f5cec687-05e5-4573-b1dc-08119f24cbc9"; match_id:"1"; parent_rule:"0"; rule_action:"Drop"; rule_name:"Block Client IP"; rule_uid:"f566bb6e-b41b-4e41-b67d-da0ef3aa1d08"; product:"VPN-1 & FireWall-1"; proto:"6"; s_port:"49243"; service:"443"; service_id:"https"; src:"192.168.11.65"]

[action:"Accept"; flags:"163872"; ifdir:"outbound"; loguid:"{0x63dd128a,0xc3,0x6efea8c0,0xdd49b9f}"; origin:"192.168.10.75"; originsicname:"cn=cp_mgmt,o=CHKP_R81..b792qm"; sequencenum:"1"; time:"1675938823"; version:"5"; administrator:"admin"; client_ip:"192.168.10.71"; machine:"192.168.10.71"; operation:"Log Out"; operation_number:"12"; product:"query-database"; subject:"Administrator Login"]

What is provided

We provide parsing rules to normalize and enrich Checkpoint Next Generation Firewall log messages, including:

  • URL Filtering

  • Smart Dashboard

  • Log Update

  • Security Management

  • CPM Server

  • Smart Console

  • Query Database

  • Endpoint Management

  • Smart Defense

  • Endpoint Security Console

  • Web API

  • VPN-1 & Firewall-1

We provide categorization for the following log types:

  • SmartDefense Alert logs

  • Network logs

  • Authentication logs

Events processed by this technology pack

The Checkpoint Next Generation Firewall content pack supports parsing for all fields, and GIM categorization for network events, SmartDefence alert events, and authentication events.

Checkpoint NGFW Spotlight content pack

The Checkpoint NGFW Spotlight Content Pack comes bundled with the Checkpoint Security Content Pack. For more information on Spotlight Content Pack selection, refer to Illuminate Content Hub. This additional pack contains the following dashboards: Overview, Alerts, Network, and Authentication.

Cisco ASA content pack

The Cisco ASA (Adaptive Security Appliances) is a multipurpose firewall appliance from Cisco and is usually used for packet filtering purposes, but it supports many additional features, such as stateful filtering, application inspection, NAT, DHCP, routing, VPN, etc. This technology pack will process Cisco ASA logs, providing normalization and enrichment of common events of interest. The content pack only supports the standard syslog template. Custom templates are not supported.

Supported versions

  • Up to version 9.x

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Cisco Device Messages ”

Requirements

  • Configure CISCO ASA device(s) to transmit Syslog to Security Data Lake via the Bitdefender Forwarder Syslog input. For details, refer to Syslog Inputs.

  • Security Data Lake raw/syslog input (ASAs syslog format may be rejected by Security Data Lake due to a non-RFC compliant format. Configure a RFC 5424 output to use a Security Data Lake syslog input. Alternatively, send the logs to Security Data Lake via the Raw or plaintext input).

Index set configuration

This technology pack includes one index set definition:

  • “Cisco Devices Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

`%ASA-6-305011: Built dynamic TCP translation from DL_172_16:192.168.10.10/1234 to L3_Internet:10.10.10.10/1234Jul 13 2021 14:13:19: %ASA-6-302014: Teardown TCP connection 8065 for inside:10.10.0.100/50511 to identity:172.10.124.136/51311 duration 0:00:00 bytes 422 TCP Reset-I`

Note

  • ASAs IP to hostname feature is not fully supported.

  • Security Data Lake Illuminate does not support network interface names with spaces.

What is provided

  • Parsing rules to extract Cisco ASA logs into Security Data Lake schema compatible fields.

  • Two dashboards.

  • One overview dashboard with 4 tabs. These tabs are ASA Overview, Network, Device Authentication, High Priority Messages.

  • One dashboard for IDS/IPS messages. To get these messages, Cisco ASA may require a specific license.

ASA message processing

The Illuminate processing of ASA Firewall log messages provides the following:

  • Field extraction, normalization and message enrichment for SFOS log messages.

  • GIM Categorization of the following messages:

    Cisco event code

    GIM event type code

    GIM event type

    106002

    129999

    Network Message

    106100

    120000

    Network Connection

    106102

    120000

    Network Connection

    106103

    120000

    Network Connection

    106001

    120000

    Network Connection

    106006

    120000

    Network Connection

    106007

    120000

    Network Connection

    106015

    120000

    Network Connection

    106016

    170001

    Network Alert

    106017

    170001

    Network Alert

    106018

    129999

    Network Message

    110002

    120000

    Network Connection

    110003

    120100

    Network Routing

    113008

    109999

    Authentication Message

    113012

    109999

    Authentication Message

    113021

    100000

    Logon

    113006

    100000

    Logon

    113007

    100000

    Logon

    302013

    120200

    Network Connection Initiated

    302014

    120300

    Network Connection Initiated

    302015

    120200

    Network Connection Initiated

    302016

    120300

    Network Connection Initiated

    302018

    120300

    Network Connection Initiated

    302022

    120200

    Network Connection Initiated

    302023

    120300

    Network Connection Initiated

    302024

    120200

    Network Connection Initiated

    302025

    120300

    Network Connection Initiated

    302026

    120200

    Network Connection Initiated

    302027

    120300

    Network Connection Initiated

    302036

    120300

    Network Connection Initiated

    302303

    120200

    Network Connection Initiated

    302304

    120300

    Network Connection Initiated

    302306

    120300

    Network Connection Initiated

    313004

    129999

    Network Message

    338001

    179999

    Alert Message

    338002

    179999

    Alert Message

    338003

    179999

    Alert Message

    338004

    179999

    Alert Message

    338005

    179999

    Alert Message

    338006

    179999

    Alert Message

    338007

    179999

    Alert Message

    338008

    179999

    Alert Message

    338201

    179999

    Alert Message

    338202

    179999

    Alert Message

    338203

    179999

    Alert Message

    338204

    179999

    Alert Message

    400000

    170001

    Alert Message

    400001

    170001

    Alert Message

    400002

    170001

    Alert Message

    400003

    170001

    Alert Message

    400004

    170001

    Alert Message

    400005

    170001

    Alert Message

    400006

    170001

    Alert Message

    400010

    170001

    Alert Message

    400011

    170001

    Alert Message

    400012

    170001

    Alert Message

    400013

    170001

    Alert Message

    400014

    170001

    Alert Message

    400015

    170001

    Alert Message

    400016

    170001

    Alert Message

    400017

    170001

    Alert Message

    400018

    170001

    Alert Message

    400019

    170001

    Alert Message

    400020

    170001

    Alert Message

    400021

    170001

    Alert Message

    400022

    170001

    Alert Message

    400034

    170001

    Alert Message

    400035

    170001

    Alert Message

    400036

    170001

    Alert Message

    400037

    170001

    Alert Message

    400038

    170001

    Alert Message

    400039

    170001

    Alert Message

    400040

    170001

    Alert Message

    400042

    170001

    Alert Message

    400043

    170001

    Alert Message

    400044

    170001

    Alert Message

    400045

    170001

    Alert Message

    400046

    170001

    Alert Message

    400047

    170001

    Alert Message

    400048

    170001

    Alert Message

    400049

    170001

    Alert Message

    400007

    170001

    Alert Message

    400008

    170001

    Alert Message

    400009

    170001

    Alert Message

    400023

    170001

    Alert Message

    400024

    170001

    Alert Message

    400025

    170001

    Alert Message

    400026

    170001

    Alert Message

    400027

    170001

    Alert Message

    400028

    170001

    Alert Message

    400029

    170001

    Alert Message

    400030

    170001

    Alert Message

    400031

    170001

    Alert Message

    400032

    170001

    Alert Message

    400033

    170001

    Alert Message

    400041

    170001

    Alert Message

    400050

    170001

    Alert Message

    410002

    120000

    Network Connection

    421001

    120000

    Network Connection

    500005

    120000

    Network Connection

    502101

    110000

    Account Created

    502102

    110500

    Account Locked

    507003

    120000

    Network Connection

    604103

    299999

    DHCP Default Event

    605004

    100000

    Logon

    605005

    100000

    Logon

    606001

    100000

    Logon

    606002

    100000

    Logon

    606003

    100000

    Logon

    606004

    100000

    Logon

    611101

    100500

    Credential Validation

    611102

    100500

    Credential Validation

    611103

    102500

    Logoff

    710002

    120000

    Network Connection

    710003

    120000

    Network Connection

    710005

    120000

    Network Connection

    710006

    129999

    Network Connection

    772003

    100000

    Logon

    772004

    100000

    Logon

    772005

    100000

    Logon

    772006

    100000

    Logon

    815002

    120000

    Network Connection

Supported event IDs

106001 | 106002 | 106006 | 106007 | 106010 | 106012 | 106013 | 106014 | 106016 | 106017 | 106018 | 106021 | 106023 | 106100 | 106101 | 106102 | 106103 | 109005 | 109006 | 109007 | 109008| 109024 | 109025 | 110002 | 110003 | 111007 | 111008 | 111009 | 111010 | 113003 | 113004 | 113005 | 113006 | 113007 | 113008 | 113009 | 113011 | 113012 | 113019 | 113021 | 113022 | 113023| 113029 | 113030 | 113031 | 113032 | 113033 | 113034 | 113035 | 113036 | 113038 | 113039 | 199020 | 199021 |

201002 | 201003 | 201004 | 201005 | 201006 | 201009 | 201010 | 201011 | 201012 | 201013 | 202010 | 209003 | 209004 | 209005 | 216001 |

302010 | 302013 | 302014 | 302015 | 302016 | 302018 | 302020 | 302021 | 302022 | 302023 | 302024 | 302025 | 302026 | 302027 | 302036 | 302304 | 302305 | 302306 | 303002 | 304001 | 304002| 304003 | 304004 | 304005 | 304006 | 304007 | 305005 | 305006 | 305011 | 305012 | 305019 | 305020 | 308001 | 313001 | 313004 | 313005 | 313008 | 313009 | 316001 | 318001 | 318101 | 321005| 321006 | 322002 | 322003 | 325001 | 325002 | 326013 | 331001 | 331002 |

400010 | 400014 | 400011 | 400014 | 405001 | 410001 | 401002 | 401003 | 401004 | 401005 | 405002 | 407001 | 407002 | 410002 | 414001 | 415007 | 415008 | 415009 | 415010 | 415011 | 415012| 415013 | 415014 | 418001 | 419002 | 419005 | 419006 | 420002 | 420003 | 421001 | 421002 | 421007 | 429002 | 429003 | 434002 | 434003 |

500001 | 500002 | 500004 | 500005 | 502101 | 502102 | 502103 | 502111 | 502112 | 507003 |

602303 | 602304 | 602305 | 604101 | 604102 | 604103 | 604104 | 604105 | 604201 | 604202 | 604203 | 604204 | 604205 | 604206 | 604207 | 604208 | 605005 | 606001 | 606002 | 606003 | 606004| 607001 | 608001 | 608002 | 608003 | 608004 | 608005 | 609001 | 609002 | 602101 | 611101 | 611102 | 611103 | 611301 | 611303 | 613004 | 620001 |

710002 | 710005 | 710003 | 710006 | 713041 | 713042 | 713049 | 713050 | 713120 | 713172 | 713201 | 713230 | 713231 | 713257 | 713903 | 713904 | 713905 | 716001 | 716002 | 716055 | 716056| 716057 | 716058 | 716059 | 716060 | 716500 | 716501 | 716502 | 716503 | 716504 | 716505 | 716506 | 716508 | 716509 | 716510 | 716512 | 716513 | 716515 | 716516 | 716517 | 716518 | 716519| 716520 | 716521 | 716522 | 721001 | 721002 | 721003 | 721004 | 721005 | 721006 | 721007 | 721008 | 721009 | 721010 | 721011 | 721012 | 721013 | 721014 | 721015 | 721016 | 721017 | 721018| 721019 | 722004 | 722005 | 722006 | 722007 | 722008 | 722009 | 722010 | 722011 | 722012 | 722013 | 722014 | 722021 | 722022 | 722023 | 722026 | 722027 | 722028 | 722032 | 722033 | 722034| 722037 | 722038 | 722042 | 722043 | 722044 | 722046 | 722047 | 722048 | 722049 | 722050 | 722051 | 725002 | 725001 | 725003 | 725007 | 725016 | 733100 | 737001 | 737002 | 737003 | 737004| 737005 | 737006 | 737007 | 737008 | 737009 | 737010 | 737011 | 737012 | 737013 | 737014 | 737015 | 737016 | 737017 | 737018 | 737019 | 737023 | 737024 | 737025 | 737027 | 737028 | 737029| 737030 | 737031 | 737032 | 737033 | 737034 | 737035 | 737036 | 737038 | 746014 | 746015 | 746016 | 750001 | 750002 | 750003 | 750004 | 750005 | 750006 | 750007 | 750008 | 750009 | 750010| 750014 | 750015 | 750016 | 751001 | 751002 | 751003 | 751004 | 751005 | 751006 | 751007 | 751008 | 751009 | 751010 | 751011 | 751012 | 751013 | 751014 | 751015 | 751016 | 751017 | 751019| 751020 | 751021 | 751022 | 751023 | 751024 | 751025 | 751026 | 751027 | 751028 | 752002 | 752003 | 752004 | 752005 | 752006 | 752007 | 752010 | 752012 | 752013 | 752014 | 752015 | 752016| 768001 | 768002 | 768003 | 768004 | 769001 | 769002 | 769003 | 769004 | 769005 | 769006 | 769007 | 769008 | 769009 | 772002 | 772003 | 772004 | 772005 | 772006 | 775001 | 775003 | 775004| 775005 | 779003 | 779004 | 779005 | 779006 | 779007 |

805001 | 805002 | 805003 | 812002 |

Basic support for CTS SXP event IDs (application_name and vendor_event_description)

338001 | 338002 | 338003 | 338004 | 338005 | 338006 | 338007 | 338008 | 338101 | 338102 | 338103 | 338104 | 338201 | 338202 | 338203 | 338204|776001 | 776002 | 776003 | 776004 | 776005 | 776006 | 776007 | 776008 | 776009 | 776010 | 776011 | 776012 | 776013 | 776014 | 776015 | 776016 | 776017 | 776018 | 776019 | 776020|

Cisco ASA Firepower content pack

The Cisco ASA (Adaptive Security Appliance) is a multipurpose firewall appliance from Cisco and is generally used for packet filtering purposes, but it supports many additional features, such as stateful filtering, application inspection, NAT, DHCP, routing, VPN, etc. This technology pack will process Cisco ASA logs, providing normalization and enrichment of common events of interest.

Firepower is an extension to ASA.

Requirements

  • This content pack supports Cisco ASA up to version 9.x or Cisco Firepower 7.1 and higher.

  • Configure ASA/Firepower to send logs to Security Data Lake (see official ASA documentation: Configure Adaptive Security Appliance (ASA) Syslog) (link for PIX 500)

  • Security Data Lake raw/syslog input (ASA syslog format may be rejected by Security Data Lake due to a non-RFC compliant format. Configure an RFC 5424 output to use a Security Data Lake Syslog input. Alternatively, send the logs to a Security Data Lake Raw or plaintext input).

Supported versions

  • Up to version 9.x or Cisco Firepower 7.1 and higher.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Cisco Device Messages"

Index set configuration

This technology pack includes one index set definition:

  • “Cisco Devices Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format examples

ASA logs

%ASA-6-305011: Built dynamic TCP translation from DL_172_16:192.168.10.10/1234 to L3_Internet:10.10.10.10/1234Jul 13 2021 14:13:19: %ASA-6-302014: Teardown TCP connection 8065 for inside:10.10.0.100/50511 to identity:172.10.124.136/51311 duration 0:00:00 bytes 422 TCP Reset-I

Firepower logs

Jul 13 2021 14:13:19: %FTD-6-302014: Teardown TCP connection 8065 for inside:10.10.0.100/50511 to identity:172.10.124.136/51311 duration 0:00:00 bytes 422 TCP Reset-I

%NGIPS-1-430002: EventPriority: Low, DeviceUUID:11133c5c-a6a1-11eb-a6e7-be0b98331111, InstanceID: 2, FirstPacketSecond:2023-02-30T11:31:19Z, ConnectionID: 4, AccessControlRuleAction: Allow, SrcIP:172.10.10.10, DstIP: 172.16.20.10, ICMPType: Echo Request, ICMPCode: NoCode, Protocol: icmp, IngressInterface:inside, EgressInterface: outside, ACPolicy:Default Allow All Traffic, AccessControlRuleName: mytest, Client:ICMP client, ApplicationProtocol: ICMP,InitiatorPackets: 11, ResponderPackets: 0, InitiatorBytes: 74, ResponderBytes: 0, NAPPolicy: Tuned Security and Connectivity

%NGFW-1-430002: EventPriority: Low, DeviceUUID:11133c5c-a6a1-11eb-a6e7-be0b98331111, InstanceID: 2, FirstPacketSecond:2023-02-30T11:31:19Z, ConnectionID: 4, AccessControlRuleAction: Allow, SrcIP:172.10.10.10, DstIP: 172.16.20.10, ICMPType: Echo Request, ICMPCode: NoCode, Protocol: icmp, IngressInterface:inside, EgressInterface: outside, ACPolicy:Default Allow All Traffic, AccessControlRuleName: mytest, Client:ICMP client, ApplicationProtocol: ICMP,InitiatorPackets: 11, ResponderPackets: 0, InitiatorBytes: 74, ResponderBytes: 0, NAPPolicy: Tuned Security and Connectivity

Note

The ASA IP to hostname feature is not fully supported. Security Data Lake Illuminate does not support network interface names with spaces.

Routing table

Supported Cisco Event types:

Cisco type

event_source_product

%ASA

CISCO-ASA

%NGIPS

CISCO-ASA

%NGFW

CISCO-ASA

%FTD

CISCO-ASA

What is provided

  • Parsing rules to extract Cisco ASA logs into Security Data Lake schema compatible fields.

  • An overview dashboard with 4 tabs. These tabs are ASA Overview, Network, Device Authentication, and High Priority Messages.

  • A dashboard for IDS/IPS messages. To get these messages, Cisco ASA may require a specific license.

ASA message processing

The Illuminate processing of ASA Firewall log messages provides the following:

  • Field extraction, normalization and message enrichment for SFOS log messages.

  • GIM categorization of the following messages:

    Cisco event code

    GIM event type code

    GIM event type

    106002

    129999

    Network Message

    106100

    120000

    Network Connection

    106102

    120000

    Network Connection

    106103

    120000

    Network Connection

    106001

    120000

    Network Connection

    106006

    120000

    Network Connection

    106007

    120000

    Network Connection

    106015

    120000

    Network Connection

    106016

    170001

    Network Alert

    106017

    170001

    Network Alert

    106018

    129999

    Network Message

    110002

    120000

    Network Connection

    110003

    120100

    Network Routing

    113008

    109999

    Authentication Message

    113012

    109999

    Authentication Message

    113021

    100000

    Logon

    113006

    100000

    Logon

    113007

    100000

    Logon

    302013

    120200

    Network Connection Initiated

    302014

    120300

    Network Connection Initiated

    302015

    120200

    Network Connection Initiated

    302016

    120300

    Network Connection Initiated

    302018

    120300

    Network Connection Initiated

    302022

    120200

    Network Connection Initiated

    302023

    120300

    Network Connection Initiated

    302024

    120200

    Network Connection Initiated

    302025

    120300

    Network Connection Initiated

    302026

    120200

    Network Connection Initiated

    302027

    120300

    Network Connection Initiated

    302036

    120300

    Network Connection Initiated

    302303

    120200

    Network Connection Initiated

    302304

    120300

    Network Connection Initiated

    302306

    120300

    Network Connection Initiated

    313004

    129999

    Network Message

    338001

    179999

    Alert Message

    338002

    179999

    Alert Message

    338003

    179999

    Alert Message

    338004

    179999

    Alert Message

    338005

    179999

    Alert Message

    338006

    179999

    Alert Message

    338007

    179999

    Alert Message

    338008

    179999

    Alert Message

    338201

    179999

    Alert Message

    338202

    179999

    Alert Message

    338203

    179999

    Alert Message

    338204

    179999

    Alert Message

    400000

    170001

    Alert Message

    400001

    170001

    Alert Message

    400002

    170001

    Alert Message

    400003

    170001

    Alert Message

    400004

    170001

    Alert Message

    400005

    170001

    Alert Message

    400006

    170001

    Alert Message

    400010

    170001

    Alert Message

    400011

    170001

    Alert Message

    400012

    170001

    Alert Message

    400013

    170001

    Alert Message

    400014

    170001

    Alert Message

    400015

    170001

    Alert Message

    400016

    170001

    Alert Message

    400017

    170001

    Alert Message

    400018

    170001

    Alert Message

    400019

    170001

    Alert Message

    400020

    170001

    Alert Message

    400021

    170001

    Alert Message

    400022

    170001

    Alert Message

    400034

    170001

    Alert Message

    400035

    170001

    Alert Message

    400036

    170001

    Alert Message

    400037

    170001

    Alert Message

    400038

    170001

    Alert Message

    400039

    170001

    Alert Message

    400040

    170001

    Alert Message

    400042

    170001

    Alert Message

    400043

    170001

    Alert Message

    400044

    170001

    Alert Message

    400045

    170001

    Alert Message

    400046

    170001

    Alert Message

    400047

    170001

    Alert Message

    400048

    170001

    Alert Message

    400049

    170001

    Alert Message

    400007

    170001

    Alert Message

    400008

    170001

    Alert Message

    400009

    170001

    Alert Message

    400023

    170001

    Alert Message

    400024

    170001

    Alert Message

    400025

    170001

    Alert Message

    400026

    170001

    Alert Message

    400027

    170001

    Alert Message

    400028

    170001

    Alert Message

    400029

    170001

    Alert Message

    400030

    170001

    Alert Message

    400031

    170001

    Alert Message

    400032

    170001

    Alert Message

    400033

    170001

    Alert Message

    400041

    170001

    Alert Message

    400050

    170001

    Alert Message

    410002

    120000

    Network Connection

    421001

    120000

    Network Connection

    500005

    120000

    Network Connection

    502101

    110000

    Account Created

    502102

    110500

    Account Locked

    507003

    120000

    Network Connection

    604103

    299999

    DHCP Default Event

    605004

    100000

    Logon

    605005

    100000

    Logon

    606001

    100000

    Logon

    606002

    100000

    Logout

    606003

    100000

    Logon

    606004

    100000

    Logout

    611101

    100500

    Credential Validation

    611102

    100500

    Credential Validation

    611103

    102500

    Logoff

    710002

    120000

    Network Connection

    710003

    120000

    Network Connection

    710005

    120000

    Network Connection

    710006

    129999

    Network Connection

    772003

    100000

    Logon

    772004

    100000

    Logon

    772005

    100000

    Logon

    772006

    100000

    Logon

    815002

    120000

    Network Connection

Supported event IDs for ASA and Firepower

106001 | 106002 | 106006 | 106007 | 106010 | 106012 | 106013 | 106014 | 106016 | 106017 | 106018 | 106021 | 106023 | 106100 | 106101 | 106102 | 106103 | 109005 | 109006 | 109007 | 109008| 109024 | 109025 | 110002 | 110003 | 111007 | 111008 | 111009 | 111010 | 113003 | 113004 | 113005 | 113006 | 113007 | 113008 | 113009 | 113011 | 113012 | 113019 | 113021 | 113022 | 113023| 113029 | 113030 | 113031 | 113032 | 113033 | 113034 | 113035 | 113036 | 113038 | 113039 | 199020 | 199021 |

201002 | 201003 | 201004 | 201005 | 201006 | 201009 | 201010 | 201011 | 201012 | 201013 | 202010 | 209003 | 209004 | 209005 | 216001 |

302010 | 302013 | 302014 | 302015 | 302016 | 302018 | 302020 | 302021 | 302022 | 302023 | 302024 | 302025 | 302026 | 302027 | 302036 | 302304 | 302305 | 302306 | 303002 | 304001 | 304002| 304003 | 304004 | 304005 | 304006 | 304007 | 305005 | 305006 | 305011 | 305012 | 305019 | 305020 | 308001 | 313001 | 313004 | 313005 | 313008 | 313009 | 316001 | 318001 | 318101 | 321005| 321006 | 322002 | 322003 | 325001 | 325002 | 326013 | 331001 | 331002 |

400010 | 400014 | 400011 | 400014 | 405001 | 410001 | 401002 | 401003 | 401004 | 401005 | 405002 | 407001 | 407002 | 410002 | 414001 | 415007 | 415008 | 415009 | 415010 | 415011 | 415012| 415013 | 415014 | 418001 | 419002 | 419005 | 419006 | 420002 | 420003 | 421001 | 421002 | 421007 | 429002 | 429003 | 434002 | 434003 |

500001 | 500002 | 500004 | 500005 | 502101 | 502102 | 502103 | 502111 | 502112 | 507003 |

602303 | 602304 | 602305 | 604101 | 604102 | 604103 | 604104 | 604105 | 604201 | 604202 | 604203 | 604204 | 604205 | 604206 | 604207 | 604208 | 605005 | 606001 | 606002 | 606003 | 606004| 607001 | 608001 | 608002 | 608003 | 608004 | 608005 | 609001 | 609002 | 602101 | 611101 | 611102 | 611103 | 611301 | 611303 | 613004 | 620001 |

710002 | 710005 | 710003 | 710006 | 713041 | 713042 | 713049 | 713050 | 713120 | 713172 | 713201 | 713230 | 713231 | 713257 | 713903 | 713904 | 713905 | 716001 | 716002 | 716055 | 716056| 716057 | 716058 | 716059 | 716060 | 716500 | 716501 | 716502 | 716503 | 716504 | 716505 | 716506 | 716508 | 716509 | 716510 | 716512 | 716513 | 716515 | 716516 | 716517 | 716518 | 716519| 716520 | 716521 | 716522 | 721001 | 721002 | 721003 | 721004 | 721005 | 721006 | 721007 | 721008 | 721009 | 721010 | 721011 | 721012 | 721013 | 721014 | 721015 | 721016 | 721017 | 721018| 721019 | 722004 | 722005 | 722006 | 722007 | 722008 | 722009 | 722010 | 722011 | 722012 | 722013 | 722014 | 722021 | 722022 | 722023 | 722026 | 722027 | 722028 | 722032 | 722033 | 722034| 722037 | 722038 | 722042 | 722043 | 722044 | 722046 | 722047 | 722048 | 722049 | 722050 | 722051 | 725002 | 725001 | 725003 | 725007 | 725016 | 733100 | 737001 | 737002 | 737003 | 737004| 737005 | 737006 | 737007 | 737008 | 737009 | 737010 | 737011 | 737012 | 737013 | 737014 | 737015 | 737016 | 737017 | 737018 | 737019 | 737023 | 737024 | 737025 | 737027 | 737028 | 737029| 737030 | 737031 | 737032 | 737033 | 737034 | 737035 | 737036 | 737038 | 746014 | 746015 | 746016 | 750001 | 750002 | 750003 | 750004 | 750005 | 750006 | 750007 | 750008 | 750009 | 750010| 750014 | 750015 | 750016 | 751001 | 751002 | 751003 | 751004 | 751005 | 751006 | 751007 | 751008 | 751009 | 751010 | 751011 | 751012 | 751013 | 751014 | 751015 | 751016 | 751017 | 751019| 751020 | 751021 | 751022 | 751023 | 751024 | 751025 | 751026 | 751027 | 751028 | 752002 | 752003 | 752004 | 752005 | 752006 | 752007 | 752010 | 752012 | 752013 | 752014 | 752015 | 752016| 768001 | 768002 | 768003 | 768004 | 769001 | 769002 | 769003 | 769004 | 769005 | 769006 | 769007 | 769008 | 769009 | 772002 | 772003 | 772004 | 772005 | 772006 | 775001 | 775003 | 775004| 775005 | 779003 | 779004 | 779005 | 779006 | 779007 |

Basic support for CTS SXP event IDs (application_name and vendor_event_description)

776001 | 776002 | 776003 | 776004 | 776005 | 776006 | 776007 | 776008 | 776009 | 776010 | 776011 | 776012 | 776013 | 776014 | 776015 | 776016 | 776017 | 776018 | 776019 | 776020|805001 | 805002 | 805003 | 812002|

Basic support

338001 | 338002 | 338003 | 338004 | 338005 | 338006 | 338007 | 338008 | 338101 | 338102 | 338103 | 338104 | 338201 | 338202 | 338203 | 338204|

Additional Firepower event IDs

430001, 430002, 430003, 430004, 430005

Cisco Business 350 Content Pack

Cisco Business 350 Series Managed Switches are managed Layer 3 network switches designed for small and medium-sized businesses, offering advanced features like VLAN segmentation, static routing, and enhanced security in a simple, intuitive interface.

This technology pack processes Cisco Business 350 Series (CBS) switch logs, providing normalization and enrichment of common events of interest.

Supported versions

  • Pack created with CBS350 Firmware 3.4.0.17

Requirements

  • Configure the CBS350 device to transmit RFC5424-formatted syslog to the Security Data Lake syslog input.

Note

Legacy-formatted Cisco logs, such as <190>%COPY-I-FILECPY..., are not currently supported.

Stream configuration

This technology pack includes 1 stream:

  • "Illuminate:Cisco Device Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • Cisco Devices Event Log Messages

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Note

This pack uses the general Cisco Devices Event Log Messages index that most other Cisco-related content packs use. If you have an existing Cisco Devices Event Log Messages index, the CBS logs will reside there.

Log collection and delivery

This pack parses logs from the following sources:

  • Syslog

Configuration

Due to the generic formatting of CBS logs, identifying and parsing these logs can be difficult and possibly match non-CBS logs. To solve this problem, you must configure a CBS-specific input in Security Data Lake and use an Illuminate lookup override. This configuration allows Illuminate to treat every log sent to this input as a CBS message by mapping the input ID to the CBS Illuminate identification rule. This input should be unique to CBS, to ensure that this pack processes only CBS logs.

  1. Create a new syslog input in Security Data Lake and choose an unused port.

  2. Click Show received messages to obtain the input ID. This action opens a search window with the All Time timeframe.

  3. Copy the gl2_source_input value.

  4. Go to Enterprise > Illuminate, then click the Customization tab.

  5. Locate lookup_adapter_input_routing and click Edit.

  6. For content_name , enter cisco_350, and for input_id, enter the gl2_source_input ID copied earlier.

  7. Click Configure value to confirm. All logs sent to the configured input and associated port will be identified as CBS logs, ensuring proper Illuminate processing.

  8. Create the Illuminate lookup override.

Log Format Example

These are example logs for various processed log types.

<190>1 2025-01-24T11:09:44.000-08:00 SOME-SWITCH SOMETHING - CONNECT - User CLI session for user some.user over ssh , source 192.168.2.3 destination  192.168.2.10 ACCEPTED
<190>1 2025-01-24T11:48:30.000-08:00 SOME-SWITCH SOMETHING - SSHSUCC - Connection ID 11 - SSH Session request from 192.168.2.10 port 53865 to Local address 192.168.2.30 port 22, username 'some.user' using crypto cipher aes256-ctr, hmac hmac-sha2-256 succeeded.
<190>1 2025-01-17T09:27:51.000-08:00 SOME-SWITCh SOMETHING - Up -  gi1/0/47
<190>1 2025-02-25T00:04:48.000-08:00 SOME-SWITCh SOMETHING - FILECPY - Files Copy - source URL flash://system/configuration/startup-config destination URL flash://system/configuration/mirror-config

What is provided

  • Rules to parse, normalize, and enrich content pack messages.

Events processed by this technology pack

The content pack supports the following log types:

  • NATIVE_VLAN_MISMATCH

  • PORTSTATUS

  • SECSYNBLOCKED

  • SNMPAUTHFAIL

  • SSHFAIL

  • LOG

  • FILECPY

  • REJECT

  • Up

  • Down

  • SHUTDWN

  • SSHSUCC

  • CONNECT

  • DISCONNECT

  • EeeLldpMultiNeighbours

Generic processing will be provided for log types not listed above.

Message fields included in this pack

General parsing

Common fields

Field name

Example value

Field type

Description

application_name

PNPAGENT

keyword

This field is generated by the Syslog input when analyzing the syslog message

destination_ip

192.168.2.10

long

IP address of the destination host

destination_port

22

long

Port the client connects to

event_source

GL-SWITCH

keyword

Syslog hostname in delivered message

event_source_product

cisco_350

keyword

The default event_source_product for CBS processed logs

network_interface

gi1/0/47

keyword

The network interface(s) noted in the message

source_ip

192.168.2.3

long

IP address of the source host

source_port

12345

long

Port from which the client initiates

user_name

some.user

keyword

User name tied to the message

vendor_crypto_cipher

aes256-ctr

keyword

The cypher used to encrypt the communication

vendor_crypto_hmac

hmac-sha2-256

keyword

The HMAC used in the communication

vendor_connection_id

14

keyword

The connection ID associated with the connection

vendor_destination_file_name

mirror-config

keyword

The destination file name noted in message

vendor_destination_protocol

flash

keyword

The destination protocol noted in the message (flash/http/https/etc.)

vendor_destination_request_path

/system/configuration/mirror-config

keyword

The destination file path

vendor_event_message

Backoff PnP Request with <callbackAfter> has received: 24 Hours 0 Minutes 0 Seconds

keyword

Main event message contained in log and will only exist for log types not noted as supported

vendor_event_outcome

Bye Bye

keyword

The outcome from the associated connection

vendor_event_outcome_code

11

keyword

The outcome code from the associated connection

vendor_event_outcome_reason

identification exchange failed

keyword

Additionally provided info related to the outcome of the associated connection

vendor_source_request_path

/system/configuration/startup-config

keyword

The source file path

vendor_source_request_protocol

flash

keyword

The source protocol noted in the message (flash/http/https/etc.)

vendor_subtype

BACKOFFCALLBACKAFTER

keyword

This field is extracted is the CBS message ID or event identifier

Cisco IOS content pack

Cisco IOS is proprietary software used in Cisco routers and switches, enabling robust management of network traffic, including data, voice, and video across various communications environments.

This technology pack will process Cisco IOS logs, providing normalization and enrichment of those events.

Supported versions

  • Cisco IOS XE 17.14.x

Requirements

  • Cisco IOS XE 17.14.x

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Cisco Device Messages "

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Cisco Devices Event Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

  • You can choose to send logs via syslog or raw format. Cisco products often include timestamps in logs that may not be compatible with Security Data Lake. If this occurs, we recommend that you send logs via raw format.

Log format example

SEC-6-IPACCESSLOGP

Aug 17 02:41:39.326: %SEC-6-IPACCESSLOGP: list 105 denied udp 192.168.12.157(55250) -> 192.168.12.255(11550), 1 packet

URLF-6-URL_ALLOWED

Mar 12 18:46:11: %URLF-6-URL_ALLOWED: Access allowed for URL http://www.websense.com/; client 10.54.192.6:54123 server 192.168.0.1:80

What is provided

  • We provide parsing rules to normalize and enrich Cisco IOS log messages.

  • We provide categorization for the following log types:

    • SEC-6-IPACCESSLOGRP

    • SEC-6-IPACCESSLOGSP

    • SEC-6-IPACCESSLOGP

    • SEC-6-IPACCESSLOGDP

    • SEC-6-IPACCESSLOGNP

    • LINK-3-UPDOWN

    • LINK-5-CHANGED

    • LINEPROTO-5-UPDOWN

    • CRYPTO-5-SESSION_STATUS

    • AUTHMGR-5-SECURITY_VIOLATION

    • SYS-5-CONFIG_I

    • SEC_LOGIN-5-LOGIN_SUCCESS

    • SEC_LOGIN-4-LOGIN_FAILED

    • AAA-5-USER_LOCKED

    • AAA-5-USER_UNLOCKED

    • SEC-6-IPACCESSLOGRL

    • URLF-4-URL_BLOCKED

    • URLF-6-URL_ALLOWED

    • URLF-4-SITE_BLOCKED

    • URLF-6-SITE_ALLOWED

    • URLF-5-SERVER_UP

    • URLF-3-SERVER_DOWN

    • URLF-3-ALLOW_MODE

Events processed by this technology pack

The Cisco IOS content pack supports identification for all events, but parsing, normalization, and categorization are supported for the events listed above.

Packetbeat Spotlight content pack

Cisco IOS offers a dashboard with three tabs: an Overview tab, a Network tab, and a tab for an overview of Authentication events.

Cisco ISE content pack

Cisco Identity Services Engine (ISE) is a robust, centralized network security policy management platform. It enables organizations to enforce secure access policies for endpoints, network devices, and users, across wired, wireless, and VPN networks.

Supported versions

  • Identity Services Engine 3.2

Requirements

  • The default length of remote log target messages configured in the Cisco ISE GUI is set to 1024. This will truncate messages and prevent proper parsing by Illuminate. You MUST configure this value to be 8192 so the full message is sent to Security Data Lake. See the Cisco documentation for more information.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Cisco Device Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Cisco Devices Event Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

You can choose to send logs via syslog or raw format (TCP or UDP). Please note that Cisco products often include timestamps in logs that may not be compatible with Security Data Lake. If this occurs, we recommend you send logs to a Raw or plaintext input. 

Note

The message field has been replaced by a shorter message highlighting key fields and values to reduce license utilization. Activate the full_message option in the input if needed.

Log format example

<18>Jul 31 03:39:53 DEVICE-01 CISE_Failed_Attempts 0000001161 1 0 2024-12-18 13:10:56.252 +00:00 0045534800 5440 NOTICE RADIUS: Endpoint abandoned EAP session and started new, ConfigVersionId=53, Device IP Address=192.168.1.1, DestinationIPAddress=192.168.1.1, UserName=blah.blah, AcsSessionID=ATH-ISE-POL03/522862485/1041418, SelectedAccessService=RADIUS 802.1X Wireless, RequestLatency=36, FailureReason=5440 Endpoint abandoned EAP session and started new, Step=11001, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15048, Step=15048, Step=11507, Step=12500, Step=12625, Step=11006, Step=11001, Step=11018, Step=12301, Step=12300, Step=12625, Step=11006, Step=11001, Step=11018, Step=12302, Step=12319, Step=12800, Step=12805, Step=12806, Step=12807, Step=12808, Step=12810, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=12319, Step=12810, Step=12812, Step=12803, Step=12804, Step=12801, Step=12802, Step=12816, Step=12310, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=12313, Step=11521, Step=12305, Step=11006, Step=11001, Step=11018, Step=12304, Step=11522, Step=11806, Step=12305, Step=11006, Step=5440, NetworkDeviceName=HOME-HOME, NetworkDeviceGroups=Location#All Locations#HOME#HOME, NetworkDeviceGroups=Device Type#All Device Types#Wireless Controller, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, EapTunnel=PEAP, EapAuthentication=EAP-MSCHAPv2, User-Name=blah.blah, NAS-IP-Address=192.168.1.1, NAS-Port=1615, Called-Station-ID=HOME-AP1:Digital, Calling-Station-ID=1e-f7-a9-dd-d3-f7, NAS-Identifier=HOME-HOME:Home Digital, NAS-Port-Type=Wireless - IEEE 802.11, CPMSessionID=0B10A8C000171CA2D9E45D65, EndPointMACAddress=01-01-01-01-01-01, ISEPolicySetName=802.1X Wireless - Digital, StepLatency=84=13745, StepData=4= DEVICE.Device Type, StepData=5= Radius.NAS-Port-Type, StepData=6= Normalised Radius.RadiusFlowType, StepData=7= Radius.Called-Station-ID, StepData=8= DEVICE.Location, TLSCipher=ECDHE-RSA-AES256-GCM-SHA384, TLSVersion=TLSv1.2, DTLSSupport=Unknown, RadiusFlowType=Wireless802_1x, Network Device Profile=Cisco, Location=Location#All Locations#HOME#HOME, Device Type=Device Type#All Device Types#Wireless Controller, IPSEC=IPSEC#Is IPSEC Device#No, Response={RadiusPacketType=Drop; },

Events processed by this technology pack

The Cisco ISE content pack supports the following event IDs. Generic processing will be provided for event IDs not listed.

Parsed fields

Event code

Event message

5200

Authentication succeeded

5201

Authentication succeeded

5202

Command Authorization succeeded

5203

Session Authorization succeeded

5205

Dynamic Authorization succeeded

5238

Endpoint authentication problem was fixed

5240

Previously rejected endpoint was released to continue authentications

5400

Authentication failed

5405

RADIUS Request dropped

5411

Supplicant stopped responding to ISE

5435

NAS conducted several failed authentications of the same scenario

5436

RADIUS packet already in the process

5440

Endpoint abandoned EAP session and started new

5441

Endpoint started new session while the packet of previous session is being processed. Dropping new session.

5449

Endpoint failed authentication of the same scenario several times and was rejected

GIM categorization

Vendor event message

GIM category

GIM subcategory

GIM event type code

Authentication succeeded

authentication

authentication.default

109999

Command Authorization succeeded

authentication

authentication.default

109999

Dynamic Authorization succeeded

authentication

authentication.default

109999

Previously rejected endpoint was released to continue authentications

authentication

authentication.default

109999

Endpoint authentication problem was fixed

authentication

authentication.default

109999

Session Authorization succeeded

authentication

authentication.default

109999

Cisco ISE Spotlight content pack

Cisco ISE offers a dashboard with 3 tabs: Overview, Authentication, and Network.

Cisco Meraki content pack

Cisco Meraki is a hardware vendor and sells cloud-controlled security appliances (firewall), switches, and access points via a centralized managed platform. This technology pack will process Cisco Meraki logs, providing normalization and enrichment of common events of interest.

Supported versions

  • Up to MX16.9+

  • Up to MR 30.x

Supported log MR types

association, disassociation, wpa_auth, wpa_deauth, flows, 8021x_eap_failure, 8021x_deauth, 8021x_auth, 8021x_eap_success, splash_auth, mac_spoofing, multiple_servers, and device_packet_flood

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Cisco Device Messages”

If this stream is already created, then nothing will be changed. This stream will be created if it does not exist, and it will be configured to route messages to the Cisco Devices index set. There should not be any rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Cisco Devices Event Log Messages”

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format examples

1 1619032507.590967163 ip_flow_end src=1.1.1.1 dst=2.2.2.2 protocol=icmp translated_dst_ip=4.4.4.4

1 1619032507.495518695 DEVICE_NAME flows src=1.1.1.1 dst=2.2.2.2 protocol=udp sport=1900 dport=1900 pattern: 1 all

Requirements

  • Configure Cisco Meraki to transmit Syslog to your Bitdefender Forwarder Syslog input.

Meraki Syslog and Nanosecond Timestamps

Cisco Meraki devices are sometimes configured to send epoch timestamps with nanosecond precision; the Security Data Lake syslog input cannot parse these messages and will drop them. If your device is configured to send nanosecond timestamps, please configure a Raw or plaintext input over UDP for Security Data Lake and configure the Meraki to send logs to this input. This input must be configured to use a different port than any other existing UDP input. The parsing of epoch timestamps will be addressed in a future version of Security Data Lake.

What is provided

  • Parsing rules to extract Cisco Meraki logs into Security Data Lake schema compatible fields.

Cisco Umbrella content pack

Cisco Umbrella is part of Cisco Secure Client (formerly AnyConnect). It integrates with Secure Client to provide comprehensive security by combining VPN capabilities with DNS-layer protection, web security, and cloud-delivered firewall features.

This technology pack will process Cisco Umbrella logs, providing normalization and enrichment of those events.

Supported versions

  • Cisco Secure Client 5.1.3.62

Requirements

  • Cisco Secure Client 5.1.3.62

  • Cisco Umbrella Schema version 8 or 9

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Cisco Device Messages "

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Cisco Devices Event Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

Log format example

Proxy logs

"2017-10-02 23:52:53","TheComputerName","192.192.192.135","1.1.1.91", "3.4.5.6","","ALLOWED","http://google.com/the.js","www.google.com","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36","200","562","1489","","","Search Engines","","","","","","Roaming Computer","","TheComputerName, ADSite,Network","Roaming Computer, Site, Network","GET","","","the.js","","","","isolated","downloaded_original_file","warn-session","",""

DNS logs

"2015-01-16 17:48:41","ActiveDirectoryUserName", "ActiveDirectoryUserName,ADSite,Network", "10.10.1.100","24.123.132.133","Allowed","1 (A)", "NOERROR","domain-visited.com.", "Photo Sharing","AD User","AD User,Site,Network",""

Audit logs

"","2021-07-22 10:46:45","user@domain.com","", "logexportconfigurations", "update","209.165.200.227","version: 4","version: 5"

What is provided

  • We provide parsing rules to normalize and enrich Cisco Umbrella log messages.

  • We provide categorization for the following log types:

    • Audit Logs

    • DNS Logs

    • Proxy Logs

Events processed by this technology pack

The Cisco Umbrella content pack supports parsing, normalization, and categorization for the events listed above.

Cisco Umbrella Spotlight content pack

Cisco Umbrella offers a dashboard with three tabs: an Overview tab, a Network tab, and a tab for an overview of HTTP events.

Cloudflare content pack

Cloudflare is a comprehensive cloud web-based security and performance platform that works by filtering out malicious traffic, preventing cyberattacks like DDoS, and optimizing content delivery to ensure faster loading times for users.

This technology pack will process Cloudflare logs, providing normalization and enrichment of those events.

Supported versions

  • Cloudflare 2024.10.2

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Cloudflare Messages"

Note

If this stream does not exist prior to the activation of this pack, then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Cloudflare Event Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

You can leverage the raw HTTP input in Security Data Lake to receive logs directly from Cloudflare via its Logpush functionality. By configuring Logpush, you can define which types of logs to send (e.g. HTTP requests, firewall events) and specify Security Data Lake as the destination endpoint. This allows seamless log forwarding from Cloudflare to Security Data Lake for centralized log analysis. For detailed instructions, refer to Cloudflare Logpush with Raw HTTP Input.

Security Data Lake configuration

  1. Under Enterprise > Forwarders > Input profiles, create a new raw HTTP input for receiving Cloudflare logs, unless one already exists. This input must be used for Cloudflare logs only.

  2. Click Show received messages for your raw HTTP input to obtain the input ID. This will display a search window with the All Time timeframe. If there is a large number of logs, then you may want to adjust the timeframe to speed up the process.

  3. Copy the gl2_source_input value.

  4. Go to Enterprise >Illuminate and select the Customization tab.

  5. Locate the lookup_adapter_input_routing and click Edit on the right. For the content_name key, enter the gl2_source_input ID copied earlier. For the input_id value, enter cloudflare. (Note that the column names are reversed; this will be corrected in a future release).

  6. Select Configure value to confirm.

  7. If receiving Cloudflare logs on multiple inputs, repeat this process for each input.

Log format example

{"Action":"log","ClientASN":209,"ClientASNDescription":"CENTURYLINK-US-LEGACY-QWEST","ClientCountry":"us","ClientIP":"205.186.39.189","ClientIPClass":"noRecord","ClientRefererHost":"","ClientRefererPath":"","ClientRefererQuery":"","ClientRefererScheme":"","ClientRequestHost":"cloudtest.life","ClientRequestMethod":"GET","ClientRequestPath":"/","ClientRequestProtocol":"HTTP/1.1","ClientRequestQuery":"","ClientRequestScheme":"http","ClientRequestUserAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36","ContentScanObjResults":[],"ContentScanObjSizes":[],"ContentScanObjTypes":[],"Datetime":"2024-10-16T14:03:41Z","Description":"Test_WAF","EdgeColoCode":"DFW","EdgeResponseStatus":404,"Kind":"firewall","LeakedCredentialCheckResult":"none","MatchIndex":0,"Metadata":{"ruleset_version":"2","version":"1","type":"customer"},"OriginResponseStatus":404,"OriginatorRayID":"00","RayID":"8d389800b7c76c57","Ref":"","RuleID":"af14fd3aedda46898b13c9d033ad0a5f","Source":"firewallcustom"}

What is provided

  • We provide categorization for the following log types:

    • HTTP Requests

    • Firewall Events

    • DNS logs

  • We provide parsing rules to normalize and enrich Cloudflare log messages.

Events processed by this technology pack

The Cloudflare content pack supports parsing and GIM categorization for the HTTP Request, Firewall Events, and DNS Logs events.

Cloudflare Spotlight content pack

The Cloudflare Spotlight content pack includes an Overview tab and an HTTP Overview tab.

Compliance Unified Visibility content pack (preview)

This preview compliance pack provides targeted visibility into Identification and Authentication (IAC), Network (NET), and Endpoint (END) events that support control requirements shared across NIST SP 800-53 Rev 5, PCI DSS v4.0, and US CMMC 2.0 Level 1. The Spotlight includes dashboards and a daily report template with tailored widgets for compliance reporting.

Note

This is a preview pack. Features are subject to change, and more content and usage guidance are planned for future iterations.

Supported frameworks

This pack currently supports a subset of controls from the following compliance frameworks:

  • NIST SP 800-53 Rev 5

  • PCI DSS v4.0

  • US CMMC 2.0 Level 1

What is Provided

  • Security Data Lake Compliance: Unified Visibility (Preview) dashboard

  • Security Data Lake Compliance: Unified Visibility Report (Preview) report template

Using this content pack

GIM categorization

This compliance pack uses events that have been categorized using Common Information Model (GIM) categorization codes and in some cases additional schema-defined fields. It is not restricted to a specific product. Illuminate content that leverages Core enrichment will assign GIM categories automatically where applicable. Custom packs and pipeline rules can manually assign GIM categories as well, for inclusion in this pack's dashboard widget searches.

For a complete list of GIM categorizations, refer to Message Categories.

For more information on Illuminate enrichments, refer to the dedicated section.

GIM categorization and enrichments used

For widgets pertaining to IAC events, the following GIM event types are used:

  • account created

  • account deleted

  • account modified

  • account renamed

  • account disabled

  • account enabled

  • account locked

  • account unlocked

  • group member added

  • group member removed

  • password change

  • administrative password reset

  • access policy violation

  • account policy violation

  • credential validation

  • logon

Note

Widgets related to account management are primarily geared toward events processed by the Illuminate Windows Security Content Pack.

For widgets pertaining to NET events, the following GIM event categories are used:

  • network

  • authentication

For widgets pertaining to Network (NET) events, the following GIM tags are used:

  • remote_access (used in conjunction with gim_event_category: authentication)

  • source_is_internal

  • destination_is_internal

For widgets pertaining to END events, the following GIM event categories are used:

  • alert

  • detection

Note

Widgets under END events are currently scoped via widget search filters to the following Illuminate content packs: Microsoft Defender, Microsoft Defender for Endpoint, Crowdstrike Falcon, and Symantec Endpoint Protection.

Report generation

This compliance pack includes a prebuilt report template for exporting dashboard data. The report can be scheduled for regular delivery via email in accordance with compliance requirements of continuous logging and monitoring and data storage over long periods of time.

For full details on report generation, refer to Reports.

Note

Ensure that email configuration is set up successfully in Security Data Lake before you enable report scheduling.

Scheduled compliance reports can be configured with the following example workflow in Security Data Lake:

  1. Under the Enterprise menu, select Reports.

  2. Locate the Security Data Lake Compliance: Unified Visibility Report (Preview) report.

  3. To the right, under Actions, select Edit.

  4. Go to the Delivery tab.

  5. Adjust any settings, such as the report delivery schedule, as desired.

  6. Add one or more recipients to the Email recipients input field.

  7. (Optional) Modify the report Content and Style to your specifications.

  8. Click Update to save the changes.

Compliance Unified Visibility Spotlight preview

The Spotlight pack offers a dashboard with 3 tabs: Identification and Authentication (IAC), Network Security (NET), and Endpoint Security (END).

Core DNS content pack

The Core DNS Processing Illuminate content pack includes supplementary processing of DNS-related messages and a Spotlight pack to gain additional insights into DNS-related log messages.

Requirements

  • A log source that includes DNS-related messages, either analyzed DNS traffic including DNS queries and/or network traffic logs that include traffic associated with DNS servers.

Background

DNS

DNS, or the Domain Name System, is one of the important protocols in modern networks and is also an important data point for security monitoring and incident response.

Features

Asset integration

This pack, when enabled, works with the Asset enrichment feature. It allows you to identify approved DNS servers, ensuring the identification of traffic to non-approved DNS servers.

DNS request calculations

This pack enables the calculation of multiple data points related to DNS requests:

  • DNS query request length

  • DNS query response length

  • DNS query entropy

  • DNS server approval status

DNS query request/response length

This is a simple count of the number of characters in a DNS request or response. This is valuable as it can be used, when measured in aggregate, to expose some attacks that use DNS for data exfiltration and command control.

DNS query length

When the query_request field exists, this pack generates the query_request_length field.

DNS query response length

When the query_response field exists, this pack generates the query_response_length field.

The query response length is an approximate measurement of the response length. DNS responses can often include multiple values, with a separator character. This measurement includes those characters.

DNS query request entropy calculations

This pack calculates the entropy, using Shannon's entropy algorithm for the value of the query_response field when that field exists, and assigns it to the query_request_entropy field.

Entropy, in this context, measures the variability of the data. Some attacks that use domain generation algorithms can be detected by measuring the entropy of the DNS request value.

DNS server approval status

This pack works in conjunction with Asset Enrichment and identifies systems that have been identified as approved DNS servers. This can be used to detect misconfigured or unauthorized devices attached to your network and increase your situational awareness with respect to the operation of the network.

This pack adds the approved_dns_server field, with the Boolean value of true , if the device has been identified as an approved DNS server, and false, if it has not been identified as approved. Note that, until a server has been identified as an approved DNS server, all DNS traffic will be considered unapproved.

Configuring approved DNS servers

Note

Some DNS log sources, such as Sysmon, do not log the destination server. These sources cannot be used to determine if the server is considered approved.

To define a device as an approved DNS server, you must add it to the asset list and assign the approved_dns_servers category to it. You can add approved external DNS server IP addresses on the assets page.

  1. In Security Data Lake, go to Security > Assets.

  2. If there are already assets defined, look for an existing entry for the DNS server to assign approval to. If there is already an asset entry for the DNS server to approve, take the following steps:

    • Click the actions (...) button for the asset and select Edit.

    • Under General info, locate the Categories field.

    • Enter approved_dns_servers in this field and press Enter.

    • Click Next repeatedly until you see the Save Asset button.

    • Click Save Asset.

  3. If there is no existing asset entry, take the following steps:

    • Select New Asset.

    • Enter the Asset Name.

    • Enter the IP address associated with the DNS server in the IP Addresses field, then press Enter.

    • Repeat the previous step for any additional IP addresses associated with the approved DNS server.

    • Add any relevant information to the other fields for this asset.

    • Select Next to advance to the next page of the asset entry form.

    • Enter any of the additional fields desired, then select Next when done.

    • Repeat this process for each page of the asset entry dialog.

    • Click Save Entry on the last page of the asset entry dialog.

DNS Processing Spotlight content pack

The DNS Processing Spotlight content pack contains a dashboard that provides insights into DNS activity.

Dashboard: Illuminate:DNS Analysis

  • DNS Activity Summary tab: A high-level view of categorized DNS events.

  • DNS Assets tab: Review DNS traffic to approved/unapproved DNS servers.

CrowdStrike Falcon content pack

CrowdStrike Falcon is a cutting-edge endpoint security solution with advanced capabilities. Leveraging Artificial Intelligence and threat intelligence, Falcon empowers organizations to proactively defend against cyber threats, detect malicious activities in real-time, and respond swiftly to secure their endpoints with unmatched precision and agility.

This technology pack will process CrowdStrike Falcon logs, providing normalization and enrichment of those events.

Supported versions

  • CrowdStrike Falcon 7.15.18514.0

Stream configuration

This technology pack includes one stream:

  • “Illuminate: CrowdStrike Falcon Messages”

Note

If this stream does not exist prior to the activation of this pack, then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “CrowdStrike Falcon Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

  • Logs are sent via the CrowdStrike input in Security Data Lake’.

Log format example

- {"timestamp":1693337449.649,"version":"1.1","host":"customer-id","short_message":"{\"UserId\":\"api-client-id\",\"UserIp\":\"10.1.1.1\",\"OperationName\":\"reveal_token\",\"ServiceName\":\"sensor_update_policy\",\"UTCTimestamp\":1688847014,\"Attributes\":{\"device_id\":\"6614e76223cc47699c09b18e84da6425\",\"message\":\"\",\"seedID\":\"101\"}}","full_message":"{\"metadata\":{\"customerIDString\":\"customer-id\",\"offset\":2802412,\"eventType\":\"UserActivityAuditEvent\",\"eventCreationTime\":1688847014000,\"version\":\"1.0\"},\"event\":{\"UserId\":\"api-client-id\",\"UserIp\":\"10.1.1.1\",\"OperationName\":\"reveal_token\",\"ServiceName\":\"sensor_update_policy\",\"UTCTimestamp\":1688847014,\"Attributes\":{\"device_id\":\"6614e76223cc47699c09b18e84da6425\",\"message\":\"\",\"seedID\":\"101\"}}}","_event_source_product":"crowdstrike_falcon","_vendor_subtype":"UserActivityAuditEvent","_vendor_version":"1.0","_event_created":"2023-07-08T20:10:14.000Z"}

What is provided

  • We provide categorization for the following log types:

    • DetectionSummaryEvent

    • EppDetectionSummaryEvent

    • XdrDetectionSummaryEvent

    • AuthActivityAuditEvent

  • All messages sent via the CrowdStrike API to the Security Data Lake CrowdStrike input will be parsed but not all will receive categorization or normalization.

  • We provide parsing rules to normalize and enrich CrowdStrike Falcon log messages.

Input configuration

  1. To successfully connect your CrowdStrike Falcon device to the Security Data Lake CrowdStrike input, you will need your CrowdStrike client ID and your Client Secret. For more information, refer to CrowdStrike input.

  2. Once the connection is established, your CrowdStrike logs should be successfully delivered to Security Data Lake.

Events processed by this technology pack

The CrowdStrike Falcon content pack supports parsing for all fields and GIM categorization for the CustomerIOCEvent, DetectionSummaryEvent, and UserActivityAuditEvent events.

CrowdStrike Spotlight content pack

The CrowdStrike Spotlight content pack includes an Overview tab, an Authentication tab, and an Alert tab.

F5 BIG-IP content pack

F5 BIG-IP is an application delivery controller platform that combines load balancing, traffic management, and security services to optimize, secure, and scale networked applications.

Supported versions

  • F5 BIG-IP ASM 17.5.1

  • F5 BIG-IP AFM 17.5.1

Supported log types

  • ASM, AFM

  • For TMM logs: HTTP_RESPONSE, HTTP_REQUEST

Requirements

Stream configuration

This technology pack includes 1 stream:

  • Illuminate:F5 Messages

Note

If this stream does not exist prior to the activation of this pack then it is created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • F5 Bigip Messages

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

This pack parses logs from the following sources:

  • Filebeat

  • Syslog (beta support)

  • CEF (beta support)

Filebeat configuration

  1. For information on setting up Bitdefender Sidecar for Filebeat, refer to Sidecars.

  2. Create a Beats input in Security Data Lake and ensure that Do not add Beats type as prefix is not selected. For details, refer to Beats Input.

  3. Create an API access token. For details, refer to Installing Sidecar (section 1.2, Create an API token).

  4. Configure a custom Windows Filebeat collector. For details, refer to Sidecar collectors.

  5. To configure the collector for shipping messages to Security Data Lake, select the right path and ensure that the Filebeat input adds the event_source_product field, with a value of f5_bigip, for the parser to identify the log source as F5 BIG-IP.

  6. You must set the fields_under_root option to true for message identification to work, as shown in the following example:

    filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/f5/*.log
fields:
event_source_product: f5_bigip
fields_under_root: true

  7. Adjust the file path in the configuration file if needed.

  8. Install Bitdefender Sidecar on the client host.

  9. Edit the Bitdefender Sidecar client configuration with your Security Data Lake API URL and API access token.

Sending logs via syslog

F5 BIG-IP supports syslog. This content pack may support F5-BIG-IP syslog for the ASM and AFM modules.

Sending logs in CEF format

F5 BIG-IP supports the CEF format. This content pack may work with CEF and the CEF input in Security Data Lake, but, due to a lack of example logs, the full function cannot be guaranteed.

Log format examples

Apr 10 09:25:46 172.16.1.2 ASM:unit_hostname="f5_01",management_ip_address="192.168.1.10",management_ip_address_2="N/A",http_class_name="/Common/App_WAF",web_application_name="/Common/App_WAF",policy_name="/Common/App_WAF",policy_apply_date="2025-04-08 2:29:51",violations="N/A",support_id="142371702665",request_status="passed",response_code="200",ip_client="11.10.5.46",route_domain="0",method="GET",protocol="HTTPS",query_string="",x_forwarded_for_header_value="11.10.5.2",sig_ids="N/A",sig_names="N/A",date_time="2025-04-10 2:25:46",severity="Informational",attack_type="N/A",geo_location="RO",ip_address_intelligence="N/A",username="N/A",session_id="C3c1eaf29ce05e59",src_port="51124",dest_port="443",dest_ip="172.16.1.11",sub_violations="N/A",virus_name="N/A",violation_rating="0",websocket_direction="N/A",websocket_message_type="N/A",device_id="N/A",staged_sig_ids="",staged_sig_names="",threat_campaign_names="N/A",staged_threat_campaign_names="N/A",blocking_exception_reason="N/A",captcha_result="not_received",microservice="N/A",tap_event_id="N/A",tap_vid="N/A",vs_name="/Common/vs-443-2021-apptest1.dom.ro-bkp",sig_cves="N/A",staged_sig_cves="N/A",uri="/notif/summary",fragment="",request="GET /notif/summary HTTP/1.1\r\nHost: apptest.dom.ro\r\nConnection: keep-alive\r\nsec-ch-ua-platform: %22Windows%22\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\r\nsec-ch-ua: %22Google Chrome%22;v=%22135%22, %22Not-A.Brand%22;v=%228%22, %22Chromium%22;v=%22135%22\r\nsec-ch-ua-mobile: ?0\r\nAccept: */*\r\nSec-Fetch-Site: same-origin\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Dest: empty\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccept-Language: en-US,en;q=0.9,ro;q=0.8\r\nCookie: _ga=GA1.1.845057894.1744101172; SESSION=6dceff56-9d1e-421c-ab0e-820e91591bf8; _ga_X2KD43T4E2=GS1.1.1744263.4.1.14265953.0.0.0; TS67d45652027=08fbd28c49065a7bf1423084f5cc3e81130007f7d872e9d324682b29696

Apr 10 2:25:46 172.16.1.2 AFM:acl_rule_name="",action="Open",hostname="bigip-3.pme-ds.f5.com",bigip_mgmt_ip="192.168.73.33",context_name="/Common/topaz3-all3",context_type="Virtual Server",date_time="Oct 04 2012 13:18:04",dest_ip="10.3.1.200",dest_port="443",device_product="Advanced Firewall Module",device_vendor="F5",device_version="11.3.0.2095.0",drop_reason="",errdefs_msgno="23003137",errdefs_msg_name="Network Event",ip_protocol="TCP",severity="8",partition_name="Common",route_domain="0",source_ip="10.3.1.101",source_port="39329",vlan="/Common/external"

Apr 10 2:24:59 172.16.1.2 1 2025-04-10T2:25:46.854685+03:00 f5_short tmm 8545 23003147 [F5@12276 hostname="f5_01" bigip_mgmt_ip="192.168.1.10" bigip_mgmt_ip2="::" client_ip="46.97.34.38" client_ip_geo_location="RO" client_port="28220" client_request_uri="/version.json"]

What is provided

  • Parsing rules to extract F5 BIG-IP logs (AFM, ASM) into Security Data Lake schema-compatible fields.

  • Simple dashboard with a general overview and an overview for ASM logs.

GIM categorization

GIM categorization is provided for the following messages:

vendor_event_type

gim_event_type_code

DNS Event

149999

Network Event

120000

Message fields included in this pack

General parsing

Common fields

Original field name

Field name

Example value

Field type

Description

part of the header

application_name

ASM

string

Application Name or Syslog Application Name

dest_ip

destination_ip

172.16.1.11

string

Destination IP address

dest_port

destination_port

443

long

Destination Port

hostname

host_hostname

bigip-3.pme-ds.f5.com

string

Hostname of the F5 instance

Mapped

event_action

allowed

string

Mapped Event Action

Mapped

event_severity

informational

string

mapped Event Severity

Mapped

event_severity_level

1

long

mapped Event Severity Level

method

http_request_method

GET

string

HTTP method used

ip_protocol

network_transport

tcp

string

Network Transport

response_code

http_response_code

200

long

HTTP Response Code used

uri

http_uri

/notif/summary

string

HTTP URI used

protocol

network_protocol

https

string

Network Protocol

session_id

session_id

C3c1eaf29ce05e59

string

used Session ID

src_ip

source_ip

11.10.5.46

string

Source IP address

src_port

source_port

51124

long

Source Port

username

user_name

Tom

string

User Name

F5 BIG-IP Spotlight pack

This F5 BIG-IP Spotlight includes a general overview and an ASM overview dashboard.

Fortinet FortiGate content pack

Fortinet's FortiGate is a next-generation firewall that covers both traditional and wireless traffic. The hardware-based firewall can function as an IPS and include SSL inspection and web filtering. This technology pack will process Fortigate event log messages, providing normalization and enrichment of common events of interest.

Requirements

  • Fortigate running FortiOS Version 7.0 or later

Not supported

  • Sending Fortigate logs with the CEF format

Stream configuration

This technology pack includes one stream:

  • “Illuminate: Fortigate Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Fortinet Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

date=2021-06-22 time=14:32:46 devname="ABCD-EFG-HIK-LMN-202-87-35-206" devid="FGA20E5Q16027714" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1624352568074022779 tz="+0530" srcip=x.x.x.x srcport=50198 srcintf="wan1" srcintfrole="wan" dstip=2.2.2.2 dstport=4510 dstintf="wan2" dstintfrole="wan" sessionid=2912907682 proto=6 action="close" policyid=32 policytype="policy" poluuid="5b3cd3ef-0fd0-51e7-1222-9c9e72bdfbba" service="4510" dstcountry="India" srccountry="India" trandisp="dnat" tranip=1.1.1.1 tranport=4510 duration=62 sentbyte=2049 rcvdbyte=2703 sentpkt=12 rcvdpkt=11 appcat="unscanned"

Requirements

  • Configure Fortigate to transmit Syslog to your Security Data Lake Syslog input. For more information, refer to Syslog Inputs.

What is provided

  • Rules to normalize and enrich Fortigate log messages

  • A Fortigate Spotlight content pack

Fortigate log message processing

The Illuminate processing of Fortigate log messages provides the following:

  • Field extraction, normalization, and message enrichment for Fortigate log messages

  • GIM categorization of the following messages:

Fortigate log subtype

GIM category

GIM subcategory

Forward

network

network.default

Multicast

network

network.default

Sniffer

network

network.default

Webfilter

network

network.default

Virus

alert

alert.default

Anomaly

alert

alert.default

Local

network

network.default

SSL

network

network.default

Fortigate Spotlight content pack

The Fortigate Spotlight content pack contains:

Dashboard: Fortigate Overview

  • Fortigate Overview

  • Virus Overview

  • Application Control Overview

  • DNS Overview

GitLab content pack

GitLab is a complete DevOps platform that provides Git-based source code management, CI/CD automation, security scanning, and project collaboration in a single application, available as both cloud-hosted and self-managed solutions. This pack parses GitLab logs.

Requirements

  • This pack requires the use of the raw HTTP input in Security Data Lake.

Supported versions

  • This pack is tested with GitLab version 17.9.

What is provided

This pack includes parsing rules that convert GitLab logs into Security Data Lake schema-compatible fields. It supports all known event_types.

Log format example:

Application Logs{"id":3255712804,"author_id":26388820,"entity_id":67540197,"entity_type":"Project","details":{"add":"user_access","as":"Default role: Guest","member_id":122256555,"event_name":"member_created","author_name":"Stefan Tester","author_class":"User","target_id":26027514,"target_type":"User","target_details":"Stefan Tester","custom_message":"Membership created","ip_address":"2603:8080:2b20:9a50:12cd:7d27:1240:b8ea","entity_path":"testmegroupname/testing"},"ip_address":"2603:8080:2bf0:9a50:1422:7227:2240:b8ea","author_name":"Stefan Tester","entity_path":"testmegroupname/testing","target_details":"Stefan Tester","created_at":"2025-03-03T16:23:41.344Z","target_type":"User","target_id":26027514,"event_type":"member_created"}

Note

GitLab produces a wide range of JSON logs with a wide range of fields. Non-schema fields have a vendor_ prefix.

Security Data Lake configuration

To receive logs directly from GitLabs via its Audit Event Streaming functionality, you must use the raw HTTP input in Security Data Lake. You can define which types of logs to send and specify Security Data Lake as the destination endpoint. This allows seamless log forwarding from GitLab to Security Data Lake for centralized log analysis.

  1. In Security Data Lake, create a new raw HTTP input for receiving Gitlab logs, unless one already exists. For details, refer to Raw HTTP Input. This input must be used for Gitlab logs only. Configure the log source to the desired value using the Override source field.

  2. Make sure the logs contain an event_source_product field, whose value must be Gitlab-web.

  3. In GitLab, set up an HTTP destination according to the instructions in the official documentation.

  4. In Security Data Lake, click Show received messages for your raw HTTP input to obtain the input ID. This will display a search window with the All Time timeframe. If there is a large number of logs, then you may want to adjust the timeframe to speed up the process.

  5. Copy the gl2_source_input value.

  6. Go to Enterprise > Illuminate and select the Customization tab.

  7. Locate lookup_adapter_input_routing and click Edit . For the content_name key, enter the gl2_source_input value copied earlier. For the input_id value, enter gitlab. (Note that the column names are reversed).

  8. Select Configure value to confirm.

  9. If receiving GitLab logs on multiple inputs, repeat this process for each input.

GitLab Spotlight content pack

The GitLab content pack provides an Overview dashboard, a Web Overview dashboard, and a User Overview dashboard.

Google Workspace content pack

Google Workspace is a collection of cloud computing, productivity and collaboration tools, software, and products developed and marketed by Google. It consists of Gmail, Google Contacts, Google Calendar, Google Meet, Google Chat, Google Drive, Google Docs, and more.

Requirements

  • Google Workspace subscription

  • Google Cloud subscription

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Google Workspace Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Google Workspace Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

Google Workspace uses the Google Workspace input, which ingests logs for multiple Google product types in JSON format. For input configuration details, refer to Google Workspace Input.

Log format example

{"time_usec":1724603503674757,"email":"somebody@somewhere.com","group_id":[],"org_unit_name_path":["Org Name"],"ip_address":"ABCDEFGHIJKLMNOPQR==","event_type":"delivery_type","event_name":"delivery","record_type":"gmail","has_sensitive_content":false,"unique_identifier":"-1294059893469656048","event_id":"b6c2d1fb","resource_ids":[],"resource_details":[],"gmail":{"event_info":{"timestamp_usec":1724603503674757,"elapsed_time_usec":1660649,"success":true,"mail_event_type":2},"message_info":{"action_type":3,"rfc2822_message_id":"<111273729@google.com>","subject":"Spotty connection? No worries. Work offline","payload_size":40973,"source":{"address":"googleworkspace-noreply@google.com","service":"smtp-inbound","from_header_address":"googleworkspace-noreply@google.com","from_header_displayname":"Google Workspace Team"},"destination":[{"address":"somebody@somewhere.com","service":"gmail-ui","selector":""}],"flattened_destinations":"gmail-ui::somebody@somewhere.com","description":"No Error","is_spam":false,"is_policy_check_for_sender":false,"num_message_attachments":0,"attachment":[],"connection_info":{"client_ip":"192.168.1.1","failed_smtp_out_connect_ip":[],"smtp_tls_state":1,"smtp_reply_code":0,"smtp_user_agent_ip":"192.168.1.1","is_intra_domain":false,"dmarc_pass":true,"dmarc_published_domain":"google.com","client_host_zone":"google.com","ip_geo_country":"US","authenticated_domain":[{"name":"google.com","type":2},{"name":"scoutcamp.bounces.google.com","type":6},{"name":"scoutcamp.bounces.google.com","type":1}],"is_internal":false,"dkim_pass":true,"spf_pass":true},"message_set":[{"type":9},{"type":15},{"type":1}],"triggered_rule_info":[],"smime_content_type":0,"link_domain":["google.com","w3.org"],"spam_info":{"disposition":1,"classification_reason":1,"ip_whitelist_entry":""}}}}

What is provided

  • Rules to normalize and enrich Google Workspace log messages, a dashboard, and a saved search.

Events processed by this technology pack

The Google Workspace content pack supports the following logs types. Generic processing will be provided for log types not listed.

  • Gmail Logs

  • Chat Logs

  • Calendar Logs

  • Drive Logs

  • Mobile Logs

  • Token Logs

  • Login Logs

GIM categorization

The pack provides GIM categorization of the following messages:

Vendor event description

GIM category

GIM subcategory

GIM event type code

Message sent

messaging

messaging.email

130000

Message received

messaging

messaging.default

139999

Message permanently deleted

messaging

messaging.email

132000

Message quarantined

messaging

messaging.email

131500

Google Workspace Spotlight content pack

The Google Workspace Spotlight content pack offers a dashboard with two tabs, Google Workspace Overview and Gmail, and a parameter-based saved search for information associated with a user e-mail address.

HAProxy content pack

HAProxy is an open-source software solution that provides a high-performance and highly available TCP and HTTP load balancer and proxy server.

About HAProxy log collection

  • The use case is a HAProxy HTTP server on a Linux system.

  • This pack will parse out and configure HAProxy TCP, HTTP, HTTPS, and TCP logs.

Requirements

  • The content pack supports logging via syslog.

  • For instructions on setting up syslog with HAProxy, refer to the official documentation.

  • You must configure syslog with the rfc5424 format.

Note

In Security Data Lake, you need a syslog input with the matching IP, port, and protocol to receive the logs.

Supported versions

  • Tested with HAProxy version 2.9

Stream configuration

This technology pack includes one stream:

  • "Illuminate:HAProxy LoadBalancer Messages"

Note

If this stream name is already defined, then nothing will be changed. If this stream name does not exist, then it will be created.

Index set configuration

This technology pack includes one index set definition:

  • "HAProxy LoadBalancer Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Supported log formats

  • Default/Connection Logs

  • Error Logs

  • TCP Logs (option tcplog)

  • HTTP Logs (option httplog)

  • HTTPS Logs (option httpslog)

Input via Filebeat together with Bitdefender Sidecar

To configure your Security Data Lake server and your client(s), refer to the Sidecar documentation.

You will need to take the following steps:

  1. Create a Beats input.

  2. Create a Security Data Lake REST API token and save it.

  3. Install Bitdefender Sidecar.

  4. Add your client(s), e.g. web server.

These steps are explained in the sections below.

Security Data Lake settings

  1. Create a Beats input in Security Data Lake. For information on how to create and configure this Bitdefender Forwarder input, refer to Beats input.

  2. Create a Security Data Lake REST API access token and save it. For details, refer to Installing Sidecar (Section 1.2, Create an API token).

  3. Create a (Linux) filebeat configuration under System > Sidercars > Configuration , with a filebeat on Linux collector.

  4. Configure the file and add:

    • The correct IP under hosts.

      Important

      You must enter the IP of the Bitdefender Forwarder and the port that you defined in the Beats input profile.

    • The log source configured to the desired value and an event_source_product field with a haproxy value.

    fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}
filebeat.inputs:
    input_type: log
    paths:
        /var/log/haproxy.log
        type: filestream
        fields_under_root: true
        fields:
        event_source_product: haproxy
        output.logstash:
        hosts: ["<forwarder_ip>:5044"]
        path:
        data: ${sidecar.spoolDir!"/var/lib/bitdefender/sidecar/collectors/filebeat"}/data
        logs: ${sidecar.spoolDir!"/var/lib/bitdefender/sidecar/collectors/filebeat"}/log

    Important

    There must be two spaces in front of event_source_product and - /var....

  5. Save the configuration to complete setup.

Configure a client with Filebeat and Bitdefender Sidecar

  1. Install, enable and verify Bitdefender Sidecar on the remote machine. For details, refer to  Installing Sidecar.

  2. Install Filebeat according to the instructions in the official documentation. Alternatively, you can download and install the OSS-only version of Filebeat.

    • If you install Filebeat manually, use /etc/filebeat as the installation directory.

    • If you install Filebeat via apt-get, then the correct directory is automatically selected.

    Example commands for Ubuntu:

    wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/oss-8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list
sudo apt-get update && sudo apt-get install filebeat
sudo systemctl enable filebeat
sudo systemctl start filebeat
sudo systemctl status filebeat

  3. (Optional) Edit the filebeat.yml file as needed. You can do this via the Sidecar configuration in the Security Data Lake interface.

  4. Start the daemon. If there is a permission issue, you can resolve it by running the following command:

    sudo chown root filebeat.yml

  5. (recommended) Configure Filebeat to start automatically after reboot.

  6. In Security Data Lake, assign a configuration to the machine where Sidecar is installed. You can do this from System > Sidecars > Administration.

Log format examples

Connection log

haproxy[1234]: Connect from 10.0.1.2:33312 to 10.0.3.31:8012 (www/HTTP)

Error log

haproxy[6103]: 127.0.0.1:56059 [03/Dec/2023:17:35:10.380] frt/f1: Connection error during SSL handshake

TCP log

haproxy[14387]: 10.0.1.2:33313 [06/Feb/2023:12:12:51.443] sdl-in static/srv1 8/9/5007 212 PH -1/2/3/4/5 6/7

HTTP/HTTPS log

haproxy[1234]: 10.0.1.2:33317 [06/Feb/2023:12:14:14.655] https-in static/srv1 11/0/31/68/108 200 2353 - - ---- 1/2/3/4/5 6/7 {sdl.de} {} "GET /index.html HTTP/1.1" 0/0/0/0/0 sdl.de/TLSv1.3/TLS_AES_256_GCM_SHA384

Note

Custom log formats are not supported.

What is provided

This package includes parsing rules to extract HAProxy logs into Security Data Lake schema-compatible fields.

  • HAProxy default logs get the GIM code "129999" (network.default).

  • Logs with the http_request get the GIM code "180000" (http.message).

Mappings

Default log structure

The default format is deprecated, but the content pack will support it.

Feb 16 12:12:29 localhost haproxy[14115]: Connect from 10.0.12.20:59312 to 10.0.23.131:2022 (www/HTTP)

Field name

Example value

Description

process_name

haproxy

Process name

process_id

14115

HAProxy's Process ID

source_ip

10.0.12.20

IP address of the client which initiated the connection

source_port

59312

TCP port of the client which initiated the connection

destination_ip

10.0.23.131

IP address the client connected to

destination_port

2022

TCP port the client connected to

vendor_frontend_name

www

The name of the frontend or listener

vendor_frontend_mode

HTTP

Mode the frontend is operating (TCP or HTTP)

Default fields for TCP/HTTP and HTTPs logs

Field name

Example value

Description

process_name

haproxy

Process name

process_id

14115

Process ID

source_ip

10.0.1.22

TCP port of the client that initiated the connection

source_port

33213

TCP port of the client that initiated the connection

event_received_time

02/Feb/2023:12:12:51.222

Exact date when the connection was received by HAProxy

vendor_frontend_name

sdl

Name of the frontend (or listener) that received and processed the connection

vendor_backend_name

backend1

Name of the backend (or listener)

vendor_server_name

srv1

Name of the last server to which the connection was sent

vendor_tw

1

Total time in milliseconds spent waiting

vendor_tc

2

Total time in milliseconds spent waiting for the connection to establish to the final server

vendor_tt

5007

Total time in milliseconds elapsed between the accept and the last close

destination_bytes_sent

212

Total number of bytes transmitted from the server to the client when the log is emitted

captured_request_cookie

optional field

Optional name=value entry indicating that the client had this cookie in the request

captured_response_cookie

optional field

Optional name=value entry indicating that the server has returned a cookie with its response

vendor_termination_state

-- or ----

The condition the session was in when the session ended

vendor_actconn

3

Total number of concurrent connections on the process when the session was logged

vendor_feconn

4

Total number of concurrent connections on the frontend when the session was logged

vendor_beconn

5

Total number of concurrent connections handled by the backend when the session was logged

vendor_srv_conn

6

Total number of concurrent connections still active on the server when the session was logged

vendor_retries

7

Number of connection retries experienced by this session when trying to connect to the server

vendor_srv_queue

8

Total number of requests which were processed before this one in the server queue

vendor_backend_queue

9

Total number of requests which were processed before this one in the backend's global queue

TCP log format

haproxy[14387]: 10.0.1.22:33213 [02/Feb/2023:12:12:51.222] sdl backend1/srv1 1/2/5007 212 -- 3/4/5/6/+7 8/9

HTTP/HTTPS format

haproxy[14389]: 10.0.1.2:33317 [06/Feb/2023:12:14:14.655] https-in sdl/srv1 10/0/30/69/109 200 27250 cookie - C--- 10/1/1/1/0 20/20 {1sdl.de} {fun.de} "GET /index.html HTTP/1.1" 20/21/22/23/24 grt.de/TLSv1.3/TLS_AES_256_GCM_SHA384

Additional fields for HTTP/HTTPS logs:

Field name

Example value

Description

vendor_trr

69

Total time in milliseconds spent waiting for the server to send a full HTTP response

vendor_ta

109

Total time the request remained active in HAProxy

http_response_code

200

HTTP status code returned to the client

http_request_cookie

cookie

An optional name=value entry indicating that the client had this cookie in the request

http_response_cookie

-

An optional name=value entry indicating that the server has returned a cookie with its response

vendor_captured_request_headers

1sdl.de

List of headers captured in the request due to the presence of the "capture request header" statement

vendor_captured_response_headers

fun.de

A list of headers captured in the response due to the presence of the "capture response header" statement

http_request_method

GET

HTTP request method

http_request_path

/index.html

HTTP request path

http_version

1.1

HTTP version

vendor_fc_err

20

Status of the connection on the frontend's side

vendor_ssl_fc_err

21

Last error of the first SSL error stack that was raised on the connection from the frontend's perspective

vendor_ssl_c_err

22

Status of the client's certificate verification process

vendor_ssl_c_ca_err

23

Status of the client's certificate chain verification process

vendor_ssl_fc_is_resumed

24

True if the incoming TLS session was resumed with the stateful cache or a stateless ticket

vendor_ssl_fc_sni

grt.de

SNI (Server Name Indication) presented by the client to select the certificate to be used

vendor_ssl-version

TLSv1.3

SSL version of the frontend

vendor_ssl_ciphers

TLS_AES_256_GCM_SHA38

SSL cipher used for the connection

HAProxy Spotlight content pack

HAProxy offers five dashboards: a general overview dashboard, a dashboard for default logs, one for TCP logs, one for HTTP and HTTPS logs, and an error dashboard.

Juniper SRX Series Firewall content pack

The Juniper SRX line of firewalls combine effective security, SD-WAN, routing, switching and WAN interfaces with next-generation firewall and advanced threat mitigation capabilities. It provides secure connectivity across distributed enterprise locations.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Juniper Messages”

Note

If this stream does not exist prior to the activation of the content pack, it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Requirements

  • Juniper SRX devices running Junos OS 17.4. Junos OS must be configured to send log messages via the sd-syslog format. Compared to standard syslog, the sd-syslog format is an overly structured system log file format.

  • Juniper SRX Logging

For more information, refer to the Juniper documentation.

Warning

Make sure that the Expand structured data option in the input to which you send your logs is not selected.

Index set configuration

This technology pack includes one index set definition:

  • “Juniper Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format examples

<14>1 2023-08-02T06:20:55.496Z RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.129 source-address="192.168.1.2" source-port="49158" destination-address="10.10.10.10" destination-port="80" connection-tag="0" service-name="junos-http" nat-source-address="172.16.1.2" nat-source-port="29479" nat-destination-address="10.10.10.10" nat-destination-port="80" nat-connection-tag="0" src-nat-rule-type="source rule" src-nat-rule-name="trust_Zone" dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="default-permit" source-zone-name="trust" destination-zone-name="untrust" session-id="6389" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/1.0" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN" application-category="N/A" application-sub-category="N/A" application-risk="-1" application-characteristics="N/A" src-vrf-grp="N/A" dst-vrf-grp="N/A" tunnel-inspection="Off" tunnel-inspection-policy-set="root" source-tenant="N/A" destination-service="N/A"]

<14>1 2023-08-02T06:20:13.049Z RT_IDS - RT_SCREEN_TCP [junos@2636.1.1.1.2.40 attack-name="SYN flood!" source-address="192.168.1.1" source-port="40001" destination-address="192.168.1.2" destination-port="50010" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="drop"]

What is provided

Rules to normalize and enrich Juniper SRX log messages.

Juniper SRX log message processing

The Illuminate processing of Juniper SRX log messages provides the following:

  • Field extraction, normalization and message enrichment for Juniper SRX log messages.

  • GIM categorization of the following messages:

Juniper SRX log type

GIM category

GIM subcategory

RT_FLOW_SESSION_CLOSE

network

network.flow

RT_FLOW_SESSION_CREATE

network

network.open

IDP_ATTACK_LOG_EVENT

network

network.flow

APPTRACK_SESSION_CLOSE

network

network.flow

Juniper SRX Spotlight content pack

The Spotlight content pack includes a Juniper SRX Overview dashoard.

Linux Auditbeat content pack

The Illuminate Linux Auditbeat Spotlight works with Illuminate Core and the Elastic Auditbeat agent for Linux. The Auditbeat agent is a "lightweight shipper for audit data." The Auditbeat agent for Linux communicates with the Audit framework for LInux and adds processing, enrichment, and delivery of Linux audit messages.

The Linux Auditbeat Spotlight comes ready to use, with pre-built dashboard views that include:

  • Linux Auditbeat Overview

  • Network Activity

  • Admin activity

These built-in views can serve as a starting point for creating custom dashboards.

Supported versions

This Spotlight supports Auditbeat for Linux versions 7-8 and will function with both the Elastic-licensed and Apache-licensed versions of Auditbeat.

Warning

The Apache-licensed version of Auditbeat does NOT include the system module, which provides additional data sets not available in the Elastic-licensed version.

By default, Security Data Lake comes with the Apache-licensed version of Auditbeat. If you want to use the system module, you can install the Elastic-licensed version by adding the appropriate repo and installing Auditbeat alongside the bundled version.

Install the Elastic version of Auditbeat

For the APT package manager, run the following commands:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list

For the YUM package manager, run the following commands:

sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
cat << EOF | sudo tee -a /etc/yum.repos.d/elastic-8.x.repo
[elastic-8.x]
name=Elastic repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

Configure the Auditbeat Log Collector in Security Data Lake

Modify the Auditbeat log collector configuration. For more information on setting up Sidecar log collectors, refer to Sidecar collectors.

  1. Go to System > Sidecars and select the Configurations tab.

  2. Under Log Collectors, select Edit next to your Auditlog collector.

  3. Modify the Executable Path field to point to the new Auditbeat agent's binary path, which is set to /usr/share/auditbeat/bin/auditbeat by default.

Optionally, you can also opt to create a new Auditbeat log collector with this path so that you do not overwrite the default log collector. Remember to give the new collector a unique name, like Auditbeat (Elastic-licensed).

Requirements

  • A configured Beats input in Security Data Lake. Set the Title, Bind Address (for example, 0.0.0.0 to listen on all interfaces), and port (for example, 5044). The Do not add Beats type as prefix option must not be selected in the input settings. Pipeline processing rules reference incoming data by field name, and the pipeline will not function correctly if this prefix is omitted. For more information on the Beats input configuration, refer to Beats Input.

    Note

    One Beats input can service multiple log sources; therefore, this step is not required if a beats input has already been configured.

  • One or more Linux hosts with Elastic Audibeat installed. For details on installing Auditbeat, refer to the official documentation. You can manage Beats agents, including Auditbeat, using Bitdefender Sidecar.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Linux Auditbeat Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Illuminate: Linux Auditbeat Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

["type=CRED_ACQ msg=audit(1633670701.685:6873): pid=5205 uid=0 auid=4294967095 ses=4294970295 subj=unconfined msg='op=PAM:setcred grantors=pam_permit,pam_cap acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"]

What is provided

  • Parsing rules to extract Linux Auditbeat logs into Security Data Lake-schema compatible fields

  • Data lookup tables used in the normalization and enrichment of Linux Auditbeat log messages into the Security Data Lake schema

  • Dashboards

Auditbeat log message processing

The Illuminate processing of Linux Auditbeat messages provides the following:

  • Field extraction, normalization and message enrichment for Linux Auditbeat log messages

  • GIM categorization of the following messages:

Auditbeat Module: AuditD

| vendor_event_category |

Auditbeat Module: File Integrity

Auditbeat dataset

Auditbeat log category

GIM category

GIM subcategory

executed

cell

cell

bound-socket

cell

cell

connected-to

cell

cell

network_flow

process_stopped

process_started

existing_user

existing_process

opened-file

was-authorized

started-session

acquired-credentials

disposed-credentails

ended-session

changed-logon-id-to

wrote-to-file

started-service

stopped-service

process_error

attributes_modified

updated

created

host

authenticated

deleted

moved

violated-apparmor-policy

package_updated

ran-command

refreshed-credentials

user_logout

package_installed

renamed

user_login

accepted-connection-from

logged-in

changed-password

added-group-account-to

package_removed

user_changed

added-user-account

host_changed

password_changed

sent-to

user_added

deleted-group-account-from

Linux System content pack

Linux is a ubiquitous, open-source operating system that powers everything from servers and cloud infrastructure to desktop systems and embedded devices.

This technology pack provides common log parsing, normalization, and enrichment for Debian/Ubuntu Linux distributions.

Supported distributions

  • Ubuntu 20.04 LTS (Focal Fossa) and 22.04 LTS (Jammy Jellyfish)

  • Debian 11 (bullseye) and 12 (bookworm)

Note

While the initial release of this pack was primarily developed and tested on Ubuntu, it also supports Debian, as Ubuntu is based on Debian. Both distributions share similar log formats for common system outputs like syslog and auth.log. Minor differences in service naming or security frameworks may exist, but the core log structures are compatible across both platforms.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Linux System Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Linux System Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

This pack primarily parses logs written to syslog and auth.log under the /var/log directory.

The following log delivery methods are recommended:

  • Syslog daemons such as rsyslog and syslog-ng

  • Filebeat (with Bitdefender Sidecar)

Rsyslog configuration

  1. Create a syslog input Security Data Lake. For details on input creation and configuration, refer to Syslog Inputs.

  2. Configure rsyslog to send logs under /var/log to Security Data Lake.

  3. You can specifically forward messages from syslog and auth.log, as the pack primarily targets these log sources.

  4. Create a custom template that identifies the logs as Linux logs for the parser to recognize.

  5. The simplest method is to set the event_source_product field to linux in the structured data portion of the syslog message. Refer to the following template configuration sample:

    template(
  name="custom_linux_syslog_5424"
  type="string"
  string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% [exampleSDID@12345 event_source_product=\"linux\"]%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
)
*.* action(type="omfwd" target="YOUR GRAYLOG SERVER" port="514" protocol="tcp" template="custom_linux_syslog_5424")

Note

It is recommended that you send RFC 5424-compliant syslog messages.

Syslog-ng configuration

  1. Create a syslog input Security Data Lake. For details on input creation and configuration, refer to Syslog Inputs.

  2. For Illuminate to identify and process the logs as Linux logs, the event_source_product field must be added to each message by the syslog-ng configuration

    Modify the configuration to set the custom event_source_product field to linux using a rewrite function. Refer to the following example under the Destinations section of the configuration:

    ########################
# Destinations
########################

# Set custom field using rewrite.
rewrite custom_field { set("linux" value(".SDATA.meta.event_source_product")); };

# Define TCP syslog destination.
destination d_sdl { syslog("<forwarder_hostname_or_ip>" port(514)); };

  3. Under Log paths define the source, rewrite and destination. This example refers to the configurations set in the previous step:

    ########################
# Log paths
########################

# Send from the default source s_src to the custom destination d_sdl using the intermediary rewrite as configured above.
log { source(s_src); rewrite(custom_field); destination(d_sdl); };

Filebeat configuration

  1. For information on how to set up Bitdefender Sidecar for Filebeat, refer to Sidecars.

  2. Create a Beats input in Security Data Lake. Ensure that Do not add Beats type as prefix is not selected in the input configuration. For more information on the Beats input configuration, refer to Beats input.

  3. Create an API access token and a custom Linux Filebeat collector.

  4. Configure the collector to ship messages in syslog and auth.log to Security Data Lake. The Filebeat input must add the event_source_product field, with a value of linux, for the parser to identify the log source as Linux.

  5. In addition, the fields_under_root option must be set to true for message identification to work. Refer to the following example:

    - input_type: log
paths:
- /var/log/auth.log
- /var/log/syslog
type: filestream
fields_under_root: true
fields:
event_source_product: linux

  6. Install Bitdefender Sidecar on the client.

  7. Edit the Bitdefender Sidecar client configuration with your Security Data Lake URL and API access token. For more information on configuring Bitdefender Sidecar, refer to Installing Sidecar.

Note

This pack currently has partial support for messages delivered using GELF. Parsing works for most event types but some, such as variants of IAM events, do not get processed as intended when using GELF.

What is provided

  • Rules to parse, normalize, and enrich Linux system log messages

  • A dashboard displaying events and statistics of interest

Events processed by this technology pack

The Linux System Logs content pack supports the following log types. Generic processing will be provided for log types not listed.

  • SSH Logs

  • Sudo Logs

  • Su Logs

  • PAM Logs

  • Systemd Logs

  • Cron Logs

  • UFW Logs

  • Iptables Logs

  • User Activity Logs

  • Group Activity Logs

GIM categorization

GIM categorization is provided for the following messages:

Log type

Vendor event description

GIM category

GIM subcategory

GIM event type code

pam

Authentication failure

authentication

authentication.default

109999

ssh

Postponed keyboard-interactive

authentication

authentication.default

109999

ssh

Accepted password

authentication

authentication.credential validation

100500

ssh

Accepted publickey

authentication

authentication.credential validation

100500

ssh

Failed password (for invalid/illegal user)

authentication

authentication.credential validation

100500

ssh

Failed publickey (for invalid/illegal user)

authentication

authentication.credential validation

100500

systemd

Service status message

service

service.default

219999

systemd

Unit service entered <STATE> state

service

service.default

219999

systemd

Failed with result

service

service.default

219999

systemd

Main process exited

service

service.default

219999

systemd

Control process exited

service

service.default

219999

kernel/ufw

UFW ALLOW/BLOCK

network

network.network connection

120000

kernel/ufw

UFW AUDIT

network

network.default

129999

kernel/iptables

IPTABLES-ALLOW/DROP

network

network.network connection

120000

kernel/iptables

iptables-log

network

network.default

129999

users/groups

Changed password expiry for user

iam

iam.default

119999

users/groups

Changed user information

iam

iam.default

119999

users/groups

Changed user shell

iam

iam.default

119999

users/groups

User added to group

iam

iam.default

119999

users/groups

User removed from group

iam

iam.default

119999

users/groups

User created

iam

iam.default

119999

users/groups

User deleted

iam

iam.default

119999

users/groups

User username changed

iam

iam.default

119999

users/groups

User password changed

iam

iam.default

119999

users/groups

User ID changed

iam

iam.default

119999

users/groups

Group removed

iam

iam.default

119999

users/groups

Group ID changed

iam

iam.default

119999

users/groups

Group password changed by user

iam

iam.default

119999

users/groups

Group password removed by user

iam

iam.default

119999

Note

GIM categorization for IAM events currently lacks support for events referencing group entities.

Message fields included in this pack

General parsing

Field name

Example value

Field type

Description

event_created

2025-03-25T10:08:00.000Z

date

Syslog timestamp in messages delivered via Filebeat

event_log_path

/var/log/auth.log

keyword

The full path of the source log file in messages delivered via Filebeat

event_reporter_hostname

corp.srv.lxv01

keyword

Hostname provided by Filebeat

event_source

lxs1

keyword

Syslog hostname in messages delivered via Filebeat

application_name

sshd

keyword

This field is generated by the Syslog input or parsed from the Syslog header in Filebeat messages

facility

security/authorization

keyword

This field is generated by the Syslog input

process_id

5222

keyword/loweronly

This field is generated by the Syslog input

source

prodlxv01

keyword

Hostname or IP of the source system that generated the event

source_user_domain

corp.internal

keyword

AD or LDAP domain extracted from source user account names where applicable

user_domain

corp.internal

keyword

AD or LDAP domain extracted from user account names where applicable

SSH

Field name

Example value

Field type

Description

event_outcome

success

keyword

The outcome of the event

event_repeat_count

3

long

Count of times a message has been repeated

host_ip

10.1.2.3

ip

IP address that the SSH server binds to

host_port

22

long

Port that the SSH server listens on

source_ip

10.1.2.3

ip

IP address of the client

source_hostname

workstation.corp.example.com

keyword

Hostname of the client

source_port

62681

long

Port from which the client connects

user_name

webadmin

keyword

The user used to authenticate or associated with the session

vendor_credential_type

publickey

keyword

The type of credentials used for authentication

vendor_event_action

refused

keyword

The action taken in the event

vendor_event_description

Accepted password

keyword

The description of the event action

vendor_event_outcome

not allowed

keyword

The vendor-defined outcome of the action described in the message

vendor_event_outcome_reason

not listed in AllowUsers

keyword

The vendor-provided text detailing the reason for the event outcome

vendor_ssh_signature

ED25519 SHA256:YbexxF5dVcxxmEh9xx/DuXoUX6xxLvKI2u3xx7LjYuw

keyword

The fingerprint of the key or certificate used for authentication

Sudo

Field Name

Example value

Field type

Description

event_outcome

success

keyword

The outcome of the event

process_command_line

/bin/bash

keyword

The full command line that the user attempted to execute

process_working_directory

/home/user1

keyword

The current working directory that the process was called from

source_user_name

user1

keyword

The user that initiated the request to run a command with elevated privileges

user_name

root

keyword

The user that the command is run as

vendor_event_description

User executed a command with elevated privileges

keyword

The description of the event action

vendor_event_outcome

success

keyword

The outcome describing whether the sudo attempt was successful or not

vendor_sudo_error

user NOT in sudoers

keyword

The error that occurred, often indicating a failed sudo attempt

vendor_tty

pts/1

keyword

The terminal from which the sudo command was executed

Su

Field Name

Example value

Field type

Description

event_outcome

success

keyword

The outcome of the event

source_user_name

user1

keyword

The user that initiated the action to switch to another user

user_name

user2

keyword

The target user that the original user attempted to switch to

vendor_event_description

Failed user attempt to switch to another user

keyword

The description of the event action

vendor_event_outcome

FAILED

keyword

The outcome describing whether the su attempt was successful or not

vendor_tty

pts/0

keyword

The terminal from which the su command was executed

PAM

Field name

Example value

Field type

Description

event_outcome

failure

keyword

The outcome of the event

source_ip

10.1.2.3

ip

Remote IP address from which the authentication attempt originated

source_hostname

workstation.corp.example.com

keyword

Remote hostname from which the authentication attempt originated

source_user_id

0

keyword

ID of the user or process that initiated the session for another user

source_user_name

user1

keyword

The remote user that made the authentication attempt or user that initiated the session

user_id

1000

keyword

ID of the user for which a session was opened/closed

user_name

user2

keyword

The user account being authenticated or the user for which a session was opened/closed

vendor_event_action

opened

keyword

The action taken in the event

vendor_event_description

Session opened for user

keyword

The description of the event action

vendor_pam_euid

0

keyword

The effective user ID used to execute the process, which may differ from the real user ID

vendor_pam_function

auth

keyword

The specific function being invoked by PAM

vendor_pam_logname

user1

keyword

The login name of the user

vendor_pam_module

pam_unix

keyword

The name of the PAM module handling the authentication

vendor_pam_service_name

sshd

keyword

The service or application using PAM for authentication

vendor_pam_uid

0

keyword

ID of the user being authenticated or of the process facilitating the authentication

vendor_tty

/dev/pts/0

keyword

The terminal over which the authentication attempt was made

Systemd

Field name

Example value

Field type

Description

event_outcome

failure

keyword

The outcome of the event

service_name

logrotate

keyword

The name of the service

service_state

active

keyword

The state of the service

vendor_event_action

Finished

keyword

The action taken in the event

vendor_event_description

Main process exited

keyword

The description of the event action

vendor_event_outcome

Failed

keyword

The vendor-defined outcome of the action described in the message

vendor_systemd_code

exited

keyword

The exit code returned by the process when it terminates

vendor_systemd_service_status

Deactivated successfully.

keyword

The general status of the service

vendor_systemd_status_code

1

keyword

The status code that indicates the result of the process

vendor_systemd_status_description

FAILURE

keyword

The description of the status of the service after its process has terminated

vendor_systemd_unit_description

Rotate log files

keyword

The description of the systemd unit, often from when it changes state

Cron

Field name

Example value

Field type

Description

process_command_line

cd / && run-parts --report /etc/cron.hourly

keyword

The full command line scheduled to run

source_user_name

root

keyword

The user that modified the crontab of itself or another user

user_name

user1

keyword

The user that the command is run under or whose crontab is modified

vendor_cron_error

grandchild #2176 failed with exit status 1

keyword

The error that occurred during a job or when processing crontab

vendor_cron_info

Running @reboot jobs

keyword

The general information output from a job

vendor_event_description

Cron job initiated

keyword

The description of the event action

User and group activity

Field Name

Example value

Field type

Description

source_user_id

1001

keyword

ID of the user account impacting another user account, or the ID before a change

source_user_name

user1

keyword

Name of the user account impacting another user account, or the name before a change

user_id

1002

keyword

ID of the user account

user_name

user2

keyword

Name of the user account

vendor_event_action

created

keyword

The action taken in the event

vendor_event_description

User created

keyword

The description of the event action

vendor_source_group_id

998

keyword

ID of the group before a change

vendor_source_group_name

group1

keyword

Name of the group before a change

vendor_group_id

999

keyword

ID of the group

vendor_group_name

group2

keyword

Name of the group

vendor_tty

/dev/pts/0

keyword

The terminal from which an action was taken

vendor_user_home

/home/user1

keyword

User home directory

vendor_user_shell

/bin/bash

keyword

User login shell

UFW

Field name

Example value

Field type

Description

event_action

blocked

keyword

The action taken by UFW on the network connection

network_bytes

36

long

The length of the packet in bytes

network_iana_number

7

long

The protocol number of the packet

network_transport

tcp

keyword

The transport protocol of the packet

network_interface_in

ens33

keyword/loweronly

Name of interface receiving traffic

network_interface_out

wlp3s0

keyword/loweronly

Name of interface sending traffic

source_ip

192.168.1.151

ip

Source IP address of the packet

source_port

5044

long

Source port of the packet

destination_ip

192.168.1.204

ip

Destination IP address of the packet

destination_port

46026

long

Destination port of the packet

source_mac

94:08:53:70:ff:b3

keyword

Source MAC address of the packet

destination_mac

e8:ff:1e:d8:d2:2d

keyword

Destination MAC address of the packet

vendor_ufw_id

35670

keyword

The unique ID of the IP datagram, shared across packet fragments

vendor_ufw_window

50336

keyword

The TCP window size of the packet

vendor_ufw_ttl

64

keyword

The packet Time to Live

vendor_uptime

16058.979911

keyword

The kernel time in seconds since boot

Iptables

Field name

Example value

Field type

Description

event_action

allowed

keyword

The action taken by iptables on the network connection

network_bytes

266

long

The length of the packet in bytes

network_iana_number

2

long

The protocol number of the packet

network_transport

tcp

keyword

The transport protocol of the packet

network_interface_in

ens33

keyword/loweronly

Name of interface receiving traffic

network_interface_out

wlp1s0

keyword/loweronly

Name of interface sending traffic

source_ip

192.168.1.151

ip

Source IP address of the packet

source_port

5044

long

Source port of the packet

destination_ip

192.168.1.204

ip

Destination IP address of the packet

destination_port

46026

long

Destination port of the packet

source_mac

94:08:53:70:ff:b3

keyword

Source MAC address of the packet

destination_mac

e8:ff:1e:d8:d2:2d

keyword

Destination MAC address of the packet

vendor_iptables_id

34317

keyword

The unique ID of the IP datagram, shared across packet fragments

vendor_iptables_window

13426

keyword

The TCP window size of the packet

vendor_iptables_ttl

47

keyword

The packet Time to Live

vendor_uptime

531661.188230

keyword

The kernel time in seconds since boot

Note

User names are case-sensitive in some Linux distributions. While case is retained in the original message and in extracted fields like user_name and source_user_name, searches will treat the values as case-insensitive. For example, a search for user_name:user1 would return results containing both cases, such as user1 and USER1.

Linux System Logs Spotlight content pack

The Spotlight content pack includes the following tabs: Linux System Overview, SSH, Sudo, and Users and Groups.

Linux System User Activity Sigma rules content pack

The Linux System User Activity Sigma Rules content pack is a collection of Sigma rules, selected from SOC Prime's Threat Detection Marketplace. The rules in this content pack are focused on Linux security threats. They are configured to work directly with existing Linux Illuminate content.

When you enable this content pack, these rules appear on the Sigma Rules page in the Security interface. By default, new rules are disabled. You can select which rules to enable for your environment.

Requirements

  • Linux Auditbeat and/or Linux content pack

Stream configuration

This technology pack uses the stream category:

  • "linux"

What is provided

This content pack includes 28 Sigma rules.

  • Critical threat level: 2 rule

  • High threat level: 13 rules

  • Medium threat level: 9 rules

  • Low threat level: 4 rules

Each rule includes remediation steps, which display if an alert is triggered based on the Sigma rule. For details, refer to Remediation Steps.

Configure Sigma rules

When you enable this content, the new Sigma rules are added to the Sigma Rules page in Security Data Lake. Follow the steps below to enable rules and configure alerts.

  1. Enable your chosen Sigma rules on the Security > Sigma Rules page.

    Note

    To find the Sigma rules added by this content pack, search for Illuminate – Linux, as all the rules from this pack have titles that begin with this text string.

    To enable an inactive Sigma rule, click the toggle in the Enabled column.

    Note

    Make sure you review the rules before enabling them. Each rule can have a performance cost, depending on your network configuration. You might need to add other streams as well.

  2. Update rules if necessary. Some rules can result in many false positives and should be adjusted. Click the rule title to open the editing window, where you can review the rule definition and other options. However, note that not all options are editable—including the rule definition.

    If you need to update the rule definition, first clone the rule by selecting Clone from the More menu. In the cloned rule, you can update any of the fields and options, including the rule definition.

    For complete information about creating and working with Sigma rules, refer to Sigma Rules.

  3. Edit and update the event definition, if necessary. Each Sigma rule has a matching event definition, found on the Event Definitions tab of the Alerts page. For Sigma rules you enable, review the matching event definitions. You can add search filters or alerts, as well as custom fields.

    Note

    When you enable the Sigma rule, the event definition is enabled by default. You can disable the event and any defined alert on the Event Definition page without disabling the Sigma rule.

    For more information, refer to Event Definitions.

Microsoft Defender for Endpoint content pack

Microsoft Defender for Endpoint is an industry-leading, cloud-powered endpoint security solution that helps to secure against ransomware, file-less malware, and other sophisticated attacks on Windows, macOS, Linux, Android, and iOS.

Requirements

  • Microsoft Defender for Endpoint Plan 1 or Plan 2.

Stream configuration

This technology pack includes one stream:

“Illuminate:Microsoft Defender for Endpoint Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

“Microsoft Defender for Endpoint Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format examples

{"id":"da20708b1e-8554-4ec8-b59c-925c4663aa3a_1","incidentId":2,"investigationId":null,"assignedTo":null,"severity":"Medium","status":"New","classification":null,"determination":null,"investigationState":"UnsupportedAlertType","detectionSource":"WindowsDefenderAtp","detectorId":"7f1c3609-a3ff-40e2-995b-c01770161d68","category":"Execution","threatFamilyName":null,"title":"Suspicious PowerShell command line","description":"A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.","alertCreationTime":"2023-04-06T10:41:43.691043Z","firstEventTime":"2023-04-06T10:39:00.7407597Z","lastEventTime":"2023-04-06T10:42:49.3567967Z","lastUpdateTime":"2023-04-06T10:45:41.5166667Z","resolvedTime":null,"machineId":"31328158e55872c03a1b5ec4c96744cbb82c8f4b","computerDnsName":"win-tfb8l7bi77h","rbacGroupName":"UnassignedGroup","aadTenantId":"df620235-50d7-4400-bb7e-3b112e9b1ff4","threatName":null,"mitreTechniques":["T1059.001","T1105","T1140","T1216","T1218","T1218.003"],"relatedUser":{"userName":"Administrator","domainName":"WIN-TFB8L7BI77H"},"loggedOnUsers":[{"accountName":"testuser","domainName":"DESKTOP-IIQVPJ7"}],"comments":[{"comment":"test comment for docs","createdBy":"secop123@contoso.com","createdTime":"2020-07-21T01:00:37.8404534Z"}],"evidence":[{"entityType":"Process","evidenceCreationTime":"2023-04-06T10:45:41.51Z","sha1":"6cbce4a295c163791b60fc23d285e6d84f28ee4c","sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","fileName":"powershell.exe","filePath":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","processId":10520,"processCommandLine":"powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= silentlycontinue;(New-Object System.Net.WebClient).DownloadFile(http://127.0.0.1/1.exe, C:\\test-WDATP-test\\invoice.exe);Start-Process C:\\test-WDATP-test\\invoice.exe","processCreationTime":"2023-04-06T10:42:49.2635644Z","parentProcessId":5212,"parentProcessCreationTime":"2023-04-06T10:40:44.9749107Z","parentProcessFileName":"cmd.exe","parentProcessFilePath":"C:\\Windows\\System32","ipAddress":null,"url":null,"registryKey":null,"registryHive":null,"registryValueType":null,"registryValue":null,"registryValueName":null,"accountName":"Administrator","domainName":"WIN-TFB8L7BI77H","userSid":"S-1-5-21-3669279935-616031708-4259075843-500","aadUserId":null,"userPrincipalName":null,"detectionStatus":"Detected"},{"entityType":"File","evidenceCreationTime":"2021-01-26T20:33:58.42Z","sha1":"8563f95b2f8a284fc99da44500cd51a77c1ff36c","sha256":"dc0ade0c95d6db98882bc8fa6707e64353cd6f7767ff48d6a81a6c2aef21c608","fileName":"suspicious.dll","filePath":"c:\\temp","processId":null,"processCommandLine":null,"processCreationTime":null,"parentProcessId":null,"parentProcessCreationTime":null,"parentProcessFileName":null,"parentProcessFilePath":null,"ipAddress":null,"url":null,"registryKey":null,"registryHive":null,"registryValueType":null,"registryValue":null,"accountName":null,"domainName":null,"userSid":null,"aadUserId":null,"userPrincipalName":null,"detectionStatus":"Detected"},{"entityType":"Process","evidenceCreationTime":"2023-04-06T10:41:44.03Z","sha1":"6cbce4a295c163791b60fc23d285e6d84f28ee4c","sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","fileName":"powershell.exe","filePath":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","processId":10300,"processCommandLine":"powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= silentlycontinue;(New-Object System.Net.WebClient).DownloadFile(http://127.0.0.1/1.exe, C:\\test-WDATP-test\\invoice.exe);Start-Process C:\\test-WDATP-test\\invoice.exe","processCreationTime":"2023-04-06T10:39:00.4695054Z","parentProcessId":884,"parentProcessCreationTime":"2023-04-06T10:38:58.4494255Z","parentProcessFileName":"cmd.exe","parentProcessFilePath":"C:\\Windows\\System32","ipAddress":null,"url":null,"registryKey":null,"registryHive":null,"registryValueType":null,"registryValue":null,"registryValueName":null,"accountName":"Administrator","domainName":"WIN-TFB8L7BI77H","userSid":"S-1-5-21-3669279935-616031708-4259075843-500","aadUserId":null,"userPrincipalName":null,"detectionStatus":"Detected"},{"entityType":"User","evidenceCreationTime":"2023-04-06T10:41:43.81Z","sha1":null,"sha256":null,"fileName":null,"filePath":null,"processId":null,"processCommandLine":null,"processCreationTime":null,"parentProcessId":null,"parentProcessCreationTime":null,"parentProcessFileName":null,"parentProcessFilePath":null,"ipAddress":null,"url":null,"registryKey":null,"registryHive":null,"registryValueType":null,"registryValue":null,"registryValueName":null,"accountName":"Administrator","domainName":"WIN-TFB8L7BI77H","userSid":"S-1-5-21-3669279935-616031708-4259075843-500","aadUserId":null,"userPrincipalName":null,"detectionStatus":null},{"entityType":"Ip","evidenceCreationTime":"2023-04-06T10:41:43.81Z","sha1":null,"sha256":null,"fileName":null,"filePath":null,"processId":null,"processCommandLine":null,"processCreationTime":null,"parentProcessId":null,"parentProcessCreationTime":null,"parentProcessFileName":null,"parentProcessFilePath":null,"ipAddress":"10.10.10.173","url":null,"registryKey":null,"registryHive":null,"registryValueType":null,"registryValue":null,"registryValueName":null,"accountName":null,"domainName":null,"userSid":null,"aadUserId":null,"userPrincipalName":null,"detectionStatus":null},{"entityType":"Process","evidenceCreationTime":"2023-04-06T10:41:43.81Z","sha1":"6cbce4a295c163791b60fc23d285e6d84f28ee4c","sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","fileName":"powershell.exe","filePath":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","processId":10748,"processCommandLine":"powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= silentlycontinue;(New-Object System.Net.WebClient).DownloadFile(http://127.0.0.1/1.exe, C:\\test-WDATP-test\\invoice.exe);Start-Process C:\\test-WDATP-test\\invoice.exe","processCreationTime":"2023-04-06T10:39:14.8653703Z","parentProcessId":10644,"parentProcessCreationTime":"2023-04-06T10:39:11.5147433Z","parentProcessFileName":"cmd.exe","parentProcessFilePath":"C:\\Windows\\System32","ipAddress":null,"url":null,"registryKey":null,"registryHive":null,"registryValueType":null,"registryValue":null,"registryValueName":null,"accountName":"Administrator","domainName":"WIN-TFB8L7BI77H","userSid":"S-1-5-21-3669279935-616031708-4259075843-500","aadUserId":null,"userPrincipalName":null,"detectionStatus":"Detected"}],"domains":[]}

Microsoft Defender for Endpoint logging

Microsoft Defender for Endpoint utilizes the Microsoft Defender for Endpoint input that ingests alert logs in JSON format (as shown above). For information on the configuration of this input, refer to Microsoft Defender for Endpoint Input.

Please note that Illuminate processes nested arrays in a specific manner. For each evidence entityType (Process, User, IP, File, URL), Illuminate will only process one result per entityType. However, you can still access additional results in the evidence_array and GIM-specific fields (such as user_name, file_name, file_path, etc.).

What is provided

  • Rules to normalize and enrich Microsoft Defender for Endpoint log messages.

Microsoft Defender for Endpoint log message processing

The Illuminate processing of Microsoft Defender for Endpoint log messages provides the following:

  • Field extraction, normalization and message enrichment for Microsoft Defender for Endpoint log messages

  • GIM Categorization of the following messages:

Log type

GIM category

GIM subcategory

alerts

alerts

alert.default

Microsoft Defender for Endpoint Spotlight content pack

The Spotlight content pack provides an Overview dashboard and an User Alert Viewer saved search.

Microsoft DHCP content pack

DHCP is a network protocol used to assign IP addresses and other network configuration parameters dynamically to devices on a network. Microsoft provides DHCP server software as a component of its Windows Server operating system.

The Microsoft DHCP server is designed to manage the automatic assignment of IP addresses to client devices on a network, reducing the need for manual configuration of each device and helping to ensure a consistent and correct IP addressing scheme. The DHCP server can be managed through the Microsoft management console, making it easy to administer and configure.

This technology pack provides processing for Microsoft DHCP server event logs collected with the filebeat agent.

Supported versions

  • Windows 2016, 2019, and 2022.

Requirements

  • Windows DHCP server

  • Configure Filebeat to send Microsoft DHCP server logs to the Security Data Lake Beats input via the Bitdefender Forwarder.

Log collection

The DHCP activity log can be read in a text-based editor and is stored in the C:\Windows\System32\DHCP folder. A log is created for each day of the week and named.

Filebeat setup

Filebeat is a lightweight log shipper that can be used to send logs from a Windows server to a remote logging system like Security Data Lake.

1. Install Filebeat

Download and install Filebeat for Windows from elastic.co. Choose the required version and download the ZIP file. For installation instructions, refer to the official documentation.

2. Create a Beats input in Security Data Lake

For information on input creation and configuration, refer to Beats Input.

3. Configure Filebeat

Configure Filebeat to collect DHCP logs. Edit the Filebeat configuration file (filebeat.yml) to specify the location of the DHCP logs and any other desired settings. In this file, you must also specify the output for Filebeat to send the logs to.

In the example below, under paths, we added this line to fetch all the files in the folder:

C:\Windows\System32\dhcp\*

The fields portion is mandatory, as this is the field that Security Data Lake will focus on to direct the logs into the correct stream.

We have provided a sample filebeat.yml file that will send logs from your DHCP server via the Bitdefender forwarder, allowing them to be fully imported and parsed. The sample shows the minimum required sections for a .yml file running DHCP. You may choose to add to the file but both sections (inputs and output) must be present.

# ============================== Filebeat inputs ===============================
            filebeat.inputs:
            # Each - is an input. Most options can be set at the input level, so
            # you can use different inputs for various configurations.
            # Below are the input specific configurations.
            # filestream is an input for collecting log messages from files.
            - type: filestream
            
              # Unique ID among all inputs, an ID is required.
              id: <my-filestream-id>
              
              # Change to true to enable this input configuration.
              enabled: true
              
              # Paths that should be crawled and fetched. Glob based paths.
              paths:
                - C:\Windows\System32\dhcp\*
              
              # Set the event_source_product field to microsoftdhcp
              fields:
                 event_source_product: microsoft_dhcp 
              fields_under_root: true
            
        ○ Output.logstash
# ------------------------------ Logstash Output -------------------------------
            output.logstash:
              # The host IP and beats input 
  hosts: ["<your_forwarder_ip>:5044"]

Starting Filebeat

Start Filebeat as a service on the Windows server to begin collecting and sending the DHCP logs. To do this, open a command prompt and enter the following command:

Start-Service filebeat

Once the service is running, enter this command to start sending logs:

.\filebeat.exe -c filebeat.yml

You should now see your logs being ingested into Security Data Lake and being successfully parsed.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Windows Event Log Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Windows Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

12,01/30/23,15:27:28,Release,192.168.1.11,DESKTOP-P423Q1J,C025A54DB363,,3451374721,0,,,,,,,,,0

What is provided

  • Parsing rules to normalize and enrich Microsoft DHCP log messages.

  • We support the following event IDs:

Event ID

Description

00

The log was started.

01

The log was stopped.

02

The log was temporarily paused due to low disk space.

10

A new IP address was leased to a client.

11

A lease was renewed by a client.

12

A lease was released by a client.

13

An IP address was found to be in use on the network.

14

A lease request could not be satisfied because the scope's address pool was exhausted.

15

A lease was denied.

16

A lease was deleted.

17

A lease was expired and DNS records for an expired leases have not been deleted.

18

A lease was expired, and DNS records were deleted.

20

A BOOTP address was leased to a client.

21

A dynamic BOOTP address was leased to a client.

22

A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.

23

A BOOTP IP address was deleted after checking to see it was not in use.

24

IP address cleanup operation has begun.

25

IP address cleanup statistics.

30

DNS update request to the named DNS server.

31

DNS update failed.

32

DNS update successful.

33

Packet dropped due to NAP policy.

34

DNS update request failed as the DNS update request queue limit exceeded.

35

DNS update request failed.

36

Packet dropped because the server is in failover standby role or the hash of the client ID does not match.

50+

Codes above 50 are used for Rogue Server Detection information.

Events processed by this technology Pack

The Microsoft DHCP content pack supports DHCP leasing events, parsing for all fields, and GIM categorization for the lease events: Release, Renew, and Assign.

Microsoft IIS content pack

Microsoft Internet Information Services (IIS) is a flexible, secure, and manageable web server developed by Microsoft for hosting websites, web applications, and services on Windows. It supports HTTP, HTTPS, FTP, FTPS, and more, and integrates tightly with ASP.NET, Windows authentication, and the broader Windows Server ecosystem.

Supported/tested versions

  • Microsoft IIS 10, W3C log format

  • Microsoft IIS 8, W3C log format

Note

This pack supports two formats for access logs: default W3C fields and all W3C fields in the default order. Custom formats are not supported.

Stream configuration

This technology pack includes 1 stream:

  • "Illuminate:Microsoft IIS Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • "Microsoft IIS Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

This pack parses logs from the following sources:

  • Filebeat

Filebeat configuration

  1. For information on setting up Bitdefender Sidecar for Filebeat, refer to Sidecars.

  2. Create a Beats input in Security Data Lake and ensure that Do not add Beats type as prefix is not selected. For details, refer to Beats Input.

  3. Create an API access token. For details, refer to Installing Sidecar (section 1.2, Create an API token).

  4. Configure a custom Windows Filebeat collector. For details, refer to Sidecar collectors.

  5. To configure the collector for shipping messages to Security Data Lake, select the right path and ensure that the Filebeat input adds the event_source_product field, with a value of microsoft_iis, for the parser to identify the log source as Microsoft IIS.

  6. You must set the fields_under_root option to true for message identification to work, as shown in the following example:

    filebeat.inputs:
                    - type: log
                    enabled: true
                    paths:
                    - C:\inetpub\logs\LogFiles\W3SVC1\*.log
                    fields:
                    event_source_product: microsoft_iis
                    fields_under_root: true

  7. Adjust the file path in the configuration file if needed. To also collect HTTPERR logs, add a second path entry: C:\Windows\System32\LogFiles\HTTPERR\httperr*.log.

  8. Install Bitdefender Sidecar on the client host.

  9. Edit the Bitdefender Sidecar client configuration with your Security Data Lake API URL and API access token.

Log format example

These are example logs for Microsoft IIS in the W3C log format.

W3C - default logs

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2025-07-22 16:04:35 ::1 GET / - 80 - ::1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/122.0.0.0+Safari/537.36+Edg/122.0.0.0 - 200 0 0 1127
2025-07-22 16:04:35 ::1 GET /iisstart.png - 80 - ::1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/122.0.0.0+Safari/537.36+Edg/122.0.0.0 http://localhost/ 200 0 0 14
2025-07-22 16:04:35 ::1 GET /favicon.ico - 80 - ::1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/122.0.0.0+Safari/537.36+Edg/122.0.0.0 http://localhost/ 404 0 2 7

W3C - all fields selected

#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2025-07-22 17:08:10 W3SVC1 WIN-I4KO2719DL6 ::1 GET / - 80 - ::1 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/122.0.0.0+Safari/537.36+Edg/122.0.0.0 - - localhost 304 0 0 166 780 86

What is provided

  • Rules to parse, normalize, and enrich Microsoft IIS messages.

  • GIM categorization for W3C access logs and HTTPERR logs as 180200 (http communication) with GIM enforcement fields.

  • HTTPERR (HTTP.sys error) log parsing with source/destination IP and port, HTTP method/path/version, response code, and reason phrase extraction.

Events processed by this technology pack

The content pack supports the following log types.

  • W3C Access logs

  • HTTPERR (HTTP.sys error) logs

Generic processing will be provided for log types not listed above.

GIM categorization

GIM categorization is provided for the following messages:

Message type

gim_event_type_code

gim_event_category

gim_event_class

gim_event_subcategory

gim_event_type

Access Logs

180200

http

protocol

http.communication

http communication

HTTPERR Logs

180200

http

protocol

http.communication

http communication

Message fields included in this pack

General parsing for the default W3C format

Common Fields

Field name

Example value

Field type

Description

event_created

2025-07-22 17:08:10

date

Date and Time of the event created

source_ip

::1

string

Source IP address

http_request_method

GET

string

HTTP method used

http_request_path

/

string

Requested URI path

http_uri_query

-

string

Query string parameters

destination_port

80

long

Port on destination

user_name

-

string

Authenticated user name

destination_ip

::1

string

Destination IP address

http_user_agent

Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/122.0.0.0+Safari/537.36+Edg/122.0.0.0

string

Client user agent

http_referrer

-

string

HTTP referrer header

http_response_code

200

long

HTTP status code

http_sub_status

10

long

HTTP substatus code

http_win32_status

20

long

Win32 status code

http_response_time

1127

long

Time taken to serve request

Extended W3C field format

Fields

Field name

Example value

Field type

Description

event_created

2025-07-22 17:08:10

date

Date and Time of the event created

destination_sitename

W3SVC1

string

Web server site name

destination_hostname

WIN-I4KO2719DL6

string

Web server hostname

source_ip

::1

string

Source IP address

http_request_method

GET

string

HTTP method used

http_request_path

/

string

Requested path

http_uri_query

-

string

Query string parameters

destination_port

80

long

Port on destination host

user_name

-

string

Authenticated user name

destination_ip

::1

string

IP of destination

http_version

HTTP/1.1

string

HTTP protocol version

http_user_agent

Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/122.0.0.0+Safari/537.36+Edg/122.0.0.0

string

Client user agent

http_cookie

-

string

HTTP cookie header

http_referrer

-

string

Referrer URL

http_host

localhost

string

Target host

http_response_code

304

long

HTTP status code

http_sub_status

0

long

HTTP substatus code

http_win32_status

0

long

Win32 status code

destination_bytes_sent

166

long

Bytes sent to client

source_bytes_sent

780

long

Bytes received from client

http_response_time

86

long

Request duration in ms

Microsoft IIS Spotlight content pack

This Spotlight offers a dashboard with an Overview tab.

Microsoft Office 365 content pack

Microsoft Office 365 provides cloud-based office apps like Word, Excel, and others. Office 365 Spotlight for Illuminate works with the Office 365 Log Events Enterprise Plugin to process Microsoft Office 365 logs by providing normalization and enrichment of common events. The Spotlight comes ready to use with several pre-built dashboard views, including Office 365 Overview and tabs for Exchange, Azure Active Directory, and other Office 365 applications.

Supported versions

  • Current version of Office 365 as supported by Microsoft and the Office 365 Log Events Enterprise Plugin.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:O365 Messages"

If this stream name is already defined, then nothing will be changed. If this stream name does not exist, then it will be created.

Index set configuration

This technology pack includes one index set definition:

  • "Microsoft Office365 Event Log Messages"

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

{"CreationTime":"2021-10-03T00:14:46","Id":"bee3fdad-4243-8f3b-f234-15c294843741","Operation":"SearchMtpStatus","OrganizationId":"bee3fdad-4243-8f3b-f234-15c294843742","RecordType":52,"UserKey":"NOT-FOUND","UserType":5,"Version":1,"Workload":"SecurityComplianceCenter","UserId":"NOT-FOUND","AadAppId":"bee3fdad-4243-8f3b-f234-15c294843740","DataType":"MtpStatus","DatabaseType":"DataInsights","RelativeUrl":"/DataInsights/DataInsightsService.svc/Find/MtpStatus?tenantid=bee3fdad-4243-8f3b-f234-15c294843743","ResultCount":"1"}

Requirements

  • A configured Azure / Office 365 tenant and API keys.

  • A configured Microsoft Office 365 input. For information on input creation and configuration, refer to Microsoft Office 365 Input.

What is provided

  • Parsing rules to extract Office 365 logs into Security Data Lake schema-compatible fields

  • Dashboards

  • Data lookup tables to assist in normalizing Office 365 log messages into the Security Data Lake schema

Mimecast content pack

Mimecast is a cloud-based cyber security provider specializing in email security and offering protection against phishing, malware, spam, and data leaks. It also delivers services for archiving, continuity, and threat intelligence, to help organizations secure their communications and ensure compliance.

Supported versions

  • Mimecast API 2.0

Stream configuration

This technology pack includes 1 stream:

  • "Illuminate:Mimecast Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • "Mimecast Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

Log collection uses the Mimecast input, which ingests multiple Mimecast content types in JSON format. For information on how to create and configure the input, refer to Mimecast Input.

Log format example

This is a generic log representing the typical JSON format of Mimecast logs.

General Logs

{"id":"eNoVzt0KgjAAQOF32e0EdWrNoIvZn6UGYZKKNzqHWaai2y4Wv","auditType":"User Logged On","user":"user@domain.com","eventTime":"2025-06-12T14:53:56+0000","eventInfo":"Successful authentication for user@domain.com <Domain User>, Date: 2025-06-12, Time: 16:53:56 SAST, IP: 192.168.100.100, Application: SMTP-MTA2, Method: Cloud","category":"authentication_logs"}

What is provided

  • Rules to parse, normalize, and enrich Mimecast content pack messages.

  • A dashboard displaying events and statistics of interest.

  • Saved search highlighting key information using a user_email parameter.

Events processed by this technology pack

The content pack supports the following log types.

  • User Logged On

  • Unauthorized API Request

  • Case Action

  • Review Set Action

  • Discovery Case Adjustments

  • Logon Authentication Failed

  • Logon Requires Challenge

  • Completed Directory Sync

  • New Policy

  • Existing Policy Changed

  • Mimecast Support Login

  • Content Definition Adjustments

  • Existing Route Changed

  • New Delivery Route

  • Profile Group (Address) Log Entry

  • Account Updated

  • API Application Created

  • User Password Changed

  • User Settings Updated

  • User Locked

Generic processing will be provided for log types not listed above.

GIM categorization

GIM categorization is provided for the following messages:

Log type

GIM category

GIM subcategory

GIM event type code

User Locked

iam

iam.object disable

111500

User Settings Updated

iam

iam.object modify

111000

User Password Changed

iam

iam.object modify

111004

Message fields included in this pack

Fields of note

Field name

Example value

Field type

Description

application_name

SMTP-MTA2

keyword

Application extracted from 'Application' reference from .eventInfo in JSON body

destination_ip

8.8.8.8

ip

Destination IP associated with the event pulled from 'Remote IP' from .eventInfo in JSON body

destination_port

25

long

Destination port extracted from .eventInfo in JSON body

email_from

person@domain

keyword

Extracted from .from in JSON body

email_subject

Test Message

keyword

Extracted from .subject in JSON body

email_to

another_person@domain.com

keyword

Extracted from .to in JSON body

event_created

2025-06-13T14:30:03+0000

date

Timestamp extracted from .eventTime or .viewed in JSON body

event_source

JvuS6F0rQmdeSSqcrF8xSAA1BFbYC1Lqkk1A5

keyword

The client_id set in the Mimecast v2 input

event_source_product

mimecast_v2

keyword

Created via input. This will always be the same.

event_uid

JvuVUt30eqQpG3S6F0rQmdeSSqc

keyword

Extracted from .id in the JSON body.

source_ip

192.168.1.100

ip

Source IP that generated the activity. Extracted from 'IP' from .eventInfo in JSON body

user_domain

example.com

keyword

Extracted domain from user related e-mail's in JSON body

user_email

person@domain.com

keyword

Extracted user e-mail from JSON body

user_email_display_name

Random Person

keyword

The display name extracted from .eventInfo in JSON body

user_name

person

keyword

Multi-value field containing all user_name references in full JSON body

vendor_email_content_viewed_flag

false

keyword

Extracted from .contentViewed in JSON body

vendor_email_date

2025-05-30T10:10:32+0000

date

Extracted from .messageDate in JSON body

vendor_email_discovery_case_flag

true

keyword

Extracted from discoverCase in JSON body

vendor_event_action

Successful Authentication

keyword

Vendor's event action reference extracted from .eventInfo in JSON body

vendor_event_category

authentication_logs

keyword

Extracted from .category in JSON body

vendor_event_message

Successful authentication for person@domain.com <SMTP Account>, Date: 2025-06-13, Time: 16:30:03 SAST, IP: 192.168.1.1, Application: SMTP-MTA2, Method: Cloud

keyword

Full .eventInfo from JSON body

vendor_event_method

Cloud

keyword

Extracted from 'Method' reference from .eventInfo in JSON body

vendor_event_type

User Logged On

keyword

Event type extracted from .auditType in JSON body

vendor_subtype

audit_events

keyword

Created via input and associated configuration

Mimecast Spotlight content pack

This spotlight offers a dashboard with an Overview tab and a saved search tied to the user_name parameter.

NetFlow content pack

NetFlow is a network protocol that collects and monitors IP traffic flow data, providing insights into network usage, security threats, and performance. It helps analyze traffic patterns, detect anomalies, and troubleshoot network issues by capturing details such as source/destination IPs, ports, protocols, and bandwidth usage.

Requirements

  • NetFlowV5, NetFlowV9, IPFIX

Stream configuration

This technology pack includes one stream:

  • “Illuminate:NetFlow Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “NetFlow Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

Log collection uses the NetFlow input, which ingests multiple NetFlow product type logs in JSON format. For information on input creation and configuration, refer to NetFlow Input.

Log format example

NetFlowV5 [192.168.81.254]:67 <> [192.168.81.134]:68 proto:17 pkts:1 bytes:328

What is provided

  • Rules to normalize and enrich NetFlow log messages.

NetFlow log message processing

The Illuminate processing of NetFlow log messages provides the following:

  • Field extraction, normalization, and message enrichment for NetFlow log messages.

  • GIM Categorization of the following messages:

NetFlow logtype

GIM category

GIM subcategory

filter

network

network.flow

NetFlow Overview Spotlight

The Illuminate Core Network Overview spotlight can be used to view NetFlow data.

NGINX content pack

NGINX is an HTTP server that runs on Linux systems. It was originally written by Igor Sysoev and publicly released in 2004.

This pack parses and configures NGINX access logs and error logs. The default log location is: /var/log/nginx/.

Requirements

  • This pack will work with all versions of NGINX, as long as the combined log format is used.

  • Log folders must be named access.log.

  • Either Filebeat (with Sidecar) or rsyslog are required for delivering logs.

What is provided

This pack includes parsing rules that convert Nginx logs into Security Data Lake schema-compatible fields. Nginx access logs get the GIM code 180200.

Input via Filebeat together with Bitdefender Sidecar

To configure your Security Data Lake server and your client(s), refer to the Sidecar documentation.

You will need to take the following steps:

  1. Create a Beats input.

  2. Create a Security Data Lake REST API token and save it.

  3. Install Bitdefender Sidecar.

  4. Add your client(s), e.g. web server.

Security Data Lake settings

  1. Create a Beats input in Security Data Lake. For information on how to create and configure this Bitdefender Forwarder input, refer to Beats input.

  2. Create a Security Data Lake REST API access token and save it. For details, refer to Installing Sidecar (Section 1.2, Create an API token).

  3. Create a (Linux) filebeat configuration under System > Sidercars > Configuration with a filebeat on Linux collector.

  4. Configure the file and add:

    • The correct IP under hosts.

      Important

      You must enter the IP of the Bitdefender Forwarder and the port that you defined in the Beats input profile.

    • The log source configured to the desired value and an event_source_product field with an NGINX-web value.

      filebeat.inputs:
- input_type: log
  paths:
    - /var/log/nginx/access.log
    - /var/log/nginx/error.log
  type: filestream
  fields_under_root: true
  fields:
    event_source_product: nginx-web

      Important

      There must be two spaces in front of event_source_product and - /var....

  5. Save the configuration to complete setup.

Configure a client with Filebeat and Bitdefender Sidecar

  1. Install, enable and verify Bitdefender Sidecar on the remote machine. For details, refer to  Installing Sidecar.

  2. Install Filebeat according to the instructions in the official documentation. Alternatively, you can download and install the OSS-only version of Filebeat.

    • If you install Filebeat manually, use /etc/filebeat as the installation directory.

    • If you install Filebeat via apt-get, then the correct directory is automatically selected.

    Example commands for Ubuntu:

    wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/oss-8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list
sudo apt-get update && sudo apt-get install filebeat
sudo systemctl enable filebeat
sudo systemctl start filebeat
sudo systemctl status filebeat

  3. (Optional) Edit the filebeat.yml file as needed. You can do this via the Sidecar configuration in the Security Data Lake interface.

  4. Start the daemon. If there is a permission issue, you can resolve it by running the following command:

    sudo chown root filebeat.yml

  5. (recommended) Configure Filebeat to start automatically after reboot.

  6. In Security Data Lake, assign a configuration to the machine where Sidecar is installed. You can do this from System > Sidecars > Administration.

Requirements for input via rsyslog

  • A configured Syslog UDP or Syslog TCP input under the forwarder input profile.

  • Installation of rsyslog according to the instructions in the official documentation.

  • A configured rsyslog.conf file.

    The following configuration example is for a UDP input on IP 192.168.122.40, port 1544. Add this snippet under the MODULES section of the file:

    # provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 1544
*.* @192.168.122.40:1544;RSYSLOG_SyslogProtocol23Format

  • Add the following configuration snippet at the end of the rsyslog.conf file or save it as a separate configuration file:

    module(load="imfile" PollingInterval="10" statefile.directory="/var/spool/rsyslog")
input(type="imfile"
      File="/var/log/nginx/access.log"
      Tag="nginx_web_http_access"
      Severity="info"
      Facility="local6")
input(type="imfile"
      File="/var/log/nginx/error.log"
      Tag="nginx_web_http_error"
      Severity="info"
      Facility="local6")
local6.access        @192.168.122.40:1544

    Warning

    • This configuration is for UDP. UDP is not a reliable protocol, so consider if TCP is a better option for your organization.

    • After installing rsyslog, there might be active default rules (e.g. 50-default.conf) that log system, kernel, and other logs. Deactivate them if not needed.

    Use this command to restart the service on Ubuntu:

    sudo systemctl restart rsyslog

    You can check the status by issuing the following command:

    sudo systemctl status rsyslog

    Note that red lines may indicate problems. Sometimes, a full reboot of the system is needed.

Tested rsyslog version

8.2212.0

Stream configuration

This technology pack includes one stream:

"Illuminate:Nginx_web Messages"

If this stream name is already defined, then nothing will be changed. If this stream name does not exist, then it will be created.

Index set configuration:

This technology pack includes one index set definition:

"NGINX_web Logs"

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format examples

Access Logs version 1.18
127.0.0.1 - - [04/Mar/2023:19:25:07 -0600] "GET / HTTP/1.1" 200 3543 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0"

Access Logs version 1.24
127.0.0.1 - - [13/Sep/2023:08:34:54 -0500] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0" "-"

Error Logs:
2023/03/05 09:34:46 [emerg] 2032#2032: no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:21

2023/01/05 11:50:44 [error] 22053#0: *3 open() "/usr/local/stefan/nginx/1.10.2_1/html/stest" failed

Note

These are default fields or values found in the combined log format. Logs with custom fields, formats or ordering may be problematic.

NGINX Spotlight content pack

The NGINX content pack provides an Overview dashboard.

Okta content pack

Okta is a cloud-based identity management service that provides access to a wide range of applications like Amazon, Google, box, Office 365, and others. This technology pack will process Okta logs, providing normalization and enrichment of common events of interest.

Supported versions

  • This version of the Okta Spotlight was tested with Okta API version 2021.04.1

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Okta Messages"

If this stream name is already defined, then nothing will be changed. If this stream name does not exist, then it will be created.

Index set configuration

This technology pack includes one index set definition:

  • "Okta System Logs"

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

{"actor":{"id":"00uznmiqsr1UIPqr90h9","type":"User","alternateId":"test.user@example.com","displayName":"Test User","detailEntry":null},"client":{"userAgent":{"rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36","os":"Windows 10","browser":"CHROME"},"zone":"null","device":"Computer","id":null,"ipAddress":"10.10.84.54","geographicalContext":{"city":"Dallas","state":"Mississippi","country":"United States","postalCode":"90210","geolocation":{"lat":40.969,"lon":-106.6034}}},"device":null,"authenticationContext":{"authenticationProvider":null,"credentialProvider":null,"credentialType":null,"issuer":null,"interface":null,"authenticationStep":0,"externalSessionId":"00uznmiqsr1UIPqr90h9"},"displayMessage":"User login to Okta","eventType":"user.session.start","outcome":{"result":"SUCCESS","reason":null},"published":"2021-10-18T20:49:24.126Z","securityContext":{"asNumber":null,"asOrg":null,"isp":null,"domain":null,"isProxy":null},"severity":"INFO","debugContext":{"debugData":{"requestId":"YW3d0-2p3-1iwOeHylXaAVXRCcE","origin":"https://test.example.net","requestUri":"/api/v0/authx","threatSuspected":"false","url":"/api/v0/authx?"}},"legacyEventType":"core.user_auth.login_success","transaction":{"type":"WEB","id":"YW3d0-2p3-1iwOeHylXaAVXRCcE","detail":{}},"uuid":"e05d81bb-3054-837b-11ec-9bf29b682db0","version":"0","request":{"ipChain":[{"ip":"10.10.84.54","geographicalContext":{"city":"Lakeside","state":"Omaha","country":"United States","postalCode":"90210","geolocation":{"lat":33.696,"lon":-104.0346}},"version":"V4","source":null}]},"target":null}

Requirements

  • A configured Okta Developer, Preview, or Custom Domain organization

  • A user account in the Okta organization, with Report Administrator and Organization Administrator or higher permissions. For more information on Okta administrator roles, refer to the official documentation.

  • An Okta API token. For details, refer to Create an Okta token below.

  • A configured Okta Log Events input. For details, refer to Okta Log Events Input.

Create an Okta token

Okta API tokens have the same permissions as the user who creates them. If the user permissions change, the API token permissions also change. Consider creating a dedicated service account when creating an API token, to limit the access level associated with the token.

Create the API token

  1. Log in to the Okta website using an Okta account that has been granted Report Administrator and Organization Administrator permissions (or higher) for the target Okta organization.

    1. The Report Administrator role grants read-only access to reports and to the Okta System Log.

    2. The Organization Administrator role is required to create the API key. This permission should be removed from the Okta account once setup is complete.

  2. Navigate to the Okta Admin page.

  3. Access the API page:

    1. If using the Developer Console, select Tokens from the API menu.

    2. If using the Administrator Console (Classic UI), select API from the Security menu, and then select Tokens.

  4. Click Create Token.

  5. Name the token and click Create Token.

    1. IMPORTANT: Record the token value and store it in a secure location. This is the only opportunity to see and record it.

    2. OPTIONAL: It is recommended to remove any Okta Administrator roles other than Report Administrator from the account to be used for API access to system logs. This step limits use of the API key to read-only access, to reduce the potential for misuse.

For more information on Okta API tokens, refer to the official documentation.

What Is provided

  • Parsing rules to extract Okta logs into Security Data Lake schema compatible fields.

  • Data lookup tables to assist in normalizing Okta log messages into the Security Data Lake schema

  • Dashboards

Packetbeat content pack

Packetbeat is an open-source network packet analyzer that captures and analyzes network traffic in real time. It provides insights into application performance, network latency, and security threats, by monitoring communication between servers and applications. Packetbeat is designed to be lightweight and easy to deploy, making it a valuable tool for network monitoring and troubleshooting.

This technology pack will process Packetbeat logs, providing normalization and enrichment of those events.

Supported versions

  • Packetbeat 8.12.2

Requirements

  • Packetbeat 8.12.2

  • A configured Beats input in Security Data Lake. For details, refer to Beats Input.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Packetbeat Messages"

Note

If this stream does not exist prior to the activation of this pack, then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Packetbeat Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

Logs are sent via the Bitdefender Forwarder and Beats input.

Packetbeat configuration example

To successfully ship logs to Security Data Lake, make sure you add the IP address of your Bitdefender Forwarder in your packetbeat.yml file.

For example:

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["<forwarder_ip>:5044"]

Log format example

{"timestamp":1707945509.782,"version":"1.1","host":"ip-172-31-71-138.ec2.internal","short_message":"-","_packetbeat_host_os_version":"2","_packetbeat_method":"QUERY","_packetbeat_related_ip":"[172.31.71.138, 172.31.0.2, 3.218.180.17]","_packetbeat_type":"dns","_packetbeat_cloud_instance_id":"i-01cd7cd147686ddca","_packetbeat_event_type":"[connection, protocol]","_packetbeat_query":"class IN, type A, dynamodb.us-east-1.amazonaws.com","_packetbeat_dns_question_etld_plus_one":"dynamodb.us-east-1.amazonaws.com","_packetbeat_dns_answers_count":1,"_packetbeat_host_containerized":"false","_packetbeat_dns_flags_authentic_data":"false","_packetbeat_destination_ip":"172.31.0.2","_packetbeat_dns_flags_truncated_response":"false","_packetbeat_host_os_kernel":"5.10.209-198.812.amzn2.x86_64","_packetbeat_event_end":"2024-02-14T21:18:29.784Z","_packetbeat_@metadata_beat":"packetbeat","_packetbeat_agent_name":"ip-172-31-71-138.ec2.internal","_packetbeat_dns_flags_authoritative":"false","_packetbeat_status":"OK","_packetbeat_agent_version":"8.12.1","_packetbeat_dns_answers_0_name":"dynamodb.us-east-1.amazonaws.com","_packetbeat_dns_flags_recursion_desired":"true","_packetbeat_network_type":"ipv4","_packetbeat_dns_authorities_count":0,"_packetbeat_dn_header_flags":"[RD, RA]","_packetbeat_resource":"dynamodb.us-east-1.amazonaws.com","_packetbeat_server_ip":"172.31.0.2","_packetbeat_@timestamp":"2024-02-14T21:18:29.782Z","_packetbeat_agent_ephemeral_id":"1a6a4861-3672-4794-ad48-fa7f6ce9e17c","_packetbeat_cloud_provider":"aws","_packetbeat_event_start":"2024-02-14T21:18:29.782Z","_packetbeat_host_os_codename":"Karoo","_packetbeat_dns_answers_0_ttl":"4","_packetbeat_host_mac":"[06-FB-50-7E-81-B1]","_packetbeat_dns_question_type":"A","_packetbeat_server_port":53,"_packetbeat_destination_port":53,"_packetbeat_client_bytes":50,"_packetbeat_event_category":"[network]","_packetbeat_dns_id":2180,"_packetbeat_dns_question_registered_domain":"dynamodb.us-east-1.amazonaws.com","_packetbeat_dns_resolved_ip":"[3.218.180.17]","_packetbeat_destination_bytes":66,"_packetbeat_host_os_platform":"amzn","_packetbeat_network_community_id":"1:n2oEH592UySL71Gm21GwZS2Jiwo=","_packetbeat_network_bytes":116,"_packetbeat_dns_answers_0_data":"3.218.180.17","_packetbeat_source_ip":"172.31.71.138","_packetbeat_cloud_availability_zone":"us-east-1e","_packetbeat_dns_flags_recursion_available":"true","_packetbeat_host_os_type":"linux","_packetbeat_dns_question_name":"dynamodb.us-east-1.amazonaws.com","_packetbeatdns_question_top_level_domain":"us-east-1.amazonaws.com","_packetbeat_ecs_version":"8.0.0","_packetbeat_host_name":"ip-172-31-71-138.ec2.internal","_packetbeat_dns_additionals_count":0,"_packetbeat_dns_answers_0_type":"A","_packetbeat_network_direction":"egress","_packetbeat_cloud_machine_type":"t2.micro","_packetbeat_host_ip":"[172.31.71.138, fe80::4fb:50ff:fe7e:81b1]","_packetbeat_cloud_region":"us-east-1","_packetbeat_network_transport":"udp","_packetbeat_dns_response_code":"NOERROR","_packetbeat_client_ip":"172.31.71.138","_packetbeat_cloud_account_id":"335344888946","_packetbeat_agent_id":"0d245eab-3205-4f95-8b23-2878569f4dbd","_packetbeat_event_kind":"event","_packetbeat_dns_question_class":"IN","_packetbeat_dns_answers_0_class":"IN","_packetbeat_host_id":"0e7b0d07010a489ba9e1a74d38cc23de","_packetbeat_source_port":46704,"_packetbeat_client_port":46704,"_packetbeat_dns_type":"answer","_packetbeat_source_bytes":50,"_packetbeat_dns_op_code":"QUERY","_packetbeat_server_bytes":66,"_packetbeat_host_architecture":"x86_64","_packetbeat_network_protocol":"dns","_packetbeat_dns_flags_checking_disabled":"false","_packetbeat_host_os_name":"Amazon Linux","_packetbeat_@metadata_type":"_doc","_packetbeat_agent_type":"packetbeat","_packetbeat_cloud_service_name":"EC2","_packetbeat_event_dataset":"dns","_packetbeat_event_duration":1717000,"_packetbeat_host_os_family":"redhat","_packetbeat_@metadata_version":"8.12.1","_packetbeat_host_hostname":"ip-172-31-71-138.ec2.internal","_packetbeat_cloud_image_id":"ami-0aa7d40eeae50c9a9"}

What is provided

  • We provide parsing rules to normalize and enrich Packetbeat log messages.

  • We provide categorization for the following log types:

    • DNS

    • HTTP

    • Flow

Events processed by this technology pack

The Packetbeat content pack supports parsing for all fields and GIM categorization for DNS, flow, and HTTP events.

Packetbeat Spotlight content pack

Packetbeat offers a dashboard with three tabs: an Overview tab, a Network Flows tab, and an HTTP Overview tab.

Palo Alto 9.x content pack

Palo Alto is a next-generation firewall that provides real-time (line-rate, low-latency) content scanning to protect users against malicious attacks that include viruses, spyware, data leakage, and application vulnerabilities based on a stream-based threat prevention engine. This technology pack will process Palo Alto logs, providing normalization and enrichment of common events of interest.

Supported versions

  • Version 9.1

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Palo Alto Messages"

Index set configuration

This technology pack includes one index set definition:

  • "Palo Alto Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Requirements

  • Supported Palo Alto device sending logs to the Palo Alto Networks TCP (PAN-OS v9) input. For input creation and configuration information, refer to Palo Alto Networks Input.

What is provided

  • Parsing rules to extract Palo Alto logs into Security Data Lake schema-compatible fields

  • Security Data Lake Information Model message categorization

  • Illuminate Spotlight

Palo Alto 11.x content pack

Palo Alto is a next-generation firewall that provides real-time (line-rate, low-latency) content scanning to protect users against malicious attacks that include viruses, spyware, data leakage, and application vulnerabilities. Palo Alto is based on a stream-based threat prevention engine. This technology pack will process Palo Alto logs, providing normalization and enrichment of common events of interest.

Supported versions

  • PAN-OS 11.1+

Requirements

  • Palo Alto device sending logs to the Palo Alto Networks TCP (PAN-OS v11+) input. For input creation and configuration information, refer to Palo Alto Networks Input.

Important

Palo Alto devices should be configured to send data without custom formats.

Stream configuration

This technology pack includes 1 stream:

  • "Illuminate:Palo Alto Messages"

If you were previously using the Palo Alto 9.x pack with Illuminate, this pack will use the same stream.

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • "Palo Alto Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

Palo Alto Device Logging Configuration

Configure your device according to the instructions in the Palo Alto logging guide, using TCP as the transport and BSD as the format.

Log processing

The Illuminate pack for Palo Alto 11.x will rename some fields common to all Palo Alto logs but primarily processes the following log types:

  • Config

  • Decryption

  • GlobalProtect

  • HIP Match

  • System

  • Threat

  • Traffic

  • User-ID

Palo Alto logs and CSV processing

Illuminate processes Palo Alto logs in CSV format. A common issue arises when newer versions of PAN-OS introduce additional fields. To handle these extra fields gracefully, this pack captures them in placeholder fields prefixed with additional_field_, followed by a letter corresponding to the field’s position. Letters a through x are used to represent these additional columns. These placeholders are temporary and will be replaced with properly labeled fields in a future release of the pack.

IP field processing

Palo Alto devices have distinct fields for device IPv4 and IPv6 addresses. When one of these values is not present, the corresponding field will log the value 0.0.0.0. Illuminate will reassign the IPv6 address to the appropriate IP field: source_ip, host_ip, or destination_ip.

If both IPv4 and IPv6 values are defined (i.e. not assigned the value 0.0.0.0), then no changes will be made to the field assignments.

Field normalization

The Illuminate pack for Palo Alto will normalize common fields from all logs. The following table lists the normalized common fields:

Config logs

Log format example

1,2024/10/04 03:46:00,,CONFIG,0,2816,2024/10/04 03:46:00,172.16.14.19,,commit,admin,Web,Submitted,,7421534605078953992,0x0,0,0,0,0,,PA-VM,0,,0,2024-10-04T03:46:00.050-07:00

Normalized fields

Decryption logs

Log format example

1,2024/11/28 04:39:15,007954000533467,DECRYPTION,0,2817,2024/11/28 04:39:15,172.16.16.11,198.51.100.20,172.16.14.28,198.51.100.20,LAN_WAN,,,web-browsing,vsys1,LAN_Zone,WAN_Zone,ethernet1/1,ethernet1/3,Licen_PA,2024/11/28 04:39:15,593,1,49984,443,12874,443,0x1400000,tcp,allow,N/A,,,,,b8b30cde-a128-468c-a1ca-69fc9cd04b22,Finished,Finished,TLS1.2,ECDHE,AES_256_GCM,SHA384,Test SSL Decryption,secp384r1,None,trusted,Trusted,Forward,01e3ae440d35ca7bc34,d8d8858803dacbb6b9002a070297eeaf0269380972364ba09e518ebe3676fa88,2024/11/12 16:00:00,2025/05/13 16:59:59,V3,2048,14,30,23,14,:::::RSA,login.live.com,DigiCert SHA2 Secure Server CA,DigiCert Global Root CA,login.live.com,,,,,,,,,2024-11-28T04:39:15.985-08:00,,,,,,,,,,,,,,,,,7442296184930041891,0x0,0,0,0,0,,PA-VM,1,internet-utility,general-internet,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,web-browsing,no,no,

Normalized fields

GlobalProtect logs

Log format example

1,2024/11/27 11:45:44,007954000533467,GLOBALPROTECT,0,2817,2024/11/27 11:45:44,vsys1,gateway-config-release,configuration,,,test,172.16.0.0-172.31.255.255,DESKTOP-FNV6TE0,172.16.14.19,0.0.0.0,192.168.40.1,0.0.0.0,23fd01a8-11d4-44cd-8be9-774d7e1b68a5,6ZVJD02,6.3.1,Windows,\"Microsoft Windows 10 Pro , 64-bit\",1,,,,success,,0,,0,Test GP GW,7441913159746584601,0x0,2024-11-27T11:45:46.019-08:00,,,,,,0,0,0,0,,PA-VM,1,

Normalized fields

HIP match logs

Log format example

1,2024/11/27 11:45:02,007954000533467,HIPMATCH,0,2817,2024/11/27 11:45:02,test,vsys1,DESKTOP-FNV6TE0,Windows,192.168.40.1,Test_HIP,1,object,,,7441913164041551873,0x0,0,0,0,0,,PA-VM,1,0.0.0.0,23fd01a8-11d4-44cd-8be9-774d7e1b68a5,6ZVJD02,,2024-11-27T11:45:03.231-08:00,

Normalized fields

System logs

Log format example

1,2024/10/08 12:04:25,,SYSTEM,general,2816,2024/10/08 12:04:25,,general,,0,0,general,informational,\"Connection to Update server: updates.paloaltonetworks.com completed successfully, initiated by 172.16.14.40\",7421534605078955497,0x0,0,0,0,0,,PA-VM,0,0,2024-10-08T12:04:25.668-07:00

Normalized fields

Threat logs

Log format example

1,2024/12/18 03:45:54,007954000533467,THREAT,virus,2817,2024/12/18 03:45:54,172.16.16.11,89.238.73.97,172.16.14.28,89.238.73.97,LAN_WAN,,,web-browsing,vsys1,LAN_Zone,WAN_Zone,ethernet1/1,ethernet1/3,Licen_PA,2024/12/18 03:45:54,307,1,49878,443,39152,443,0x1402000,tcp,reset-server,\"eicar.com\",Eicar Test File(100000),any,medium,server-to-client,7449709697914896384,0x0,172.16.0.0-172.31.255.255,Germany,,,0,,,1,,,,,,,,0,0,0,0,0,,PA-VM,,,,,0,,0,,N/A,js,Antivirus-5010-5528,0x0,0,4294967295,,,b8b30cde-a128-468c-a1ca-69fc9cd04b22,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2024-12-18T03:45:54.944-08:00,,,,internet-utility,general-internet,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,web-browsing,no,no,,,NonProxyTraffic

Normalized fields

Traffic logs

Log format example

1,2024/10/03 00:38:31,,TRAFFIC,end,2816,2024/10/03 00:38:31,172.16.16.11,172.16.14.40,172.16.14.28,172.16.14.40,LAN-WAN,,,ping,vsys1,LAN_Zone,WAN_Zone,ethernet1/1,ethernet1/3,Traffic_log1,2024/10/03 00:38:31,16,4,0,0,0,0,0x500019,icmp,allow,592,296,296,8,2024/10/03 00:38:15,0,any,,7421447455897550886,0x0,172.16.0.0-172.31.255.255,172.16.0.0-172.31.255.255,,4,4,aged-out,0,0,0,0,,PA-VM,from-policy,,,0,,0,,N/A,0,0,0,0,1c467ae3-1dd7-4dd3-976e-c2e6d98e7cc2,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2024-10-03T00:38:31.407-07:00,,,internet-utility,general-internet,network-protocol,2,\"has-known-vulnerability,tunnel-other-application,pervasive-use\",,untunneled,no,no,0,NonProxyTraffic,

Normalized fields

User-ID logs

Log format example

1,2024/11/27 11:45:44,007954000533467,USERID,logout,2817,2024/11/27 11:45:44,vsys1,192.168.40.1,test,,0,1,0,0,0,vpn-client,globalprotect,7441913164041551877,0x0,0,0,0,0,,PA-VM,1,,2024/11/27 11:45:46,1,0x0,test,,2024-11-27T11:45:46.015-08:00,,client-to-server,

Normalized fields

Note

Prior to Illuminate 6.3.2, User was extracted as source_user, and User by Source was extracted as vendor_source_user.

Illuminate will overwrite the message field for User ID logs (normally the CSV-formatted event data) into a more brief summary of the event in question. The replacement message uses the following template:

User-ID:{user_name} discovery:{vendor_log_subtype}, data source:{vendor_datasource} (name:{vendor_datasource_name}, type:{vendor_datasource_type})

Example:

User-ID:corpuser discovery:login, data source:agent (name:CORPSYS1, type:)

Enrichments

Illuminate will enrich events with data to make working with events easier.

application_risk

Some Palo Alto logs will include a numeric risk-scoring value, assigned to the application_risk_level field for logged applications, on a scale of 1 (lowest) to 5 (highest). Illuminate also adds the application_risk_score field, which will provide a text value that reflects the rating of the numeric risk score.

Palo Alto 11 Spotlight content pack

The Palo Alto 11 Spotlight Pack provides an overview dashboard with the following tabs: Overview, Traffic, Threat, Global Protect, URL Filtering, and Decryption.

pfSense Firewall content pack

pfSense and OPNsense are free, open-source firewalls and router software based on FreeBSD. They provide advanced networking features and can be used in a variety of network configurations.

This technology pack will process pfSense and OPNsense messages.

Requirements

Supported versions include Sense CE edition 2.6 and OPNsense 23.1.

Supported logs

  • dhcpd (DHCP logs)

  • filterlog (Firewall logs)

  • nginx / lighttpd (Traffic logs)

  • unbound (DNS logs, query)

  • sshd (Login/Logout via SSH)

  • GUI login (Login)

  • sshguard (SSHGuard logs)

  • audit / php-fpm (Authentication)

  • php-fpm (User creation and deletion)

Beta support:

  • ntpd (NTP logs)

  • kea-dhcp4 (Kea DHCP logs)

  • openvpn (OpenVPN logs)

  • radvd (Routing advertisement logs)

  • suricata (Intrusion Detection)

  • snort (Snort 2.9, Intrusion Detection)

  • /usr/sbin/cron (Cron System logs)

  • dpinger (Gateway logs)

  • charon (IPSec)

  • dnsmasq (DNSMasq)

  • pkg_static (Packet Manager)

  • shutdown (Shutdown command)

  • rc.gateway_alarm (Gateway alarm)

  • snmpd (SNMP)

  • arpwatch (Arpwatch)

  • squid (Proxy Server, requires a specific input)

  • Bind (Alternative DNS Server)

  • tailscaled (Tailscale successful connection)

Note

These are mostly additional pfSense/OPNsense packages (not installed or configured by default). The pack will parse out at least the basic fields of the aforementioned packs but some may require adjusted logging settings.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:pfsense_firewall Messages”

Note

If this stream does not exist prior to the activation of this pack, then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “pfsense_firewall Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format examples

dhcpd (DHCP logs)

DHCPREQUEST for 192.168.1.50 from 52:54:00:06:aa:11 (tsterkal) via vtnet1

filterlog (Firewall logs)

71,,,1eb94a38e58994641aff378c21d5984f,vtnet0,match,block,in,4,0x0,,255,43376,0,DF,17,udp,73,192.168.122.40,224.0.0.251,5353,5353,53

nginx / lighttpd (Traffic logs)

192.168.1.50 192.168.1.10 - [23/Mar/2023:14:48:28 +0000] "GET /api/core/system/status HTTP/2.0" 200 317 "https://192.168.1.10/services_dhcp.php?if=lan" "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"

unbound (DNS logs)

[61142:0] info: reply from <cnn.com.> 205.251.192.47#53
[98871:0] query: 192.168.1.100 safebrowsing.googleapis.com. A IN

sshguard (SSHGuard logs)

Attack from "192.168.7.1" on service 100 with danger 10.

sshd (Login/Logout via SSH)

Accepted keyboard-interactive/pam for admin from 192.168.1.100 port 53214 ssh2

audit / php-fpm (Authentication)

/index.php: Successful login for user 'root' from: 192.168.1.50

login (Login to a shell)

Logs in Beta Support

ntpd (NTP logs)

65.182.224.60 local addr 192.168.122.34 -> <null>

kea-dhcp4 (Kea DHCP logs)

INFO [kea-dhcp4.leases.0x317efda18900] DHCP4_LEASE_ADVERT [hwtype=1 c4:bd:e5:1b:94:fa], cid=[01:c4:bd:e5:1b:94:fa], tid=0x3bfb1946 lease 192.168.6.173 will be advertised

openvpn (OpenVPN logs)

myusercert/192.168.1.100:35609 SENT CONTROL [myusercert]: 'PUSH_REPLY,redirect-gateway def1,route-gateway 192.168.2.1,topology subnet,ping 10,ping-restart 60,ifconfig 192.168.2.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)

radvd (Routing advertisement logs)

ignoring RA from fe80::abcd:1234:5678:aaaa on igb0: not enough addresses for subnet

suricata (Intrusion Detection)

[46424]: [Drop] [1:2001219:20] ET SCAN Potential SSH Scan [Classification: Attempted Information Leak] [Priority: 2] {TCP} 118.123.10.10:1566 -> 192.168.1.25:22

snort (Snort 2.9)

[119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 192.168.1.100:49922 -> 192.168.1.1:3128

/usr/sbin/cron (Cron System logs)

(root) CMD (/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot)

dpinger (Gateway logs)

dpinger[11000]: WAN_GW 198.51.100.1: Alarm latency 4807us stddev 1790us loss 21%

charon (IPSec)

16[CFG] loaded 0 RADIUS server configurations

Parsing is only for charon process and pid.

dnsmasq (DNSMasq)

1 192.168.1.50/49952 query[A] cnn.com from 192.168.1.50

pkg_static / pkg (Packet Manager)

opnsense upgraded: 23.1 -> 23.1.4_1

shutdown (Shutdown command)

power-down by root:

rc.gateway_alarm (Gateway alarm)

>>> Gateway alarm: WAN_DHCP (Addr:192.168.122.1 Alarm:0 RTT:1.241ms RTTsd:10.968ms Loss:0%)

snmpd (SNMP)

disk_OS_get_disks: adding device 'cd0' to device list

php-fpm (User creation and deletion)

/system_usermanager.php: Configuration Change: admin@192.168.1.100 (Local Database): Successfully deleted user: stefan

arpwatch (Arpwatch)

new station 192.168.1.100 52:54:00:06:57:10

kernel

vtnet0: promiscuous mode enabled

squid (Proxy Server, requires a specific input)

1680109171.634 171177 192.168.1.100 TCP_TUNNEL/200 111 CONNECT 192.169.3.4:443 - HIER_DIRECT/10.10.10.10 -

php/php_pfb (Software Updates/News)

[pfBlockerNG] Starting cron process.

Bind/named (Alternative DNS Server)

queries: info: client @0x802512d60 192.168.1.100#54251 (heise.de): query: heise.de IN A +E(0)K (192.168.1.1)

tailscaled (Tailscale connection)

UDP{100.121.10.10:60074 > 192.168.2.10:53} 70 ok

Requirements

The pack allows you to select one of three different ways to route the logs into the right pack.

Option 1 (via device name):

  • The name of the pfSense/OPNsense device must start with pfSense or OPNsense. These strings are case-sensitive.

Option 2 (via static field):

  • The required field name is RoutedFrom, and the required value is Route - PFSense Logs. Both values are case-sensitive.

Option 3 (via specific input):

  • A pfSense/OPNsense specific input in Security Data Lake and an Illuminate lookup override can also be configured.

Security Data Lake configuration for a specific input

1. Create a new Syslog input and choose an unused port. (If an input already exists that only handles pfSense/OPNSense logs, use that input. If using a new or existing forwarder, create a new input as part of the forwarder setup process or use the input already associated with an existing forwarder.)

2. Once the input is created, select Show received messages to obtain the input ID. This will display a search window with the All Time timeframe. If there is a large number of logs, you might want to adjust the timeframe to speed up the process.

3. Copy the gl2_source_input value.

4. Go to Enterprise > Illuminate and click the Customization tab.

5. Locate lookup_adapter_input_routing and select Edit. For the content_name key, enter pfsense_firewall. For the input_id value, enter the gl2_source_input ID you copied earlier.

6. Click Configure value to confirm.

Now, all logs sent to the configured input will be identified as pfSense/OPNSense logs, ensuring proper Illuminate processing.

pfSense/OPNsense configuration

1. Enable remote logging on pfSense/OPNsense and configure your logging target.

2. Select the logs what you want to see. Some services require you to select a setting within that service to produce logs. Most log sources are not activated by default. Some services like unbound/dns produce a high volume of logs.

3. The Hostname is the IP of your Bitdefender Forwarder.

4. Set a port. (Note it must match a Syslog input in Security Data Lake.) The default protocol is udp.

5. Select or enable syslog rfc5424.

What is provided

  • Rules to normalize and enrich pfSense and OPNSense log messages.

pfSense/OPNsense log message processing

The Illuminate processing of pfSense/OPNsense log messages provides the following:

  • Field extraction, normalization, and message enrichment for pfSense/OPNsense log messages.

  • GIM categorization of the following messages:

Event type

GIM category

GIM subcategory

DHCPACK

dhcp

dhcp.acknowledgement

DHCPREQUEST

dhcp

dhcp.request

DHCPOFFER

dhcp

dhcp.offer

DHCPDISCOVER

dhcp

dhcp.discovery

DHCP4_INIT_REBOOT

dhcp

dhcp.default

DHCP4_LEASE_ADVERT

dhcp

dhcp.offer

DHCP4_LEASE_ALLOC

dhcp

dhcp.acknowledgement

ALLOC_ENGINE_V4_DISCOVER_ADDRESS_CONFLICT

dhcp

dhcp.discovery

EVAL_RESULT

dhcp

dhcp.default

network traffic

http

http communication

GUI login

authentication

authentication.logon

GUI logout

authentication

authentication.logoff

ssh login

authentication

authentication.logon

pw_admin_change

iam

iam.object modify

pw_user_change

iam

iam.object modify

login_failed

authentication

authentication.logon

created user

iam

iam.object modify

deleted user

iam

iam.object modify

snort alert

alert

alert.default

suricata alert

alert

alert.default

sshguard attack alert

alert

alert.default

ipv4 traffic

network

network.network connection

ipv6 traffic

network

network.network connection

tailscale connection

network

network.network connection

squid connection

network

network.default

ipv4 icmp traffic

network

network.default

ipv6 icmp traffic

network

network.default

ipv4 igmp traffic

network

network.default

snmpd connection

network

network.default

dns query

name resolution

name resolution.dns request

pfSense/OPNsense Spotlight content pack

pfSense/OPNsense offers a dashboard with overviews and one with a filter log and alerts.

Postfix content pack

Postfix is a free and open-source mail transfer agent that routes and delivers electronic mail. It is known for its easy configuration, secure default settings, and efficient management of system resources.

Supported versions

  • Tested with Postfix version 3.7 but earlier versions may be compatible.

Stream configuration

This technology pack includes 1 stream:

  • "Illuminate:Postfix Mail Server Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • "Postfix Mail Server Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

  • Syslog

Syslog configuration

Postfix sends the logs by default directly into syslog.

  1. Create a syslog input under Enterprise > Forwarders > Input Profiles. For more information on input creation and configuration, refer to Syslog Inputs.

  2. Configure your syslog server (e.g. rsyslog) to send the logs to Security Data Lake via the Bitdefender Forwarder.

Log format examples

Bounce logs

`Jan 10 12:29:22 mailserver postfix/bounce[12345]: 24F202322: sender delay notification: 0A27A1222`

Cache logs

`Jan 10 12:29:22 mailserver postfix/cache[12345]: 24F202322: cache lmdb:/var/lib/postfix/verify_cache full cleanup: retained=722 dropped=26 entries`

Connect logs

`connect to intern.nl[10.10.10.10]:25: Connection timed out`

From logs

`1234567222: from=<user@example.com>, size=3527, nrcpt=1 (queue active)`

To logs

`1234567222: to=, relay=none, delay=22, delays=22/0.02/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:2525: Connection refused)`

What is provided

  • Rules to normalize and enrich Postfix log messages and a dashboard with four tabs.

Events processed by this technology pack

The Postfix content pack supports:

  • Bounce Logs

  • Cache Logs

  • Certificate Logs

  • Client Logs

  • Connect Logs

  • DNS Logs

  • Lost Connection Logs

  • Mail from Logs

  • Mail to Logs

  • Master Logs

  • Pickup Logs

  • Postsuper Logs

  • Proxy Logs

  • PS Access Logs

  • PS Noqueue Logs

  • PS Violation Logs

  • QMGR Action Logs

  • SASL Failed Logs

  • Statistics Logs

  • Tls Connection Logs

  • Workaround Logs

Log fields included in this pack

Field name

Example value

Field type

Description

DNSBL

source_ip

10.1.2.3

keyword

IP address of the client.

vendor_dnsblog_domain

zen.spamhaus.org

keyword

The DNSBL service queried.

vendor_dnsblog_result

127.0.0.2

keyword

The DNSBL query result indicating whether the IP is blacklisted.

Postsuper

vendor_event_action

requeued

keyword

The postsuper action taken on messages.

vendor_postsuper_summary_count

23

keyword

Number of messages on which action was taken.

smtpd

vendor_event_action

connect

keyword

The action taken in the event.

vendor_stage

END-OF-MESSAGE

keyword

The stage of an SMTP connection, often associated with lost or filtered connections.

vendor_smtp_response_message

<user@example.com>: Recipient address rejected

keyword

The information provided in an SMTP response, often related to rejected or failed transactions.

smtp_response_code

554

keyword

SMTP basic status code.

smtp_response_code_description

Transaction failed

keyword

SMTP basic status code description.

smtp_response_enhanced_class_code

5

keyword

SMTP enhanced status class code.

smtp_response_enhanced_class_code_description

Permanent Failure

keyword

SMTP enhanced status class code description.

smtp_response_enhanced_subject_code

7

keyword

SMTP enhanced status subject code.

smtp_response_enhanced_subject_code_description

Security or Policy Status

keyword

SMTP enhanced status subject code description.

smtp_response_enhanced_status_code

7.1

keyword

SMTP enhanced status enumerated status code.

email_from

user@example.com

keyword

Email address of the sender.

email_to

user@example.com

keyword

Email address of the recipient, found in some message types.

source_ip

10.1.2.3

keyword

IP address of the client.

source_hostname

example.com

keyword

Hostname of the client; often present when no sender address is given.

source_port

25

long

Port from which the client sent the request.

destination_hostname

mta.example.com

keyword

Hostname of the server; often present when no recipient address is given.

network_protocol

smtp

keyword

Network protocol used.

Master

vendor_event_action

daemon started

keyword

The action taken by the master daemon.

service_version

2.11.2

keyword

The Postfix version running.

vendor_config_path

/etc/postfix

keyword

Directory path to the Postfix configuration file.

vendor_termination_signal

22

keyword

Termination signal received by the master daemon.

Pickup

email_from

user@example.com

keyword

Email address of the sender.

user_id

1001

keyword

The ID of the user who submitted the message.

vendor_event_severity

high

keyword

The priority given to the message for processing.

vendor_event_outcome

deferred

keyword

The status of the message.

smtp

vendor_event_action

connect

keyword

The action taken in the event.

vendor_event_outcome

failed

keyword

The outcome of the event.

vendor_event_description

SASL authentication failed

keyword

The description of the event.

vendor_event_outcome_reason

Network is unreachable

keyword

The explanation for why a connection to the destination mail server failed.

vendor_status

sent

keyword

The outcome of an email delivery attempt.

vendor_delay

0.15

keyword

The total time, in seconds, that the message spent in the delivery process.

vendor_delay_before_qmgr

0.05

keyword

The time, in seconds, that the message spent in the queue before queue manager processing.

vendor_delay_in_qmgr

0

keyword

The time, in seconds, that the message spent in the queue manager.

vendor_delay_conn_setup

0

keyword

The time, in seconds, spent establishing a connection to the destination mail server.

vendor_delay_transmission

0.1

keyword

The time, in seconds, spent transmitting the message to the destination mail server.

vendor_dsn

2.0.0

keyword

Delivery Status Notification indicating the outcome of an email delivery attempt.

vendor_pix_workaround

disable_esmtp

keyword

Specific workaround(s) enabled.

vendor_relay_ip

10.1.2.3

keyword

IP address of the relay server.

vendor_relay_host

relay.example.com

keyword

Hostname of the relay server.

vendor_relay_port

25

long

Port used by the relay server.

vendor_smtp_response_message

Ok: queued as 1C4AF7872E4

keyword

The information provided for an SMTP response or delivery status.

vendor_mail_response

user unknown

keyword

The information provided for a delivery status.

smtp_response_code

250

keyword

SMTP basic status code.

smtp_response_code_description

Requested mail action okay, completed

keyword

SMTP basic status code description.

smtp_response_enhanced_class_code

2

keyword

SMTP enhanced status class code.

smtp_response_enhanced_class_code_description

Success

keyword

SMTP enhanced status class code description.

smtp_response_enhanced_subject_code

0

keyword

SMTP enhanced status subject code.

smtp_response_enhanced_subject_code_description

Other or Undefined Status

keyword

SMTP enhanced status subject code description.

smtp_response_enhanced_status_code

0

keyword

SMTP enhanced status enumerated status code.

email_to

user@example.com

keyword

Email address of the recipient.

vendor_orig_to

orig@example.com

keyword

The original recipient address of an email.

source_ip

10.1.2.3

keyword

IP address of the client.

source_hostname

example.com

keyword

Hostname of the client.

source_port

25

long

Port from which the client sent the request.

Warning

vendor_event_severity

warning

keyword

The vendor event severity. Follows syslog level, with an additional panic state.

vendor_warning_description

database /etc/postfix/virtual.db is old

keyword

The error message.

TLS

vendor_tls_trustlevel

Anonymous

keyword

The vendor event severity. Follows syslog level, with an additional panic state.

vendor_event_action

TLS connection

keyword

The TLS event action.

vendor_event_outcome

established

keyword

The outcome of the action.

vendor_relay_host

relay.example.com

keyword

Hostname of the relay server.

vendor_relay_ip

10.1.2.3

keyword

IP address of the relay server.

vendor_relay_port

25

long

Port used by the relay server.

vendor_tls_version

TLSv1.2

keyword

The TLS version.

vendor_tls_cipher

AECDH-AES256-SHA

keyword

The TLS cipher used.

vendor_tls_cipher_size

256/256

keyword

The TLS cipher size.

vendor_tls_error

self-signed certificate

keyword

The reason for a certificate verification failure.

Postscreen

vendor_event_action

PASS NEW

keyword

The action taken on incoming SMTP connections.

vendor_server_ip

10.1.2.3

keyword

IP address of the Postfix mail server.

vendor_server_port

25

long

Port on the Postfix mail server that received the request.

vendor_ps_violation

PREGREET

keyword

The reason the request was filtered, often due to being suspicious or non-compliant.

vendor_ps_violation_time

1.2

keyword

Duration, in seconds, that elapsed before a violation occurred.

vendor_smtp_stage

HELO

keyword

The stage of an SMTP connection during or after which a violation occurred.

vendor_smtp_response_message

<host@example.com>: Relay access denied

keyword

The explanation for why an SMTP transaction was rejected or failed.

smtp_response_code

550

keyword

SMTP basic status code.

smtp_response_code_description

Mailbox unavailable

keyword

SMTP basic status code description.

smtp_response_enhanced_class_code

5

keyword

SMTP enhanced status class code.

smtp_response_enhanced_class_code_description

Permanent Failure

keyword

SMTP enhanced status class code description.

smtp_response_enhanced_subject_code

5

keyword

SMTP enhanced status subject code.

smtp_response_enhanced_subject_code_description

Mail Delivery Protocol Status

keyword

SMTP enhanced status subject code description.

smtp_response_enhanced_status_code

5.3

keyword

SMTP enhanced status enumerated status code.

email_from

user@example.com

keyword

Email address of the sender.

email_to

user@example.com

keyword

Email address of the recipient.

source_ip

10.1.2.3

keyword

IP address of the client.

source_hostname

example.com

keyword

Hostname of the client, often present when no sender address is given.

source_port

25

long

Port from which the client sent the request.

destination_hostname

mta.example.com

keyword

Hostname of the server, often present when no recipient address is given.

network_protocol

smtp

keyword/loweronly

Network protocol used.

Cache

vendor_cache_retained

724

long

Number of result cache entries kept during cleanup.

vendor_cache_dropped

6

long

Number of result cache entries removed during cleanup.

Cleanup

vendor_event_action

header-redirect

keyword

The action taken in the event.

vendor_email_header

X-Spam-Status

keyword

An email header present in the message.

vendor_email_header_content

Yes, score=39.3 required=5.0 tests=ADVANCE_FE

keyword

The content of an email header.

vendor_milter_data

tom@example.com

keyword

Information pertaining to the mail filter protocol.

email_message_id

KIYjfnew6eh4nfj+reun0Kis-HIdHF714@mail.client.com

keyword

Email Message ID.

email_subject

This is a Subject

keyword

Email Subject.

email_from

user@example.com

keyword

Email address of the sender.

email_to

user@example.com

keyword

Email address of the recipient.

source_ip

10.1.2.3

keyword

IP address of the client.

source_hostname

example.com

keyword

Hostname of the client.

network_protocol

smtp

keyword/loweronly

Network protocol used.

Bounce

vendor_event_outcome

delay

keyword

The notification type indicating the outcome of an email delivery attempt.

vendor_bounce_uid

0A87A1A08

keyword

The queue ID unique to the email transaction that the notification describes.

Queue Manager (qmgr)

email_from

user@example.com

keyword

Email address of the sender.

email_size

2522

long

Size of the email message in bytes.

vendor_nrcpt

2

long

Number of recipients for the email.

vendor_qmgr_action

removed

keyword

The status of the message within the mail queue.

General Parsing

application_name

postfix

keyword

This field is generated by the syslog input.

process_id

5222

keyword/loweronly

This field is generated by the syslog input.

event_created

6/12/2024 2:26

date

event_source

serverhost

keyword

This field is generated by the syslog input.

vendor_event_severity

warn

keyword

Not all Postfix logs have a severity; usually, only error messages have one.

vendor_daemon

qmgr

keyword

The Postfix service that the message pertains to. Existence depends on the input format.

email_uid

2A123B456C

keyword

The queue ID unique to each Postfix message.

Scache

vendor_event_action

start interval

keyword

The action for this log type is always "start interval".

vendor_scache_timestamp

12/6/2024 21:20

keyword

The timestamp indicating when this statistic was recorded.

vendor_scache_hits

1

long

Indicates the number of successful cache hits.

vendor_scache_miss

1

long

Represents the number of cache misses.

vendor_scache_success

1

long

Shows the number of successful cache operations.

vendor_scache_domains

1

long

Indicates the number of unique domains for which connection information is cached.

vendor_scache_addresses

1

long

Shows the number of unique IP addresses for which connection information is cached.

vendor_scache_connection

1

long

Represents the number of active or open connections that are currently cached.

Anvil

vendor_anvil_cache_size

12

keyword

Represents the current size of the connection cache managed by the anvil daemon.

vendor_anvil_timestamp

12/6/2024 21:20

keyword

The timestamp indicating when this statistic was recorded.

vendor_anvil_conn_count

1

long

Refers to a specific metric tracked by the anvil daemon, which is responsible for rate limiting connections and command requests to prevent abuse or denial-of-service attacks.

vendor_anvil_conn_rate

1

long

Tracks the rate at which new connections are made to the server, providing a measure of connection activity over a specified time period.

vendor_service

smtpd

long

Specifies the context or service for which the statistic is relevant.

source_ip

10.1.2.3

keyword

IP address of the client.

source_hostname

example.com

keyword

Hostname of the client.

source_port

25

long

Port from which the client sent the request.

Postfix legacy timestamps

Postfix logs may include a legacy syslog-formatted timestamp, such as June 12 02:26:22, which is extracted and assigned the event_created field. The legacy format can be processed and indexed as a date value, but without a year defined, the date will be stored using the default year, 1970.

The Illuminate Postfix processing pack will detect these timestamps and update them to a format that includes the current year. This will address the large majority of events but it is possible that events occurring right before the end of the calendar year and being processed after the new calendar year starts could be indexed with the incorrect year, effectively making the event_created value appear in the future. Additionally, processing old events that did not occur in the current calendar year will be set to use the current year.

Postfix Spotlight content pack

The Postfix Spotlight content pack offers a dashboard with 4 tabs: Postfix Mail Server Overview, Postfix Email Overview, Postfix SMTP Overview, and Postfix TLS Overview:

Sendmail content pack

Sendmail is a free and open-source mail transfer agent (MTA) used to route and deliver email on Unix-based systems. This technology pack will process Sendmail logs and includes parsers and dashboards to visualize key data such as sender/recipient activity, delivery status, ruleset rejections, authentication, and processing statistics.

What is provided

  • Rules to parse, normalize and enrich Sendmail log messages and a dashboard with six tabs covering key insights.

Supported versions

  • Tested with Sendmail version 8.15.2 but earlier versions are compatible.

Stream configuration

This technology pack includes 1 stream:

  • "Illuminate:Sendmail Mail Server Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes 1 index set definition:

  • "Sendmail Mail Server Logs"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

  • Syslog

  • Filebeat (with Sidecar)

Syslog configuration

Sendmail outputs to syslog under mail facility by default.

  1. Create a Syslog input in Security Data Lake.

  2. Configure your syslog server (e.g. rsyslog) to send the logs to Security Data Lake.

Note

Only RFC 5424-compliant syslog messages are accepted.

Filebeat configuration

For information on setting up Bitdefender Sidecar for filebeat, refer to Sidecars.

  1. Create a Beats input in Security Data Lake.

  2. Create an API access token and a Linux filebeat collector.

  3. Configure the collector for Sendmail, as shown in the following example:

    filebeat.inputs:
- input_type: log
  paths:
    - /var/log/mail.log
  type: filestream
  fields_under_root: true
  fields:
    event_source_product: sendmail

    Note

    There must be two spaces in front of event_source_product and - /var/log/mail.log.

  4. Configure the client with filebeat and Sidecar.

Log format examples

Receipt logs

`qA6KmkmX918730: from=<user@corp.example.com>, size=1286, class=0, nrcpts=1, msgid=<498FC718.7000891@corp.example.com>, proto=ESMTP, daemon=MTA, relay=a.mail.example.com [11.111.11.111]`

Delivery logs

`qABK0GcL913544: to=<user@corp.example.com>, delay=00:00:08, xdelay=00:00:01, mailer=esmtp, pri=1314205, relay=aspmx.l.google.com. [173.194.79.26], dsn=2.0.0, stat=Sent (OK 1234567890 g7zy99885643ion.56)`

Ruleset rejection logs

`e5DHeYC11749: ruleset=check_rcpt, arg1=<user@foo.bar.com>, relay=user@mail.bar.com [11.111.11.111], reject=550 5.7.1 <user@foo.bar.com>... Relaying denied`

Authentication logs

`AUTH=server, relay=11-111-11-111.srv.foo.bar.com [11.111.11.111] (may be forged), authid=gooduser, mech=PLAIN, bits=0`

STARTTLS logs

`STARTTLS=client, relay=gmail-smtp-in.l.google.com., version=TLSv1/SSLv3, verify=OK, cipher=RC4-SHA, bits=128/128`

Connection logs

`c22AJzde908658: SMTP outgoing connect on server1.example.com`

Invalid connection logs

`m12Umdcw998259: [11.111.11.111] did not issue MAIL/EXPN/VRFY/ETRN during connection to SSLMTA`

Pregreet traffic logs

`z1ENNTPj905074: rejecting commands from foo.bar.com [11.111.11.111] due to pre-greeting traffic after 0 seconds`

Rejected discovery logs

`u52CZzhr906425: AAAb9625.ne.foo.bar.com [11.111.11.111]: VRFY user [rejected]`

Service status logs

`starting daemon (8.14.4): SMTP+queueing@00:10:00`

Events processed by this technology pack

The Sendmail content pack supports:

  • Receipt Logs

  • Delivery Logs

  • Ruleset Rejection Logs

  • Authentication Logs

  • STARTTLS Logs

  • Connection Logs

  • Invalid Connection Logs

  • Pregreet Traffic Logs

  • Rejected Discovery Logs

  • Service Status Logs

Message fields included in this pack

Field name

Example value

Field type

Description

General parsing

application_name

sendmail

keyword

This field is generated by the syslog input.

facility

mail

keyword

This field is generated by the syslog input.

process_id

5222

keyword

This field is generated by the syslog input.

source

mailsrv1

keyword/loweronly

Hostname or IP of the source system that generated the event.

email_uid

qABK0GcL913544

keyword

The queue ID unique to each message.

Receipt

email_from

user@example.com

keyword

Email address of the sender.

email_size

589

long

Size of the email message in bytes.

email_message_id

200046040409.e5EECA205337@foo.bar.com

keyword

Email Message ID.

vendor_class

0

long

The queue class (numeric precedence) of the message.

vendor_nrcpts

1

long

Number of recipients for the email.

vendor_daemon

MTA

keyword

The name of the sender daemon.

vendor_relay_user

user@example.com

keyword

User of the client relay, the host from which a message was received.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host from which a message was received.

source_hostname

example.com

keyword

Hostname of the client relay, the host from which a message was received.

network_protocol

esmtp

keyword

The protocol used when the message was received.

Delivery

email_to

user@example.com

keyword

Email address of the recipient.

vendor_ctladdr

mailadmin

keyword

The controlling user, the name of the user whose credentials are used for delivery.

vendor_delay

00:08:52

keyword

The total time the message took to be processed from reception to attempted delivery.

vendor_delay_total_seconds

532

long

The total message delay described in seconds.

vendor_xdelay

00:00:04

keyword

The total time the message took to be transmitted during final delivery.

vendor_mailer

esmtp

keyword

The name of the delivery agent used.

vendor_pri

30589

long

The initial priority assigned to the message.

vendor_dsn

2.0.0

keyword

Delivery Status Notification indicating the outcome of an email delivery attempt.

vendor_status_full

Sent (e6FDCEv13455 Message accepted for delivery)

keyword

The full delivery status of the message.

vendor_status

Sent

keyword

The abbreviated delivery status of the message.

vendor_status_text

e6FDCEv13455 Message accepted for delivery

keyword

The delivery status information returned by the delivery agent or destination host.

vendor_relay_user

user@example.com

keyword

User of the destination relay, the host that receives a message.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

destination_ip

10.1.2.3

keyword

IP address of the destination relay, the host that receives a message.

destination_hostname

example.com

keyword

Hostname of the destination relay, the host that receives a message.

Ruleset rejection

vendor_ruleset

check_rcpt

keyword

The ruleset that was used to screen the rejected message.

vendor_arg1

spammer@spammy.com

keyword

The argument to a ruleset check, usually an IP, domain or email address.

vendor_arg2

127.0.0.4

keyword

Additional argument to a ruleset check, often the query result from abuse lookup services.

vendor_relay_user

user@example.com

keyword

User of the client relay, the host from which a message was received.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host from which a message was received.

source_hostname

example.com

keyword

Hostname of the client relay, the host from which a message was received.

vendor_reject

550 5.7.1 Mail from 11.111.11.111 rejected by SPAMHAUS.

keyword

The reason a message was rejected, often containing the server SMTP response.

vendor_smtp_response_message

<spammer@spammy.com.>... SPAM REJECT

keyword

The information provided in an SMTP response.

smtp_response_code

550

keyword

SMTP basic status code.

smtp_response_code_description

Mailbox unavailable

keyword

SMTP basic status code description.

smtp_response_enhanced_class_code

5

keyword

SMTP enhanced status class code.

smtp_response_enhanced_class_code_description

Permanent Failure

keyword

SMTP enhanced status class code.

smtp_response_enhanced_status_code

7.1

keyword

SMTP enhanced status enumerated status code.

smtp_response_enhanced_subject_code

7

keyword

SMTP enhanced status subject code.

smtp_response_enhanced_subject_code_description

Security or Policy Status

keyword

SMTP enhanced status subject code description.

Authentication

vendor_auth

client

keyword

Indicates whether Sendmail acted as the client or server during authentication.

vendor_authid

mailadmin

keyword

The authentication identifier, usually a username.

vendor_mech

LOGIN

keyword

The authentication mechanism used.

vendor_bits

0

keyword

The strength of encryption used during authentication, or none used.

vendor_relay_user

user@example.com

keyword

User of the client/destination relay depending on the direction of authentication.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host authenticating to the server.

source_hostname

example.com

keyword

Hostname of the client relay, the host authenticating to the server.

destination_ip

10.1.2.3

keyword

IP address of the destination relay, the server being authenticated to by a client.

destination_hostname

example.com

keyword

Hostname of the destination relay, the server being authenticated to by a client.

STARTTLS

vendor_starttls

server

keyword

Indicates whether Sendmail acted as the client or server during STARTTLS negotiation.

vendor_tls_version

TLSv1/SSLv3

keyword

The TLS version used.

vendor_tls_cipher

AES128-SHA

keyword

The cipher suite negotiated for the secure connection.

vendor_tls_cipher_size

128/128

keyword

The key size used for encryption.

vendor_starttls_verify

OK

keyword

The result of the server certificate verification.

vendor_starttls_error

accept failed

keyword

The error that occurred during STARTTLS negotiation.

vendor_starttls_error_code

-1

keyword

The result code assigned to a STARTTLS negotiation error.

vendor_starttls_error_reason

sslv3 alert bad certificate

keyword

The reason for a STARTTLS negotiation error.

vendor_relay_user

user@example.com

keyword

User of the client/destination relay depending on the direction of connection.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host connecting to the server.

source_hostname

example.com

keyword

Hostname of the client relay, the host connecting to the server.

destination_ip

10.1.2.3

keyword

IP address of the destination relay, the server receiving the connection.

destination_hostname

example.com

keyword

Hostname of the destination relay, the server receiving the connection.

Connection

vendor_event_action

connect

keyword

The action taken in the event.

vendor_relay_user

user@example.com

keyword

User of the client/local relay.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

vendor_relay_ip

10.1.2.3

keyword

IP address of the local relay used to send a message.

vendor_relay_host

example.com

keyword

Hostname of the local relay used to send a message.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host from which a connection was received.

source_hostname

example.com

keyword

Hostname of the client relay, the host from which a connection was received.

Invalid connection

vendor_relay_user

suspicious@domain.tld

keyword

User of the client relay, the host from which the invalid connection was received.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host from which the invalid connection was received.

source_hostname

domain.tld

keyword

Hostname of the client relay, the host from which the invalid connection was received.

Pre-greet traffic

vendor_event_action

rejecting

keyword

The action taken in the event.

vendor_relay_user

suspicious@domain.tld

keyword

User of the client relay, the host from which the pre-greeting traffic was sent.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host from which the pre-greeting traffic was sent.

source_hostname

domain.tld

keyword

Hostname of the client relay, the host from which the pre-greeting traffic was sent.

Rejected discovery

vendor_relay_user

suspicious@domain.tld

keyword

User of the client relay, the host potentially scanning the server.

vendor_relay_warning

may be forged

keyword

Warning that relay IP or name may be forged.

source_ip

10.1.2.3

keyword

IP address of the client relay, the host potentially scanning the server.

source_hostname

domain.tld

keyword

Hostname of the client relay, the host potentially scanning the server.

Service status

vendor_event_action

starting

keyword

The event action indicating the status of the Sendmail daemon.

vendor_version

8.14.7

keyword

The Sendmail version running.

vendor_event_outcome_reason

signal

keyword

The specific cause for a service status change.

Sendmail Spotlight content pack

The Sendmail Spotlight content pack offers a dashboard with 6 tabs: Sendmail Mail Server Overview, Activity, Delivery Status, Rule Rejection, Authentication, and Processing Statistics.

SFOS 19.5 content pack

Sophos XG/XGS is a network security solution designed to provide comprehensive protection for networks against various threats including malware, viruses, ransomware, phishing, and more. It combines multiple security features into a single platform, offering both traditional firewall capabilities and advanced security functionality.

Requirements

The pack has been tested with SFOS (Sophos Firewall Software) version 19.5. If testing compatibility with older versions, please note that the older SFOS 17.x (released in Dec 2019) uses different field names for some log types. While the pack can still parse all the fields, certain dashboards and categorizations may not function correctly due to these variations in field names. Firewall XG and XGS are fully supported.

Supported logs/event IDs

  • All 37 SFOS log types for SFOS 19.5 are supported.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Sophos Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Sophos Device Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log example

device"SFW" date=2023-04-20 time=13:26:37 timezone="IST" device_name="XGS5w" device_id=SFTest180a log_id=010202601001 log_type="Firewall" log_component="Invalid Traffic" log_subtype="Denied" status="Deny" priority=Information duration=0 fw_rule_id=0 policy_type=0 user_name="" user_gp="" iap=0 ips_policy_id=0 appfilter_policy_id=0 application="none" application_risk=0 application_technology="MS" application_category="" in_interface="" out_interface="" src_mac= src_ip=10.10.32.19 src_country_code= dst_ip=18.18.18.18 dst_country_code= protocol="UDP" src_port=1353 dst_port=0 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=tran_src_port=0 tran_dst_ip= tran_dst_port=0 srczonetype="" srczone="" dstzonetype="" dstzone="" dir_disp="" connid="" vconnid="" hb_health="No Heartbeat" message="Invalid UDP destination." appresolvedby="Signature"

Sophos XG/XGS firewall configuration for syslog

Follow these steps to set up a Syslog output in the Sophos interface:

  1. Go to to System Services.

  2. Select Log Settings.

  3. For optimal compatibility and functionality, select Standard Syslog format. Although the legacy Device standard format may work, it offers fewer or different fields. It is also important to note that selecting the legacy format may result in GIM errors in some cases.

Security Data Lake configuration

To receive logs from Sophos XG/XGS, you must configure a Syslog UDP input in Security Data Lake. For details, refer to Syslog Inputs.

What is provided

  • Rules to normalize and enrich SFOS (Sophos Firewall Software) log messages

  • Dashboards

Sophos XG/XGS firewall message processing

The Illuminate processing of Sophos XG/XGS Firewall log messages provides the following:

  • Extraction of fields, normalization, and enrichment of SFOS log messages.

  • The message field will be replaced by a shorter message to reduce license utilization. Activate the full_message option in the input if needed.

  • GIM Categorization of the following messages:

Vendor event Component

GIM event type code

GIM event type

DHCP Server

299999

DHCP Default Event

Firewall Rule

120000

Network Connection

Invalid Traffic

120000

Network Connection

Heartbeat

120000

Network Connection

ICMP Redirection

120000

Network Connection

ICMP ERROR MESSAGE

120000

Network Connection

Fragmented Traffic

120000

Network Connection

Invalid Fragmented Traffic

120000

Network Connection

Local ACL

120000

Network Connection

DoS Attack

120000

Network Connection

Source Routed

120000

Network Connection

MAC Filter

120000

Network Connection

IPMAC Filter

120000

Network Connection

IP Spoof

120000

Network Connection

Virtual Host

120000

Network Connection

GUI

229999

Audit Event

My Account Authentication

100000

Logon

Firewall Authentication

100000

Logon

Anomaly

179999

Alert Message

Signatures

179999

Alert Message

Web Application Firewall

180200

HTTP Communication

Vendor event subtype

GIM event type code

GIM event type

ATP

179999

Alert Message

Virus

179999

Alert Message

Content Filtering

120000

Network Connection

Snort IDS processing content pack

Snort is an open-source network intrusion detection system (IDS) and intrusion prevention system (IPS). This IDS/IPS performs real-time traffic analysis and packet logging on Internet Protocol (IP) networks. It also can be used to detect semantic URL attacks, server message block probes, OS fingerprinting attempts, stealth port scans and buffer overflows.

Snort can be configured in three different modes: packet-capture mode, logging mode, or IDS mode. This pack runs Snort in IDS mode and comes with predefined rules. Snort will apply the packet content coming over any network it is monitoring to each rule.

Important

This content pack may be used only with Snort 3.

Sample snort rule

alert icmp any any -> any any (msg:"ICMP flood"; sid:1000001; rev:1; classtype:icmp-event; detection_filter:track by_dst, count 500, seconds 3;)

Supported versions

Snort can run on Ubuntu and RedHat-based Linux versions, FreeBSD, and Fedora.

Stream configuration

This technology pack includes one stream:

  • "Illuminate: Snort IDS Messages"

Note

If this stream does not exist prior to the activation of this pack, then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream. Note that, in the example above, we are forwarding only the Snort alerts which we are writing to the local5 facility. Alternatively, you could configure it to forward all syslog messages.

Index set configuration

This technology pack includes one index set definition:

  • “Snort IDS Logs”

The default configuration file is /etc/snort/snort.com.

For installation and configuration instructions, refer to the official Snort documentation.

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Requirements

To use this technology pack, configure Snort 3 to log in JSON format. You can use logging configurations such as alert_fast but a JSON configuration is required to capture detailed event information.

The snort.lua file below can be used for both Snort alerts and AppID alerts. If AppID is not used, those settings can be ignored.

The recommended paths and file names are listed below. If these differ from an existing configuration, the paths and file names will need to be adjusted in the Filebeat configuration.

  • Snort: /var/log/snort/alert_json.txt

  • AppID: /var/log/snort/appid-output.json

For additional information regarding AppID, installation, and usage, refer to the Snort documentation. You can find an example guide for installing and configuring AppID on Linux distributions in the Snort 3 Setup Guides section.

Snort 3 configuration

snort.lua

alert_json =
{
        fields = 'timestamp seconds action class b64_data dir dst_addr dst_port eth_dst eth_len eth_src eth_type gid icmp_code icmp_id icmp_seq icmp_type iface ip_id ip_len msg pkt_gen pkt_len pkt_num priority proto rev rule service sid src_addr src_ap src_port target tcp_ack tcp_flags tcp_len tcp_seq tcp_win tos ttl udp_len vlan b64_data client_bytes client_pkts flowstart_time server_bytes server_pkts',
        file = true,
        limit = 100,
}
appid_listener =
{
    json_logging = true,
    file = "/var/log/snort/appid-output.json",
}

Because Snort is configured to log in JSON format, a delivery system that can parse each field and deliver them to Security Data Lake is required. This technology pack supports log delivery via Filebeat with a specific configuration of inputs and outputs, identifying logs for parsing and delivery to Security Data Lake for Illuminate processing.

The paths and fields sections are required for this configuration. If the Snort logs are stored in paths other than those in the following .yml file, you must update these paths. The event_source_product: snort field is critical for proper identification and parsing of logs.

Filebeat configuration

For additional information regarding the installation and configuration of Filebeat, refer to the following resources:

The following is the default configuration file that you can edit in order to configure Filebeat.

filebeat.yml

- type: filestream

  id: snort-filestream

  enabled: true

  paths:
    - /var/log/snort/alert_json.txt
    - /var/log/snort/appid-output.json
  
  parsers:
    - ndjson:
        target: "snort3"
        add_error_key: true
        overwrite_keys: true


  fields:
    event_source_product: snort3
    fields_under_root: true

For instructions on sending other syslog daemons to Security Data Lake, refer to Syslog Inputs.

Log format example

{ "timestamp" : "04/04-10:36:13.537364", "seconds" : 1680618973, "action" : "allow", "class" : "Attempted User Privilege Gain", "b64_data" : "DHWBgAABAAQAAAAAB3NvbngtZnALbWVkaWFzZWFyY2gHdmVyaXpvbgNjb20AAAEAAcAMAAUAAQAAAEQATDFhYjI2Y2NhMTI0Y2JhNGY1ZDg5Y2MwYzUwOWQ5MjY2NC01Y2U1NzM2MTU5NzEyOTc4A2VsYgl1cy1lYXN0LTEJYW1hem9uYXdzwCjAPQABAAEAAAA5AAQjrk20wD0AAQABAAAAOQAEIsacQcA9AAEAAQAAADkABDRHiMQ=", "dir" : "S2C", "dst_addr" : "192.168.1.1", "dst_port" : 44661, "eth_dst" : "B1:F1:51:71:31:31", "eth_len" : 227, "eth_src" : "81:B1:91:F1:01:01", "eth_type" : "0x800", "gid" : 1, "iface" : "ens34", "ip_id" : 24269, "ip_len" : 193, "msg" : "PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt", "pkt_gen" : "raw", "pkt_len" : 213, "pkt_num" : 22551641, "priority" : 1, "proto" : "UDP", "rev" : 1, "rule" : "1:57878:1", "service" : "unknown", "sid" : 57878, "src_addr" : "192.168.1.2", "src_ap" : "192.168.1.2:53", "src_port" : 53, "tos" : 0, "ttl" : 61, "udp_len" : 193, "vlan" : 0, "b64_data" : "ABCLDKDDHDVBAERY3345112442JhNGY1ZDg5Y2MwYzUwOWQ5MjY2NC01Y2U1NzM2MTU5NzEyOTc4A2VsYgl1cy1lYXN0LTEJYW1hem9uYXdzwCjAPQABAAEAAAA5AAQjrk20wD0AAQABAAAAOQAEIsacQcA9AAEAAQAAADkABDRHiMQ=", "client_bytes" : 91, "client_pkts" : 1, "flowstart_time" : 1680618973, "server_bytes" : 227, "server_pkts" : 1 }

What is provided

Rules to normalize and enrich Snort 3 log messages.

Snort 3 log message processing

The Illuminate processing of Snort 3 log messages provides the following:

  • Field extraction, normalization, and message enrichment for Snort 3 log messages (IDS and AppID).

  • GIM categorization of the following messages:

Snort 3 log type

GIM category

GIM subcategory

ids

alert

alert.default

appid

network

network.default

Use cases

Snort is used to monitor networks for malicious packets and threats. Functioning as either an IDS or an IPS, Snort can analyze and compare traffic against thousands of signatures and application detectors, to provide a high-level overview of a network.

Examples of what you can monitor using this content pack: unauthorized hosts or users, misconfigured devices (DNS, hostname, etc.), devices beaconing to malicious IPs, brute force attacks or policy violations.

Snort Spotlight content pack

The Snort Spotlight content pack contains the following dashboards: Snort 3 Overview, Snort IDS Overview, and Snort App ID Overview.

SonicWall NGFW content pack

SonicWall Next-Gen Firewalls (NGFW) include a range of products (NSsp, NSa, NSv, and TZ network security appliances) that provide application inspection, IDS/IPS, VPN, and traditional firewall functionality. This technology pack will process SonicWall NGFW event log messages, providing normalization, enrichment, and categorization of common events of interest.

Requirements

  • SonicWall NGFW device running SonicOS version 6.5, 7.0, or later

  • SonicWall device configured to send logs to Security Data Lake via syslog

  • SonicWall device configured to send enhanced syslog format

Stream configuration

This technology pack includes one stream:

  • “Illuminate:SonicWall Device Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “SonicWall Device Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

id=SDF2lk3rj sn=SD2342LJFS time="2022-04-22 11:02:41" fw=10.1.2.3 pri=4 c=1024 m=537 msg="Connection Closed" app=2 n=23593520 src=192.168.10.20:53323:IF0 dst=10.0.130.15:53:IF1 srcMac=00:15:5d:a1:a2:08 dstMac=f8:0f:6f:a8:a2:21 proto=udp/dns sent=85 rcvd=117 spkt=1 rpkt=1 cdur=30633 rule="3 (LAN->WAN)" fw_action="NA"

What Is provided

  • Rules to normalize and enrich event log messages

  • A Spotlight content pack

Log message processing

Illuminate will identify SonicWall NGFW event log messages and add the event_source_product field, with sonicwall_ngfw as the value.

The Illuminate processing of SonicWall NGFW log messages provides the following:

  • Field extraction, normalization and message enrichment for SonicWall log messages

  • Security Data Lake Schema compliance

  • GIM categorization of the following messages:

SonicWall event code

gim_event_category

gim_event_subcategory

gim_event_type

10

endpoint

endpoint.service

service error

22

alert

alert.network alert

network alert

23

alert

alert.network alert

network alert

24

authentication

authentication.logoff

session disconnect

25

alert

alert.network alert

network alert

27

alert

alert.network alert

network alert

28

alert

alert.network alert

network alert

31

authentication

authentication.logon,authentication.credential validation

logon

32

authentication

authentication.logon,authentication.credential validation

logon

33

authentication

authentication.logon,authentication.credential validation

logon

34

authentication

authentication.credential validation

error

81

alert

alert.network alert

network alert

82

alert

alert.network alert

network alert

83

alert

alert.network alert

network alert

139

authentication

authentication.logon,authentication.credential validation

logon

140

authentication

authentication.logon,authentication.credential validation

logon

141

authentication

authentication.access notice

error

150

endpoint

endpoint.process

process stopped

151

endpoint

endpoint.process

process stopped

177

alert

alert.network alert

network alert

178

alert

alert.network alert

network alert

179

alert

alert.network alert

network alert

229

alert

alert.network alert

network alert

237

authentication

authentication.logon,authentication.credential validation

logon

238

authentication

authentication.logon,authentication.credential validation

logon

243

authentication

authentication.logon,authentication.credential validation

logon

244

authentication

authentication.logon,authentication.credential validation

logon

245

authentication

authentication.logon,authentication.credential validation

logon

246

authentication

authentication.logon,authentication.credential validation

logon

248

alert

alert.network alert

network alert

267

alert

alert.network alert

network alert

328

iam

iam.object modify

account renamed

437

alert

alert.network alert

network alert

440

endpoint

endpoint.service

configuration change

441

endpoint

endpoint.service

configuration change

442

endpoint

endpoint.service

configuration change

446

alert

alert.network alert

network alert

486

authentication

authentication.logon,authentication.credential validation

logon

506

endpoint

endpoint.service

service stopped

508

endpoint

endpoint.service

service stopped

527

endpoint

endpoint.ports

port closed

528

endpoint

endpoint.ports

port closed

538

endpoint

endpoint.ports

port closed

546

alert

alert.network alert

network alert

548

alert

alert.network alert

network alert

549

authentication

authentication.access policy

device policy violation

560

iam

iam.object disable

account disabled

561

iam

iam.object enable

account enabled

564

authentication

authentication.logoff

session disconnect

580

alert

alert.network alert

network alert

583

alert

alert.network alert

network alert

606

alert

alert.network alert

network alert

608

alert

alert.network alert

network alert

609

alert

alert.network alert

network alert

656

authentication

authentication.credential validation

error

669

endpoint

endpoint.service

service error

676

endpoint

endpoint.default

endpoint message

677

endpoint

endpoint.default

endpoint message

682

endpoint

endpoint.default

endpoint message

701

endpoint

endpoint.default

endpoint message

728

endpoint

endpoint.service

service stopped

734

endpoint

endpoint.default

endpoint message

735

endpoint

endpoint.default

endpoint message

737

authentication

authentication.credential validation

error

744

authentication

authentication.access notice

error

745

authentication

authentication.access notice

error

746

authentication

authentication.access notice

error

747

authentication

authentication.access notice

error

748

authentication

authentication.access notice

error

749

authentication

authentication.access notice

error

750

authentication

authentication.access notice

error

751

authentication

authentication.access notice

error

752

authentication

authentication.access notice

error

753

authentication

authentication.access notice

error

754

authentication

authentication.access notice

error

755

authentication

authentication.access notice

error

756

authentication

authentication.access notice

error

757

authentication

authentication.access notice

error

758

authentication

authentication.access notice

error

759

authentication

authentication.access notice

error

789

alert

alert.network alert

network alert

790

alert

alert.network alert

network alert

793

alert

alert.network alert

network alert

794

alert

alert.network alert

network alert

795

alert

alert.network alert

network alert

809

alert

alert.network alert

network alert

864

alert

alert.network alert

network alert

866

alert

alert.network alert

network alert

868

alert

alert.network alert

network alert

879

alert

alert.default

alert message

881

endpoint

endpoint.configuration

system time changed

882

http,network

http.communication,network.network connection

network http communication

883

endpoint

endpoint.default

endpoint message

884

endpoint

endpoint.default

endpoint message

885

endpoint

endpoint.default

endpoint message

886

endpoint

endpoint.default

endpoint message

897

alert

alert.network alert

network alert

898

alert

alert.network alert

network alert

904

alert

alert.default

alert message

905

alert

alert.default

alert message

913

authentication

authentication.credential validation

error

987

authentication

authentication.credential validation

error

988

authentication

authentication.access notice

error

989

authentication

authentication.access notice

error

990

authentication

authentication.access notice

error

991

authentication

authentication.access notice

error

992

authentication

authentication.default

authentication message

993

authentication

authentication.default

authentication message

994

endpoint

endpoint.service

configuration change

995

endpoint

endpoint.service

configuration change

996

authentication

authentication.default

authentication message

997

authentication

authentication.default

authentication message

998

authentication

authentication.default

authentication message

999

endpoint

endpoint.default

endpoint message

1000

endpoint

endpoint.default

endpoint message

1001

endpoint

endpoint.default

endpoint message

1002

endpoint

endpoint.default

endpoint message

1003

endpoint

endpoint.default

endpoint message

1004

endpoint

endpoint.default

endpoint message

1005

endpoint

endpoint.default

endpoint message

1006

endpoint

endpoint.default

endpoint message

1011

iam

iam.object modify

password change

1033

authentication

authentication.access notice

error

1035

authentication

authentication.logon,authentication.credential validation

logon

1048

iam

iam.object modify

password change

1049

endpoint

endpoint.filesystem

file modified

1058

endpoint

endpoint.process

process altered

1059

endpoint

endpoint.process

process altered

1073

authentication

authentication.access notice

error

1075

authentication

authentication.kerberos request

error

1076

authentication

authentication.default

authentication message

1080

authentication

authentication.logon,authentication.credential validation

logon

1085

endpoint

endpoint.service

service stopped

1088

endpoint

endpoint.service

service error

1089

endpoint

endpoint.service

service error

1091

alert

alert.network alert

network alert

1092

alert

alert.network alert

network alert

1093

alert

alert.network alert

network alert

1117

authentication

authentication.default

authentication message

1118

authentication

authentication.default

authentication message

1119

authentication

authentication.default

authentication message

1120

authentication

authentication.default

authentication message

1121

authentication

authentication.default

authentication message

1122

authentication

authentication.default

authentication message

1123

authentication

authentication.default

authentication message

1157

iam

iam.object disable

account disabled

1158

iam

iam.object disable

account disabled

1180

alert

alert.default

alert message

1181

alert

alert.default

alert message

1190

iam

iam.object modify

group member added

1191

iam

iam.object modify

group member removed

1192

iam

iam.object modify

group member added

1193

iam

iam.object modify

group member removed

1198

alert

alert.default

alert message

1199

alert

alert.default

alert message

1200

alert

alert.default

alert message

1201

alert

alert.default

alert message

1202

authentication

authentication.default

authentication message

1203

authentication

authentication.default

authentication message

1204

authentication

authentication.default

authentication message

1209

alert

alert.default

alert message

1210

alert

alert.default

alert message

1211

alert

alert.default

alert message

1212

alert

alert.default

alert message

1213

alert

alert.default

alert message

1214

alert

alert.default

alert message

1226

http,network

http.communication,network.network connection

network http communication

1227

authentication

authentication.access policy

account policy violation

1229

network

network.default

network message

1231

endpoint

endpoint.configuration

system time changed

1243

authentication

authentication.credential validation

error

1316

alert

alert.default

alert message

1336

endpoint

endpoint.service

configuration change

1337

iam

iam.object modify

password change

1338

iam

iam.object modify

password change

1341

authentication

authentication.default

authentication message

1342

authentication

authentication.default

authentication message

1363

alert

alert.default

alert message

1366

alert

alert.default

alert message

1367

alert

alert.default

alert message

1369

alert

alert.network alert

network alert

1373

alert

alert.network alert

network alert

1374

alert

alert.network alert

network alert

1375

alert

alert.network alert

network alert

1376

alert

alert.network alert

network alert

1378

alert

alert.default

alert message

1382

endpoint

endpoint.audit

audit policy changed

1383

endpoint

endpoint.audit

audit error

1387

alert

alert.network alert

network alert

1393

endpoint

endpoint.service

service stopped

1432

endpoint

endpoint.service

configuration change

1438

endpoint

endpoint.configuration

system configuration modified

1439

endpoint

endpoint.configuration

system configuration modified

1440

endpoint

endpoint.configuration

system configuration modified

1441

endpoint

endpoint.configuration

system configuration modified

1450

alert

alert.default

alert message

1471

alert

alert.default

alert message

1490

http,network

http.communication,network.network connection

network http communication

1491

http,network

http.communication,network.network connection

network http communication

1517

authentication

authentication.credential validation

error

1518

alert

alert.default

alert message

1519

alert

alert.default

alert message

1522

endpoint

endpoint.default

endpoint message

1524

endpoint

endpoint.default

endpoint message

1525

endpoint

endpoint.default

endpoint message

1526

endpoint

endpoint.default

endpoint message

1552

authentication

authentication.credential validation

error

1553

authentication

authentication.credential validation

error

1554

authentication

authentication.credential validation

error

1555

authentication

authentication.credential validation

error

1556

authentication

authentication.credential validation

error

1557

authentication

authentication.credential validation

error

1572

authentication

authentication.logon,authentication.credential validation

logon

1585

authentication

authentication.logon,authentication.credential validation

logon

1590

endpoint

endpoint.configuration

system configuration modified

1595

endpoint

endpoint.default

endpoint message

1596

endpoint

endpoint.default

endpoint message

1599

endpoint

endpoint.configuration

system configuration modified

1600

endpoint

endpoint.configuration

system configuration modified

1601

endpoint

endpoint.configuration

system configuration modified

1627

iam

iam.object disable

account disabled

1632

endpoint

endpoint.service

service stopped

1634

endpoint

endpoint.service

service removed

1635

endpoint

endpoint.service

service error

1636

endpoint

endpoint.default

endpoint message

1637

endpoint

endpoint.default

endpoint message

1640

endpoint

endpoint.service

configuration change

1642

endpoint

endpoint.ports

port closed

1655

authentication

authentication.access policy

account policy violation

1674

endpoint

endpoint.audit

audit policy changed

Note

Events associated with the built-in administrative account

SonicWall NGFW devices are configured with a built-in Administrator account. The default name for this account is Admin, but the name can be altered by the user. Some events are logged by the SonicWall devices related to this account, which do not include the actual user name but instead just refer to Administrator. Illuminate will assign a user_name value of Administrator for these events.

Severity mapping

SonicWall devices have different severity level assignments, which are mapped to the Security Data Lake schema severity levels, in the event_severity and event_severity_level fields.

vendor_event_severity_severity

vendor_event_severity

event_severity_level

event_severity

0

Emergency

5

critical

1

Alert

5

critical

2

Critical

5

critical

3

Error

4

high

4

Warning

3

medium

5

Notice

2

low

6

Info

1

informational

7

Debug

1

informational

Spotlight content pack

The Spotlight content pack contains:

  • Dashboard: SonicWall NGFW Overview

    • Overview tab: Summary of SonicWall device operations.

    • Alerts tab: Summary of SonicWall GIM categorized alerts

    • Network tab: Summary of network traffic

    • VPN tab: Summary of VPN activity

  • Saved search: SonicWall NGFW alert log viewer

    • View SonicWall NGFW GIM categorized security alerts

  • Saved search: SonicWall NGFW log viewer - filtered

    • Filter SonicWall NGFW logs by vendor severity, from the most critical level (0 - Emergency) to the least (7 - debug)

  • Saved search: SonicWall NGFW log viewer

    • Saved search to view SonicWall NGFW event log messages

  • Saved search: SonicWall NGFW VPN log viewer

    • Saved search to view SonicWall NGFW VPN, SSL VPN, L2TP, and portal messages

Sophos Central content pack

Sophos Central is a cloud-based unified security management platform that delivers centralized administration, threat detection, and policy enforcement across a range of security services encompassing network, endpoint, server, mobile, and email security. This content pack extracts fields from Sophos Central Endpoint Protection telemetry and event messages and normalizes them to align with the Security Data Lake schema.

Supported versions

Sophos Central is a continuously updated managed service that does not feature version numbers. This pack was built and tested for integration with the Sophos Central SIEM Integration v1 API. In addition, parsing is designed around Sophos Central events sourced from Windows endpoints. Events from other OS platforms such as macOS may be supported, but not fully tested.

Requirements

  • Sophos Endpoint agent installed on client hosts with Endpoint Protection policies enabled

  • Sophos Central API credentials created for use with the Security Data Lake Sophos Central input

What is provided

  • Extraction of fields, normalization, and enrichment of Sophos Central Endpoint Protection event logs

  • A dashboard for monitoring threat detections and affected endpoints

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Sophos Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Sophos Device Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

You can configure the Sophos Central input in Security Data Lake to securely access the Sophos Central SIEM Integration API for log data retrieval.

Configuring a Sophos Central input

For Security Data Lake to access Sophos Central logs via API, it needs API credentials:

  1. Create API credentials in Sophos Central Admin. The assigned role must have read capabilities and access to queries, such as Service Principal Super Admin. For details, refer to the API Credentials section of the Sophos Central documentation.

  2. Copy the generated Client ID and Client Secret and store them securely.

  3. Launch a Sophos Central input in Security Data Lake. When prompted, provide the previously obtained Sophos Client ID and Secret.

  4. Optionally configure the following input options:

    • Ingest Alerts: Whether to ingest Sophos alerts in addition to events.

    • Polling Interval: How often (in minutes) the input will check for new log data. We recommend using the default value of 5 minutes.

    • Enable Throttling: If enabled, it will stop reading new data for this input whenever the system falls behind on message processing and needs to catch up.

  5. Save the input settings.

If the input does not start automatically, select Start Input to begin retrieving and processing messages from the configured Sophos Central server.

Note

This pack rewrites the message field to reduce license utilization. To get the full message, set Store full message in the input settings to true.

Log format example

{"type":"Event::Endpoint::CoreDetection","origin":"SAV","created_at":"2025-01-24T11:32:22.544Z","source_info":{"ip":"192.168.40.176"},"customer_id":"aabbccdd-1234-5678-abcd-ef1234567890","severity":"medium","endpoint_id":"10a1a0aa-aa10-10aa-1010-a01a1aaa01a0","endpoint_type":"computer","user_id":"671565c8eeddce2b21c52a24","threat":"Mal/Kryptik-DL","when":"2025-01-24T11:32:11.870Z","appSha256":"43670ae43df9e361fa15f09f611da32db104ee207ed5af3e7e7f098ad82a68e0","source":"DESKTOP-JDVP7LN\Test234","location":"DESKTOP-JDVP7LN","id":"cc29ad5d-3e42-20da-8790-03f87f291fa6","group":"MALWARE","name":"Malware detected: 'Mal/Kryptik-DL' at 'C:\Users\Test234\Downloads\43670ae43df9e361fa15f09f611da32db104ee207ed5af3e7e7f098ad82a68e0'"}

Event groups processed

Logs from event groups not included will have generic processing applied:

  • APPLICATION_CONTROL

  • DATA_LOSS_PREVENTION

  • DENC

  • MALWARE

  • PERIPHERALS

  • PROTECTION

  • PUA

  • SYSTEM_HEALTH

  • UPDATING

  • WEB

Sophos Central Spotlight content pack

The Spotlight content pack provides Overview and Threat Events tabs.

Stormshield content pack

The Stormshield firewall is a security solution that provides real-time protection, control, supervision, and content filtering via IPS, application control, AV, URL filtering, vulnerability detection, anti-spam, etc. This technology pack will process Stormshield log messages, providing normalization and enrichment of common events of interest.

Prerequisites

Stormshield Firewall running Stormshield Network Security (SNS) version 2+.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Stormshield Firewall Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Stormshield Firewall Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

id=firewall time="2022-11-25 16:30:33" fw="SN710_ABCD" tz=+0100 startime="2022-11-25 16:30:32" pri=5 confid=01 slotlevel=2 ruleid=208 srcif="vlan4" srcifname="20_SOMETHING" ipproto=tcp dstif="vlan3" dstifname="1000_XYZ" proto=http_proxy src=10.10.20.13 srcport=42006 srcportname=ephemeral_fw_tcp srcname=SOMENAME srcmac=xx:6b:8d:9a:da:13 dst=192.168.1.1 dstport=8080 dstportname=http_proxy dstname=Protect-DMZ ipv=4 sent=0 rcvd=0 duration=0.00 action=pass logtype="filter"

Requirements

  • Configure Stormshield Firewall to transmit Syslog to your Security Data Lake Syslog input.

What is provided

  • Rules to normalize and enrich Stormshield firewall log messages.

  • A Stormshield Spotlight content pack (dashboard and saved search).

Stormshield Firewall log message processing

The Illuminate processing of Stormshield Firewall log messages provides the following:

  • Field extraction and normalization, and message enrichment for Stormshield Firewall log messages.

  • GIM categorization of the following messages:

Stormshield Firewall logtype

GIM category

GIM subcategory

filter

network

network.connection

connection

network

network.connection

alarm

alert

alert.default

Stormshield Firewall Spotlight content pack

The Stormshield Firewall Spotlight content pack contains:

  • Dashboard: Stormshield Network Firewall Overview

    • Overview tab

    • Alerts tab

  • Saved Search: Stormshield Firewall Log Viewer

    • Saved search based on event severity

Symantec Endpoint content pack

Symantec Endpoint Protection is a security software suite that consists of anti-malware, intrusion prevention, and firewall features for server and desktop computers. This technology pack will process Symantec logs, providing normalization and enrichment of common events of interest.

Supported versions

  • 14.3.8268.5000

Stream configuration

This technology pack includes one stream:

  • “Illuminate: Symantec Device Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Symantec Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Event types supported

  • Server Administration

  • Application and Device Control

  • Server Client-Server Policy

  • Server System

  • Client Packet

  • Client Proactive Threat

  • Client Risk

  • Client Scan

  • Client Security

  • Client System

  • Client Traffic

Log format examples

Server administration admin

WIN-TFB8L7BI77H SymantecServer: Site: My Site,Server Name: WIN-TFB8L7BI77H,Domain Name: Default,Admin: admin,Event Description: Administrator log on succeeded

Application and device control

Behavior

WIN-TFB8L7BI77H SymantecServer: WIN-TFB8L7BI77H,172.16.14.42,Blocked, - Caller SHA256=e6b2c506042ff50415668cb9d0f24c34c2cf080f1023ca9565fdb846ccd39b53 - Target MD5=9a1d9fe9b1223273c314632d04008384 - Target Arguments='',Create Process,Begin: 2023-01-11 18:38:09,End Time: 2023-01-11 18:38:09,Rule: Rule 1 | Block anydesk.exe,10060,C:/Windows/explorer.exe,0,No Module Name,C:/Users/Administrator/Downloads/AnyDesk.exe,User Name: Administrator,Domain Name: WIN-TFB8L7BI77H,Action Type: ,File size (bytes): 399808,Device ID: SCSI\Disk&amp;Ven_&amp;Prod_ST500DM002-1BD14\4&amp;37da426a&amp;0&amp;000000

Agent

WIN-TFB8L7BI77H SymantecServer: Site: My Site,Server Name: WIN-TFB8L7BI77H,Domain Name: Default,The management server received the client log successfully,WIN-TFB8L7BI77H,Administrator,LocalComputer

Server client-server policy

WIN-TFB8L7BI77H SymantecServer: Site: My Site,Server Name: WIN-TFB8L7BI77H,Domain Name: Default,Admin: admin,Event Description: Policy has been edited: Edited shared Firewall policy: Firewall policy,Firewall policy

Server system

WIN-TFB8L7BI77H SymantecServer: Site: My Site,Server Name: WIN-TFB8L7BI77H,Event Description: Failed to connect to the syslog server. External logging cannot proceed until the problem is resolved.

Client packet

WIN-TFB8L7BI77H SymantecServer: WIN-Client,Local Host IP: 172.16.14.42,Local: 3,Remote Host IP: 172.16.14.10,Remote Host Name: ceredox-dc01.ceredox.comd,Remote: 3,Outbound,Application: ,Action: Blocked

Client proactive threat

WIN-TFB8L7BI77H SymantecServer: Security risk found,Computer name: WIN-Client,IP Address: 172.16.14.42,Detection type: Suspicious Behavior Detection,First Seen: Reputation was not used in this detection.,Application name: Microsoft® Windows® Operating System,Application type: Trojan Worm,Application version: 10.0.17763.1,Hash type: SHA-256,Application hash: 85dd6f8edf142f53746a51d11dcba853104bb0207cdf2d6c3529917c3c0fc8df,Company name: Microsoft Corporation,File size (bytes): 1652736,Sensitivity: 1,Detection score: 0,COH Engine Version: ,Detection Submissions No,Allowed application reason: Not on the allow list,Disposition: Good,Download site: ,Web domain: ,Downloaded by: ,Prevalence: Reputation was not used in this detection.,Confidence: Reputation was not used in this detection.,URL Tracking Status: Off,Risk Level: High,Risk type: BPE,Source: SONAR Scan,Risk name: SONAR.SuspPE!gen43,Occurrences: 1,c:\windows\system32\certutil.exe,,Actual action: Access denied,Requested action: Left alone,Secondary action: Left alone,Event time: 2023-01-11 01:29:36,Event Insert Time: 2023-01-11 01:31:24,End Time: 2023-01-11 01:29:36,Domain Name: Default,Group Name: My Company\\Test,Server Name: WIN-TFB8L7BI77H,User Name: Administrator,Source Computer Name: ,Source Computer IP: ,Location: ,Intensive Protection Level: 0,Certificate issuer: Microsoft Windows,Certificate signer: Microsoft Windows Production PCA 2011,Certificate thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452,Signing timestamp: 1536994988,Certificate serial number: 33000001C422B2F79B793DACB20000000001C4

Client risk

WIN-TFB8L7BI77H SymantecServer: Virus found,IP Address: 172.16.14.42,Computer name: WIN-Client,Source: Auto-Protect scan,Risk name: EICAR Test String,Occurrences: 1,File path: C:\Users\Administrator\Downloads\eicar_com.zip,Description: ,Actual action: Cleaned by deletion,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2023-01-12 12:25:36,Event Insert Time: 2023-01-12 12:27:05,End Time: 2023-01-12 12:25:36,Last update time: 2023-01-12 12:27:05,Domain Name: Default,Group Name: My Company\Test,Server Name: WIN-TFB8L7BI77H,User Name: Administrator,Source Computer Name: ,Source Computer IP: ,Disposition: Bad,Download site: [https://secure.eicar.org/eicar_com.zip,Web](https://secure.eicar.org/eicar_com.zip,Web) domain: [secure.eicar.org](http://secure.eicar.org/),Downloaded by: chrome.exe,Prevalence: This file has been seen by hundreds of thousands of Symantec users.,Confidence: This file is untrustworthy.,URL Tracking Status: On,First Seen: Symantec has known about this file for more than 1 year.,Sensitivity: ,Allowed application reason: Not on the allow list,Application hash: 2546DCFFC5AD854D4DDC64FBF056871CD5A00F2471CB7A5BFD4AC23B6E9EEDAD,Hash type: SHA2,Company name: ,Application name: eicar_com.zip,Application version: ,Application type: 127,File size (bytes): 184,Category set: Malware,Category type: Virus,Location: Default,Intensive Protection Level: 0,Certificate issuer: ,Certificate signer: ,Certificate thumbprint: ,Signing timestamp: 0,Certificate serial number:

Client scan

WIN-TFB8L7BI77H SymantecServer: Scan ID: 1673417071,Begin: 2023-01-12 11:25:12,End Time: 2023-01-12 11:25:50,Completed,Duration (seconds): 38,User1: SYSTEM,User2: SYSTEM,Scan started on selected drives and folders and all extensions.,Scan Complete: Risks: 0 Scanned: 1102 Files/Folders/Drives Omitted: 0 Trusted Files Skipped: 748,Command: Not a command scan (),Threats: 0,Infected: 0,Total files: 1102,Omitted: 0,Computer: WIN-TFB8L7BI77H,IP Address: 172.16.14.42,Domain Name: Default,Group Name: My Company\Test,Server Name: WIN-TFB8L7BI77H,Scan Type: DefWatch

Client security

WIN-TFB8L7BI77H SymantecServer: WIN-TFB8L7BI77H,Event Description: [SID: 60501] URL reputation: Browser navigation to known bad URL attack blocked. Traffic has been blocked for this application: C:\Program Files\Google\Chrome\Application\Chrome.exe,Event Type: Browser Protection event,Local Host IP: 0.0.0.0,Local Host MAC: 000000000000,Remote Host Name: ,Remote Host IP: 0.0.0.0,Remote Host MAC: 000000000000,Outbound,OTHERS,,Begin: 2023-01-12 12:21:33,End Time: 2023-01-12 12:21:33,Occurrences: 1,Application: C:/Program Files/Google/Chrome/Application/chrome.exe,Location: Default,User Name: Administrator,Domain Name: WIN-TFB8L7BI77H,Local Port: 0,Remote Port: 0,CIDS Signature ID: 60501,CIDS Signature string: URL reputation: Browser navigation to known bad URL,CIDS Signature SubID: 0,Intrusion URL: http:/[www.eicar.eu/,Intrusion](http://www.eicar.eu/,Intrusion) Payload URL: ,SHA-256: ,MD-5: ,Intensive Protection Level: Level 1,URL Risk: N/A,URL Category: Malicious Sources/Malnets* Client SystemWIN-TFB8L7BI77H SymantecServer: WIN-Client,Category: 2,LiveUpdate Manager,Event Description: An update for Revocation Data was successfully installed. The new sequence number is 230112003.,Event time: 2023-01-12 15:29:51,Group Name: My Company\Test

Client traffic

WIN-TFB8L7BI77H SymantecServer: DESKTOP-D2IQ7II,Local Host IP: 172.16.14.58,Local Port: 3,Local Host MAC: F8B156BAD2E9,Remote Host IP: 8.8.8.8,Remote Host Name: dns.google,Remote Port: 3,Remote Host MAC: 001AE3B5F444,ICMP,Outbound,Begin: 2023-01-12 16:59:58,End Time: 2023-01-12 16:59:58,Occurrences: 1,Application: ,Rule: Block all other IP traffic and log,Location: Default,User Name: admin,Domain Name: DESKTOP-D2IQ7II,Action: Blocked,SHA-256: ,MD-5:

Requirements

  • Configure a TCP Syslog input in Security Data Lake. For details, refer to Syslog Inputs.

  • Configure Symantec Endpoint Protection Manager to transmit Syslog to your Syslog input.

    For SEPM output configuration, refer to the official documentation.

What is provided

  • Parsing rules to extract Symantec logs into Security Data Lake schema-compatible fields.

Categorized events

  • Client Risk: alert message

  • Client Security: alert message

  • Client Proactive Threat: alert message

  • Server Administration (log on event): logon

  • Server Administration (log off event): logoff

  • Server Administration (log on failed): logon

  • Server Administration (admin password change): administrative password reset

Note

Client Risk logs are set statically to alert_severity high.

SEPM supports three action types for the event types: Client Proactive Threat and Client Risk. The behavior is described as:

  • Actual action: The action SEP took to remediate the mentioned threat.

  • Requested action: This is the action SEP wants to perform and is usually the same as the actual action.

  • Secondary action: Action to take in case the actual action does not work.

Security Data Lake maps actual, requested, and secondary actions to:

  • Actual action: vendor_event_action

  • Requested action: vendor_requested_action

  • Secondary action: vendor_secondary_action

The logs are identified by the keyword SymantecServer.

Symantec Endpoint Spotlight content pack

The Symantec Endpoint Spotlight Content Pack comes bundled with the Symantec Endpoint Security Content Pack. This additional pack contains the following dashboards:

  • Symantec Endpoint Protection: Overview tab

  • Symantec Endpoint Protection: Alert tab

  • Symantec Endpoint Protection: Authentication tab

Symantec Endpoint Security Content Pack

Symantec Endpoint Security is a cloud and hybrid-managed solution that provides the protection of SEP, attack detection of EDR, and other technologies to secure devices.

Requirements

  • Symantec Endpoint Security Enterprise or Symantec Endpoint Security Complete license

  • Symantec Endpoint Security Loggings: Symantec Endpoint Security (SES) uses the Security Data Lake Symantec SES Events input, which ingests events and incident logs in JSON format, as seen in the log format example below.

Not supported

The following categories are not supported in this content pack:

  • Evidence of Compromise

  • Information Protection

  • License

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Symantec Endpoint Security Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Symantec Endpoint Security Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format examples

{"device_os_type_id":100,"lineage":["C:\\Users\\user2\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe"],"feature_uid":"1DF0351C-146D-4F07-B155-BF5C7077FF40","type":"event_query_results","seq_num":177,"ref_uid":"4D5B6F97-6101-4C7E-B922-930E25360417","legacy_product_uid":"d965a903-7d7a-7347-decb-101fd144c5bc","id":1,"product_uid":"31B0C880-0229-49E8-94C5-48D56B1BD7B9","feature_name":"DETECTION_RESPONSE","device_group":"Default","product_name":"Symantec Endpoint Security","version":"1.0.0","command_uid":"","device_ip":"192.168.1.3","device_vhost":1,"timezone":-330,"device_domain":"WORKGROUP","product_ver":"14.3.10148.8000","is_npvdi_client":false,"device_name":"DESKTOP-BP8KOJM","category_id":5,"device_networks":[{"ipv6":["2401:4900:1cb2:ea41:b45a:2aba:b9f5:c3ef","2401:4900:1cb2:ea41:c568:8e7a:5c3c:70aa","fe80:0000:0000:0000:af14:9b46:8337:5c4c"],"mac":"64:79:f0:cd:e9:02","ipv4":["192.168.1.3"]}],"device_os_name":"Windows 11 Professional Edition","type_id":8001,"actor":{"session_id":2,"pid":6932,"uid":"D157FA8E-DF80-F1EE-B896-84BC5A4C9DB5","tid":6468,"start_time":"2024-03-12T04:41:07.479Z","cmd_line":"\"C:\\Users\\user2\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe\" --system-initiated","integrity_id":3,"file":{"type_id":1,"created":"2024-03-11T09:36:04.367Z","modified":"2024-03-11T09:36:07.440Z","md5":"4989696e862d359ec09b75f4b2934b4b","sha2":"48cf3cfae4cc99eb5ed7b2fa0104fa8db47b6b13bc9e4c05103cc6b0265e9aeb","size":149479288,"signature_company_name":"Microsoft Corporation","signature_value_ids":[3,5],"security_descriptor":"O:S-1-5-21-2943851542-2441814902-1111111-1002G:S-1-5-21-2943851542-2441814902-1111111-513D:(A;;0x1fffff;;;S-1-5-21-2943851542-2441814902-1111111-1002)(A;;0x1fffff;;;SY)(A;;0x121411;;;S-1-5-5-0-43017645)S:AI","normalized_path":"CSIDL_PROFILE\\appdata\\local\\microsoft\\teams\\current\\teams.exe","path":"c:\\users\\user2\\appdata\\local\\microsoft\\teams\\current\\teams.exe","uid":"5629499534313427","name":"teams.exe","folder":"c:\\users\\user2\\appdata\\local\\microsoft\\teams\\current","original_name":"Teams.exe","signature_level_id":60},"user":{"name":"user1","sid":"S-1-5-21-2943851542-2441814902-1111111-1002","domain":"DESKTOP-BP8KOJM"}},"device_mac":"64:79:f0:cd:e9:02","device_uid":"HvM1Eew9SXmq8F-WGqkYtg","org_unit_uid":"DS-gzhR8RaWMhATsDmbsyg","severity_id":1,"logging_device_post_time":"2024-03-12T15:20:12.970Z","device_time":"2024-03-12T15:20:12.962Z","user_name":"user1","process":{"session_id":2,"pid":9352,"uid":"088F4DEC-E05C-F1EE-B896-84BC5A4C9DB5","start_time":"2024-03-12T15:20:12.962Z","cmd_line":"\"C:\\Users\\user2\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe\" --type=renderer --enable-wer --user-data-dir=\"C:\\Users\\user2\\AppData\\Roaming\\Microsoft\\Teams\" --ms-teams-less-cors=522133263 --app-user-model-id=com.squirrel.Teams.Teams --app-path=\"C:\\Users\\user2\\AppData\\Local\\Microsoft\\Teams\\current\\resources\\app.asar\" --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=309 --launch-time-ticks=111330447179 --mojo-platform-channel-handle=3992 --field-trial-handle=1852,i,7718261119285444314,14632190959189571843,131072 --enable-features=ContextBridgeMutability,SharedArrayBuffer,WinUseBrowserSpellChecker,WinUseHybridSpellChecker --disable-features=CalculateNativeWinOcclusion,ExtraCookieValidityChecks,ForcedColors,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1","integrity_id":2,"file":{"type_id":1,"created":"2024-03-11T09:36:04.367Z","modified":"2024-03-11T09:36:07.440Z","md5":"4989696e862d359ec09b75f4b2934b4b","sha2":"48cf3cfae4cc99eb5ed7b2fa0104fa8db47b6b13bc9e4c05103cc6b0265e9aeb","size":149479288,"signature_company_name":"Microsoft Corporation","signature_value_ids":[3,5],"security_descriptor":"O:S-1-5-21-2943851542-2441814902-1111111-1002G:S-1-5-21-2943851542-2441814902-1111111-513D:(A;;0x1fffff;;;S-1-5-21-2943851542-2441814902-1111111-1002)(A;;0x1fffff;;;SY)S:AI","normalized_path":"CSIDL_PROFILE\\appdata\\local\\microsoft\\teams\\current\\teams.exe","path":"c:\\users\\user2\\appdata\\local\\microsoft\\teams\\current\\teams.exe","uid":"5629499534313427","name":"teams.exe","folder":"c:\\users\\user2\\appdata\\local\\microsoft\\teams\\current","original_name":"Teams.exe","signature_level_id":60},"user":{"name":"user1","sid":"S-1-5-21-2943851542-2441814902-1111111-1002","domain":"DESKTOP-BP8KOJM"}},"edr_enriched_data":{"category_name":"Generic Data to be sent to Symantec EDR","category_id":201,"event_group_id":"9878AD19-4849-439E-A68A-7353D041C701","suspicion_score":50,"rule_id":1198,"rule_name":"eUserExecution","rule_description":"User execution detected"},"feature_ver":"edr/1.3.0","is_user_present":true,"event_data_type":"fdr","user":{"name":"user1"},"device_os_ver":"10.0.22621","policy":{"uid":"19caded7-de5f-4e05-8000-f71fd8151bb7","name":"Default Detection and Response Policy","version":"2"},"attacks":[{"technique_uid":"T1204","technique_name":"User Execution","tactic_ids":[2],"tactic_uids":["TA0002"]}],"customer_uid":"abc123","device_public_ip":"1.1.1.1","domain_uid":"xyz456","time":"2024-03-12T15:20:12.962Z","log_time":"2024-03-12T15:23:02.261Z","uuid":"8001:059e2820-e084-11ee-e526-000003a26ae1"}

What is provided

Rules to normalize and enrich Symantec Endpoint Security log messages.

Symantec Endpoint Security log message processing

The Illuminate processing of Symantec Endpoint Security log messages provides the following:

  • Field extraction, normalization and message enrichment for Symantec Endpoint Security log messages.

  • GIM Categorization of the following messages:

Vendor event ID

GIM category

GIM subcategory

8075

alert

alert.default

Symantec Endpoint Security Spotlight content pack

The Symantec Endpoint Protection Spotlight content pack contains:

  • Dashboard: Symantec Endpoint Security Overview

    Overview tab

    MITRE ATTACK Overview tab

  • Saved Search: Symantec Endpoint Security Correlation UID Log Viewer

    Log viewer

Symantec ProxySG content pack

Symantec ProxySG (Symantec Proxy Secure Gateway) is a next-generation web application firewall that delivers both comprehensive web security and WAN optimization. This technology pack will process ProxySG event log messages, providing normalization and enrichment of common events of interest.

Supported versions

  • Up to version 9.x

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Bluecoat Messages”

Index set configuration

This technology pack includes one index set definition:

  • “Bluecoat Event Log Messages”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

1812 2018-02-10 18:00:12 "DP1-DE1_ProxySG" 888 x.x.x.x bob - - OBSERVED "Business/Economy" https://www.szlb.net/ 200 TCP_NC_MISS GET image/jpeg http www.szlb.net 80 /templets/default/images/wap/bg-gray1.jpg - jpg "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:52.0) Gecko/20100101 Firefox/52.0" x.x.x.x 4385 367 - - 0 "client" client_connector "-" "-" x.x.x.x - - - - - none - - - - none - - ICAP_NOT_SCANNED - ICAP_NOT_SCANNED - - - - 9eef3983b1d826f3-00000000c3a3468b-000000005a7f332b

Requirements

  • Configure the Symantec ProxySG appliance to transmit Syslog to your Security Data Lake Syslog input.

  • The Symantec ProxySG technology pack expects the fields in the following order, with the x-bluecoat-request-tenant-id field being optional:

    • x-bluecoat-request-tenant-id

    • date

    • time

    • x-bluecoat-appliance-name

    • time-taken

    • c-ip

    • cs-userdn

    • cs-auth-groups

    • x-exception-id

    • sc-filter-result

    • cs-categories

    • cs(Referer)

    • sc-status

    • s-action

    • cs-method

    • rs(Content-Type)

    • cs-uri-scheme

    • cs-host

    • cs-uri-port

    • cs-uri-path

    • cs-uri-query

    • cs-uri-extension

    • cs(User-Agent)

    • s-ip

    • sc-bytes

    • cs-bytes

    • x-data-leak-detected

    • x-virus-id

    • x-bluecoat-location-id

    • x-bluecoat-location-name

    • x-bluecoat-access-type

    • x-bluecoat-application-name

    • x-bluecoat-application-operation

    • r-ip

    • x-rs-certificate-validate-status

    • x-rs-certificate-observed-errors

    • x-cs-ocsp-error

    • x-rs-ocsp-error

    • x-rs-connection-negotiated-ssl-version

    • x-rs-connection-negotiated-cipher

    • x-rs-connection-negotiated-cipher-size

    • x-rs-certificate-hostname

    • x-rs-certificate-hostname-categories

    • x-cs-connection-negotiated-ssl-version

    • x-cs-connection-negotiated-cipher

    • x-cs-connection-negotiated-cipher-size

    • x-cs-certificate-subject

    • cs-icap-status

    • cs-icap-error-details

    • rs-icap-status

    • rs-icap-error-details

    • x-cloud-rs

    • x-bluecoat-placeholder

    • cs(X-Requested-With)

    • x-bluecoat-transaction-uuid

What is provided

  • Parsing rules to extract Symantec ProxySG logs into Security Data Lake schema-compatible fields.

Sysmon Content Pack

Microsoft Sysmon is a free agent that can be installed on Windows systems and configured to provide rich details about events of particular interest when performing security monitoring of systems. This technology pack will process all Sysmon event log messages produced by recent and current versions of Sysmon. This technology pack will process Sysmon logs, providing normalization and enrichment of common events of interest.

Supported versions

  • Sysmon version 12 or later.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Sysmon;Messages”, which contains all events collected from the Sysmon event log.

Index set configuration

This technology pack includes one index set definition:

  • “Sysmon Event Log Messages,” which contains all messages from the Windows Sysmon event log.

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Requirements

  • Sysmon event logs delivered to Security Data Lake by Winlogbeat 7.x or NXLog 2.10, 3.0 or 3.1 via the Bitdefender Forwarder.

Log delivery configuration

The log delivery agent, either Winlogbeat or NXLog, must be configured to collect Sysmon events from the Windows event log service. Examples are listed below; however, to properly configure the log delivery agent to support your requirements, refer to the agent’s configuration documentation.

Note

To apply the log delivery agent configuration for either Winlogbeat or NXLog, you must install and configure Sidecar on the host machine. For more information, refer to Sidecars.

Agent configuration - Winlogbeat 7.x

Under the event_logs: section of the Winlogbeat configuration, add the following line:

name: Microsoft-Windows-Sysmon/Operational

Note that using Winlogbeat requires a Beats input to be defined in Security Data Lake. For details, refer to Beats Input.

Agent configuration - NXLog 2.10, 3.0 or 3.1

In the QueryXML section of the NXLog configuration, add the following:

<Select Path='Microsoft-Windows-Sysmon/Operational'>*</Select>

Note that using NXLog requires a GELF TCP input to be defined in Security Data Lake. For details, refer to GELF.

The example below shows a working configuration file for Sysmon (Security, Application, System, Powershell).

This configuration requires that you install NXLog 3.x in C:\Program Files (x86)\nxlog and not in the default folder.

The Host and Port are examples; use your Bitdefender Forwarder values.

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension logrotate>
    Module  xm_fileop
    <Schedule>
        When    @daily
        Exec    file_cycle('%ROOT%\data\nxlog.log', 7);
     </Schedule>
</Extension>

<Extension gelfExt>
  Module xm_gelf
  # Avoid truncation of the short_message field to 64 characters.
  ShortMessageLength 65536
</Extension>

<Input eventlog>
        Module im_msvistalog
        PollInterval 1
        SavePos False
        ReadFromLast True
    <QueryXML>
        <QueryList>
            <Query Id='1'>
                <Select Path='Security'>*</Select>
                <Select Path="Application">*</Select>
                <Select Path="System">*</Select>
                <Select Path="Microsoft-Windows-PowerShell/Operational">*</Select>
                <Select Path='Microsoft-Windows-Sysmon/Operational'>*</Select>
            </Query>
        </QueryList>
    </QueryXML>
</Input>

<Output gelf>
Module om_tcp
Host 192.168.122.40
Port 12244
OutputType  GELF_TCP
<Exec>
 # These fields are needed for Security Data Lake
 $gl2_source_collector = '${sidecar.nodeId}';
 $collector_node_id = '${sidecar.nodeName}';
</Exec>
</Output>

<Route route-1>
  Path eventlog => gelf
</Route>>

What is provided

  • Parsing rules to extract Sysmon logs into Security Data Lake schema-compatible fields

  • Security Data Lake Information Model message categorization

  • Illuminate spotlight

Events processed by this technology pack

  • The Sysmon technology pack will process all Sysmon event IDs.

Ubiquiti UniFi Content Pack

Ubiquiti UniFi is a family of monitoring products that range from wireless access points, routers, switches, security cameras, and controllers (cloud or on-prem), all working together to provide a cohesive overview of your environment. This technology pack will process UniFi log messages for UniFi OS, UniFi Network, and UniFi Protect by providing normalization and enrichment for common events of interest.

Requirements

  • UniFi devices running UniFi OS 3.0+, Network 7.3+, and Protect 2.7+

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Ubiquiti UniFi Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Ubiquiti Unifi Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

APSomewhere f091234518f6,UAP-AC-Pro-Gen2-6.2.49+14111: dnsmasq[4797]: forwarded www.example.org to 10.10.10.10

APAnywhere f09fc2dc18f6,UAP-AC-Pro-Gen2-6.2.49+14111: /usr/sbin/hostapd[16441]: WPA: Encrypt Key Data using AES-WRAP (KEK length 16)

Configuration requirements

Due to the way UniFi controllers (e.g. Dream Machine Pro) generate some logs (syslog notation of path, process name, and process ID), identifying and parsing these logs can be difficult. To solve this problem, a UniFi specific input in Security Data Lake and an Illuminate lookup override must be configured. This will allow Illuminate to treat every log sent to this input as a UniFi message by mapping the input ID to the Unifi Illuminate identification rule. This should be unique to UniFi to ensure that this pack only processes UniFi logs.

Security Data Lake configuration

  1. Create a new syslog input and choose an unused port. If an input already exists that only handles UniFi logs, use that input. If using a new or existing forwarder, create a new input as part of the forwarder setup process or use the input already associated with an existing forwarder.

  2. Once the input is created, select Show received messages to obtain the input ID. This will display a search window with the All Time timeframe. If there is a large number of logs, you might want to adjust the timeframe to speed up the process.

  3. Copy the gl2_source_input value.

  4. 4. Go to Enterprise > Illuminate and click the Customization tab.

  5. 5. Locate lookup_adapter_input_routing and select Edit. For the content_name key, enter ubiquiti_unifi. For the input_id value, enter the gl2_source_input ID you copied earlier.

  6. 6. Click Configure value to confirm.

Now, all logs sent to the configured input will be identified as a UniFi logs, ensuring proper Illuminate processing.

UniFi configuration

  1. Enable remote logging in the UniFi Network Sytem settings page, under Support.

  2. Set Logging Levels to Auto.

  3. In the Remote Logging Location settings, make sure that Remote Server is enabled, Syslog is selected, and the Host details match your Bitdefender Forwarder IP address and port. The port is especially important when configuring UniFi logging, as it must match the port configured for the input, as specified above, in the Security Data Lake configuration section.

Settings Syslog.png

What is provided

  • Rules to normalize and enrich Ubiquiti UniFi log messages

Ubiquiti UniFi log message processing

The Illuminate processing of UniFi log messages provides the following:

  • Field extraction, normalization, and message enrichment for UniFi log messages

  • GIM categorization of the following messages:

UniFi log type

GIM category

GIM subcategory

firewall

network

network.default

dnsmasq

name resolution

name resolution.dns request

dnsmasq

name resolution

name resolution.dns request, name resolution.dns answer

dnsmasq-dhcp

dhcp

dhcp.request

dnsmasq-dhcp

dhcp

dhcp.discovery

dnsmasq-dhcp

dhcp

dhcp.offer

dnsmasq-dhcp

dhcp

dhcp.acknowledgement

dnsmasq-dhcp

dhcp

dhcp.default

Ubiquiti UniFi Spotlight content pack

  • Spotlight content for this pack does not exist at this time.

Watchguard Firebox Content Pack

WatchGuard Firebox is a unified security platform that covers traditional traffic, protecting an environment from intrusions, phishing attempts, malware, ransomware, and more. Both the hardware and virtual Firebox appliances are feature rich, allowing the appliance to run features such as stateful firewall, IPS, application control, web blocker, VPN, and more. This technology pack will process Firebox event log messages, providing normalization and enrichment of common events of interest.

Requirements

  • Watchguard Firebox running Fireware 12.x

  • Watchguard Firebox configured to send logs to Security Data Lake via Syslog

Stream configuration

This technology pack includes one stream:

  • "Illuminate:WatchGuard Device Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “WatchGuard Device Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

DEV01 0011223344556 (2022-09-01T13:58:33) firewall: msg_id="3000-0148" Allow External Inside 44 tcp 20 238 10.11.12.13 192.168.1.10 58325 60951 offset 6 S 3172487743 win 4 geo_src="USA" geo_dst="USA" (Inbound Policy-00)

What is provided

  • Rules to normalize and enrich event log messages

  • A Spotlight content pack

    • Dashboard

    • Saved search

Log message processing

Illuminate will identify Watchguard Firebox event log messages and add the event_source_product field, with watchguard_firebox as the value.

The Illuminate processing of Watchguard Firebox log messages provides the following:

  • Field extraction, normalization and message enrichment for Watchguard Firebox log messages

  • Security Data Lake Schema compliance

Configuring log delivery

This process assumes that a Syslog input has been created in Security Data Lake, under Enterprise > Forwarders > Input profiles. The port configured for the Bitdefender Forwarder must match what is configured on the Firebox side.

Configuration from the Fireware Web UI and Policy Manager

  1. Select System > Logging in the Fireware Web UI or Setup > Logging in Policy Manager.

  2. Click the Syslog Server tab.

  3. Select Send log messages to these syslog servers.

  4. Click Add.

  5. Enter the Bitdefender Forwarder IP address in the IP Address field.

  6. In the Port field, match the port configured for the Syslog input on the Bitdefender Forwarder.

  7. Select Syslog from the Log Format dropdown menu.

  8. Select the time stamp and serial number of the device checkboxes so they are included.

  9. Select the syslog facility for each type of log message (Local0-7). Set Alarm to Local0 for high priority.

  10. Click Save.

Spotlight content pack

The Spotlight content pack contains:

  • Dashboard: Illuminate:WatchGuard Firebox Overview

    • Overview tab: Summary of Firebox device operations

    • Saved search: Two widgets and a tailored log view

Log event catalog

  • The Illuminate Watchguard Firebox content pack will process the following events:

event_id

gim_event_category

gim_event_subcategory

gim_event_type

1100-0004

authentication

authentication.logon

logon

1100-0005

authentication

authentication.logon

logon

1AFF-0005

-

-

-

1AFF-0018

-

-

-

1AFF-001A

-

-

-

1AFF-001B

-

-

-

1AFF-0021

-

-

-

1AFF-0024

-

-

-

1AFF-0025

-

-

-

1AFF-0026

-

-

-

1AFF-002C

-

-

-

1AFF-002E

-

-

-

1AFF-0033

-

-

-

1AFF-0036

-

-

-

1AFF-003D

-

-

-

2CFF-0000

-

-

-

2CFF-0001

-

-

-

2CFF-0005

-

-

-

2DFF-0001

-

-

-

2DFF-0005

-

-

-

3000-0148

-

-

-

3000-0149

-

-

-

3000-0150

-

-

-

3000-0152

-

-

-

3000-0153

-

-

-

3000-0154

-

-

-

3000-0155

-

-

-

3000-0156

-

-

-

3000-0157

-

-

-

3000-0158

-

-

-

3000-0159

-

-

-

3000-0160

-

-

-

3000-0161

-

-

-

3000-0162

-

-

-

3000-0163

-

-

-

3000-0164

-

-

-

3000-0165

-

-

-

3000-0166

-

-

-

3000-0167

-

-

-

3000-0168

-

-

-

3000-0169

-

-

-

3000-0170

-

-

-

3000-0171

-

-

-

3000-0172

-

-

-

3000-0173

-

-

-

Webserver Sigma Rules content pack

The Webserver Alerting Pack is a collection of Sigma rules selected from SOC Prime's Threat Detection Marketplace. The rules in this content pack are focused on webserver threats from end user actions. They are configured to work directly with existing Windows Illuminate content.

When you enable this content pack, these rules appear on the Sigma Rules page from the Security Interface. By default, new rules are disabled. You can select which rules to enable for your environment.

Note

Make sure you review the alerts before enabling them. Each rule can have a performance impact, depending on your network configuration. You might need to add other streams, as well (for example, "Cisco Device Messages").

Requirements

  • Apache HTTPD and/or NGINX Content Pack

Stream configuration

This technology pack uses the stream category:

  • "webserver"

What is provided

This content pack includes 21 Sigma rules.

  • Critical threat level: 2 rules

  • High threat level: 13 rules

  • Medium threat level: 6 rules

Each rule includes remediation steps, which display if an alert is triggered based on the Sigma rule. For details, refer to Remediation Steps.

Configure Sigma rules

When you enable this content pack, the new Sigma rules are added to the Sigma Rules page in Security Data Lake. Follow the steps below to enable rules and configure alerts.

  1. Enable your chosen Sigma rules on the Security > Sigma Rules page.

    Note

    To find the Sigma rules added by this content pack, search for Illuminate. All the rules from this pack have titles that begin with Illuminate – Webserver.

    To enable an inactive Sigma rule, click the toggle in the Enabled column.

  2. Update rules if necessary. Some rules can result in many false positives and should be adjusted. Click the rule title to open the edit window where you can review the rule definition and other options. However, note that not all options are editable, including the rule definition.

    If you need to update the rule definition, first clone the rule by selecting Clone from the More menu. In the cloned rule, you can update any of the fields and options, including the rule definition.

    For complete information about creating and working with Sigma rules, refer to Sigma Rules.

  3. Edit and update the event definition, if necessary. Each Sigma rule has a matching event definition, found on the Event Definitions tab of the Alerts page. For Sigma rules you enable, review the matching event definitions. You can add search filters or alerts as well as custom fields.

    Note

    When you enable the Sigma rule, the event definition is enabled by default. You can disable the event and any defined alert on the Event Definition page without disabling the Sigma rule.

Windows AppLocker content pack

Windows AppLocker is an optional security feature that helps organizations control which applications and files users can run, including executables, dynamic-link libraries, scripts, installers, and packaged applications.

Supported versions

  • Windows 8 or later, though we recommended Windows 10 or 11 or Server 2022+

Note

AppLocker feature availability is highly dependent on the Windows edition and version in use. For detailed requirements, refer to the Microsoft documentation.

Requirements

  • AppLocker policies must be enabled and rules created via Group Policy or Local Security Policy.

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Windows AppLocker Event Log Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Windows AppLocker Event Log Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

The following log delivery agents are supported:

  • Winlogbeat

  • NXLog Enterprise Edition

  • NXLog Community Edition (limited support)

Note

NXLog Community Edition does not send the RuleAndFileData XML portion of the event. This suppressed event data contains key fields that are important for effective AppLocker activity monitoring. Due to this limitation, we recommend you use NXLog Enterprise or Winlogbeat instead.

Bitdefender Sidecar example configuration

For detailed information on setting up Bitdefender Sidecar, refer to Sidecars.

  1. Create a Beats input for Winlogbeat or a GELF TCP input for NXLog in Security Data Lake. When sending to a Beats input, ensure that the Do not add Beats type as prefix option is disabled.

  2. Create an API access token and a custom configuration for your chosen log delivery agent.

    Example configuration for Winlogbeat:

    # Needed for Security Data Lake
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
  hosts: ["${user.forwarder_ip}:5044"]
path:
  data: ${sidecar.spoolDir!"C:\\Program Files\\Bitdefender\\sidecar\\cache\\winlogbeat"}\data
  logs: ${sidecar.spoolDir!"C:\\Program Files\\Bitdefe\\sidecar"}\logs
tags:
  - windows
winlogbeat:
  event_logs:
    - name: "Microsoft-Windows-AppLocker/EXE and DLL"
      ignore_older: 24h
    - name: "Microsoft-Windows-AppLocker/MSI and SCRIPT"
      ignore_older: 24h
    - name: "Microsoft-Windows-AppLocker/Packaged app-Deployment"
      ignore_older: 24h
    - name: "Microsoft-Windows-AppLocker/Packaged app-Execution"
      ignore_older: 24h

    For information on how to configure a Beats input for Winlogbeat, refer to Beats input.

    Example configuration for NXLog:

    Note

    This configuration requires NXLog to be installed in C:\Program Files (x86)\nxlog, not in the default folder.

    define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension logrotate>
    Module  xm_fileop
    <Schedule>
        When    @daily
        Exec    file_cycle('%ROOT%\data\nxlog.log', 7);
    </Schedule>
</Extension>

<Extension gelfExt>
    Module xm_gelf
    # Avoid truncation of the short_message field to 64 characters.
    ShortMessageLength 65536
</Extension>

<Input eventlog>
    Module im_msvistalog
    PollInterval 1
    SavePos True
    ReadFromLast True

    <QueryXML>
        <QueryList>
            <Query Id='1'>
                <Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*</Select>
                <Select Path="Microsoft-Windows-AppLocker/MSI and Script">*</Select>
                <Select Path="Microsoft-Windows-AppLocker/Packaged app-Deployment">*</Select>
                <Select Path="Microsoft-Windows-AppLocker/Packaged app-Execution">*</Select>
            </Query>
        </QueryList>
    </QueryXML>
</Input>

<Output gelf>
    Module om_tcp
    Host ${user.forwarder_ip}
    Port 12201
    OutputType  GELF_TCP
    <Exec>
        # These fields are needed for Security Data Lake
        $gl2_source_collector = '${sidecar.nodeId}';
        $collector_node_id = '${sidecar.nodeName}';
    </Exec>
</Output>

<Route route-1>
    Path eventlog => gelf
</Route>

    For information on how to configure a GELF TCP input for NXLog, refer to GELF.

  3. Install Bitdefender Sidecar on the client host.

  4. Edit the Bitdefender Sidecar client configuration with your Security Data Lake API URL and API access token.

What is provided

  • Parsing rules to extract Windows AppLocker event logs into Security Data Lake schema compatible fields

  • Illuminate spotlight highlighting security events and statistics of interest

Events processed by this technology pack

The Windows AppLocker content pack supports the following event IDs. Generic processing will be provided for event IDs not listed.

Event IDs

Event ID

Event action

Description

8000

modified

AppID policy conversion failed

8001

modified

A policy was successfully applied

8002

allowed

An EXE or DLL file was allowed to run

8003

allowed

An EXE or DLL file was allowed to run due to Audit policy but would be blocked otherwise

8004

blocked

An EXE or DLL file was blocked from running

8005

allowed

A script or MSI file was allowed to run

8006

allowed

A script or MSI file was allowed to run due to Audit policy but would be blocked otherwise

8007

blocked

A script or MSI file was blocked from running

8020

allowed

A packaged app was allowed to run

8021

allowed

A packaged app was allowed to run due to Audit policy but would be blocked otherwise

8022

blocked

A packaged app was blocked from running

8023

allowed

A packaged app installation was allowed

8024

allowed

A packaged app installation was allowed due to Audit policy but would be blocked otherwise

8025

blocked

A packaged app installation was blocked

Parsed Fields

Field name

Example value

Field type

Description

event_action

allowed

keyword

The action taken by AppLocker, such as allowing or blocking a file execution

event_code

8003

long

The Windows Event ID associated with the AppLocker event

event_log_name

microsoft-windows-applocker/exe and dll

keyword

The name of the event log channel where the event was recorded

event_severity

low

keyword

The description of the normalized event severity rating

event_severity_level

2

long

The normalized numeric severity rating for the event

event_source_product

applocker

keyword

The primary identifier for AppLocker events

event_uid

1005

keyword

The unique Windows Event Record ID of the event

file_is_signed

1

boolean

Indicates whether the file is digitally signed

file_name

PSLIST.EXE

keyword

The name of the file being evaluated

file_path

%OSDRIVE%\USERS\TESTUSER\

DESKTOP\PSLIST.EXE

keyword

The file path with environment variables

file_product

SYSINTERNALS PSLIST

keyword

The file product extracted from its Fully Qualified Binary Name (FQBN)

file_version

1.41.0.00

keyword

The file version extracted from its FQBN

file_signed_by

MICROSOFT CORPORATION

keyword

The entity that signed the file, if applicable

hash_sha256

015D546D0B1A31CF10A6DD00D36F5E1750

3EAF45C164F73B6E578970C08DA082

keyword

The SHA-256 hash of the file

process_target_id

7964

keyword

The process ID of the application being executed

source

DESKTOP-CJL6M40

keyword

Hostname or IP of the source system that generated the event

target_user_id

S-1-5-21-314323950-2314161084-

4234690932-1002

keyword

The SID of the user associated with the file execution

target_user_session_id

0x2a36e

keyword

The Logon ID of the user session context under which the application runs

user_domain

GOODCORP

keyword

The domain or local machine name associated with the event

user_id

S-1-5-21-314323950-2314161084-

4234690932-1002

keyword

The SID of the user associated with the event

user_name

testuser

keyword

The name of the user associated with the event

vendor_event_description

An EXE or DLL file was allowed to run due to Audit policy but would be blocked otherwise

keyword

The description corresponding to the Event ID

vendor_event_severity

warning

keyword

The vendor-defined description of the event severity rating

vendor_event_severity_level

3

long

The vendor-defined numeric severity rating for the event

vendor_event_type

WARNING

keyword

The type of the event describing the severity

vendor_file_base_path

%USERPROFILE%\DOWNLOADS

keyword

The directory location of the file

vendor_file_extension

EXE

keyword

The extension of the filename

vendor_file_hash_length

32

keyword

The length of the file hash string

vendor_file_original_name

PSLIST.EXE

keyword

The original name of the file extracted from its FQBN

vendor_file_path_length

43

long

The length of the file path string

vendor_file_x509_subject_common_name

MICROSOFT CORPORATION

keyword

The common name field from the file's digital certificate

vendor_file_x509_subject_country

US

keyword

The country field from the file's digital certificate

vendor_file_x509_subject_locality

REDMOND

keyword

The locality field from the file's digital certificate

vendor_file_x509_subject_organization

MICROSOFT CORPORATION

keyword

The organization that issued the file's digital signature

vendor_file_x509_subject_state_or_province

WASHINGTON

keyword

The state or province field from the file's digital certificate

vendor_fqbn

O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\SYSINTERNALS PSLIST\PSLIST.EXE\1.41.0.00

keyword

The FQBN that uniquely identifies the software publisher and version information, used by rules based on the file's digital signature if it exists

vendor_fqbn_length

95

long

The length of the FQBN

vendor_full_file_path

C:\Users\testuser\Desktop\pslist.exe

keyword

The full file path without use of environment variables

vendor_full_file_path_length

36

long

The length of the full file path string

vendor_opcode

Info

keyword

The description of the Windows Event Opcode

vendor_opcode_value

0

keyword

The numeric representation of the Windows Event Opcode

vendor_package

MICROSOFT.WINDOWSMAPS

keyword

The name of the application package

vendor_package_length

36

long

The length of the package name string

vendor_policy_name

EXE

keyword

The AppLocker policy associated with the event

vendor_policy_name_length

3

long

The length of the policy name string

vendor_rule_id

{0A591A2E-66FC-40F5-A421-0E2B94D6D539}

keyword

The ID of the AppLocker rule the application was evaluated against

vendor_rule_name

(Default Rule) All files located in the Windows folder

keyword

The name of the AppLocker rule the application was evaluated against

vendor_rule_name_length

54

keyword

The length of the rule name string

vendor_rule_sddl

D:(XA;;FX;;;S-1-1-0;(APPID://PATH Contains "%WINDIR%\*"))

keyword

The Security Descriptor Definition Language (SDDL) string defining rule permissions

vendor_rule_sddl_length

57

long

The length of the rule SDDL string

vendor_user_type

User

keyword

The type of account associated with the event

vendor_xml_name

RuleAndFileData

keyword

The Event Log XML element containing details about the event

Windows AppLocker Spotlight content pack

Windows AppLocker offers a dashboard with 6 tabs:

  • AppLocker Events Overview

  • EXE

  • DLL

  • MSI

  • SCRIPT

  • APPX

Windows Detection Chains Sigma Rules content pack

The Windows Detection Chains Sigma Rules content pack is a collection of Sigma rules selected from TruKno's Threat Detection Marketplace. The rules in this content pack are focused on Windows security threats. They are configured to work directly with existing Windows Illuminate content like Windows, Windows Security, Sysmon and PowerShell.

When you enable this content pack, these rules appear on the Sigma Rules page in the Security Interface. By default, new rules are disabled. You can select which rules to enable for your environment.

Note

Make sure you review the alerts before enabling them. Each rule can have a performance impact, depending on your network configuration.

For best performance and to ensure accurate detection, you should enable one of the following packs in addition to this Detection Campaign ruleset:

Warning

As the threat landscape evolves, certain rules may become obsolete, redundant, or less effective, necessitating their removal or revision. As such, the Sigma rules provided are subject to change and may be updated, modified, or removed in future updates. You should regularly review and validate the latest versions to ensure they align with current security needs and best practices.

Requirements

  • Windows, Windows Security, Sysmon, and/or PowerShell Content Pack

Stream configuration

This technology pack uses the stream category:

  • "windows_logs"

What is provided

This content pack includes 77 Sigma rules.

  • Critical threat level: 0 rule

  • High threat level: 58 rules

  • Medium threat level: 16 rules

  • Low threat level: 3 rules

Each rule includes remediation steps, which display if an alert is triggered based on the Sigma rule. For details, refer to Remediation Steps.

Configure Sigma rules

When you enable this content pack, the new Sigma rules are added to the Sigma Rules page in Security Data Lake. Follow the steps below to enable rules and configure alerts.

  1. Enable your chosen Sigma rules on the Security > Sigma Rules page.

    Note

    To find the Sigma rules added by this content pack, search for Illuminate. All the rules from this pack have titles that begin with Illuminate – Webserver and end with (Detection Chain).

    To enable an inactive Sigma rule, click the toggle in the Enabled column.

  2. Update rules if necessary. Some rules can result in many false positives and should be adjusted. Click the rule title to open the edit window where you can review the rule definition and other options. However, note that not all options are editable—including the rule definition.

    If you need to update the rule definition, first clone the rule by selecting Clone from the More menu. In the cloned rule, you can update any of the fields and options, including the rule definition.

    For complete information about creating and working with Sigma rules, refer to Sigma Rules.

  3. Edit and update the event definition, if necessary. Each Sigma rule has a matching event definition, found on the Event Definitions tab of the Alerts page. For Sigma rules you enable, review the matching event definitions. You can add search filters or alerts as well as custom fields.

    Note

    When you enable the Sigma rule, the event definition is enabled by default. You can disable the event and any defined alert on the Event Definition page without disabling the Sigma rule.

Windows DNS Server content pack

Windows DNS Server is a core Windows Server role that provides domain name resolution services for internal and external network resources. This content pack enables comprehensive parsing of both Analytical and Audit DNS logs, providing deep visibility into query activity across clients, DNS resolution behaviors and metrics over time, and configuration changes. These logs are critical for detecting malicious use of DNS and maintaining infrastructure integrity.

Analytical logs, sourced from the Microsoft-Windows-DNSServer Event Tracing for Windows (ETW) provider, record every DNS query and response handled by the server. This high-volume telemetry is essential for monitoring name resolution patterns and identifying abnormal traffic such as DNS tunneling or data exfiltration. Designed for performance, ETW-based logging minimizes overhead even at high query rates.

Audit logs, captured from the Microsoft-Windows-DNS-Server/Audit channel, focus on administrative operations — changes to zones, resource records, DNSSEC, and server settings. These events are vital for detecting unauthorized modifications, maintaining an audit trail, and ensuring DNS infrastructure integrity.

Supported versions

  • Windows Server 2016 and later

Note

Analytic logs from enhanced DNS logging are also available on Windows Server 2012 R2 with Hotfix KB2956577 but the Filebeat agent version required for this pack does not support Windows Server 2012.

Requirements

  • Windows DNS Server installed and DNS Analytic/Audit logs enabled on the system

  • Filebeat agent version 8.13.0 or later, running standalone

  • Illuminate Core: DNS Processing Add-on Pack (optional for some Spotlight widgets)

Stream configuration

This technology pack includes one stream:

  • "Illuminate:Windows DNS Server Event Messages"

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • "Windows DNS Server Event Messages"

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log collection

This content pack requires Filebeat version 8.13.0 or later for log collection, due to the constraint that DNS Server Analytical logging exclusively relies on Event Tracing for Windows (ETW). Filebeat is one of the few log delivery agents with native ETW support through its ETW input module.

It is important to note that you must run Filebeat standalone, not bundled with Bitdefender Sidecar. This limitation is due to the fact that the bundled Filebeat version is older than version 8.13.0, which is the minimum required for compatibility with ETW.

DNS Server Audit logs are enabled by default but Analytic logs are not. For information on how to enable the DNS Server Analytic event log, refer to the Microsoft documentation.

Note

While NXLog Enterprise Edition is able to consume DNS Server Analytical events via ETW using its im_etw module, it is not compatible with this content pack due to differences in field conventions and log structure. Only Filebeat is officially supported.

Filebeat standalone configuration example

For information on installing and configuring Filebeat for Windows, refer to the official quick start guide.

  1. Create a Beats input in Security Data Lake. Ensure that the Do not add Beats type as prefix option is disabled.

  2. Edit the Filebeat configuration according to the following example:

    # Needed for Security Data Lake
fields_under_root: true

output.logstash:
    hosts: ["<forwarder_ip>:5044"]

path:
    data: C:\Program Files\Filebeat\data
    logs: C:\Program Files\Filebeat\logs

tags:
- windows

filebeat.inputs:
- type: etw
    id: etw-dnsserver
    enabled: true
    provider.name: Microsoft-Windows-DNSServer
    session_name: DNSServer-Analytical  # IMPORTANT for parsing to recognize Analytical events
    trace_level: verbose
    match_any_keyword: 0x8000000000000000
    match_all_keyword: 0

- type: winlog
    id: winlog-dnsserver-audit
    enabled: true
    name: "Microsoft-Windows-DNSServer/Audit"
    ignore_older: 24h

    Note

    The parser for this pack requires the user-defined session_name to be DNSServer-Analytical (case-insensitive) in order to identify Analytic log events.

  3. Edit the Filebeat config to ship to your Bitdefender Forwarder IP or hostname.

  4. Ensure that DNS Server Analytic and Audit logs are enabled for the system.

What is provided

  • Parsing rules to extract Windows DNS Server Analytic and Audit event logs into Security Data Lake schema-compatible fields

  • Field normalization and data enrichment for additional investigative context

  • Illuminate Spotlight dashboard to support DNS transactional and administrative activity monitoring, provide useful insights into DNS patterns across the network, and highlight potential security threats

Events processed by this technology pack

The Windows DNS Server content pack supports the following events. Generic processing will be provided for any Event IDs not listed.

Event IDs

Analytic events

Event ID

Description

256

Query received

257

Response success

258

Response failure

259

Ignored query

260

Recursive query out

261

Response in

262

Recursive query timeout

263

Update in

264

Update response

265

IXFR request out

266

IXFR request in

267

IXFR response out

268

IXFR response in

269

AXFR request out

270

AXFR request in

271

AXFR response out

272

AXFR response in

273

XFR notification in

274

XFR notification out

275

XFR notify ACK in

276

XFR notify ACK out

277

Dynamic update forward

278

Dynamic update response in

279

Internal lookup CNAME

280

Internal lookup additional

Audit events

Event ID

Description

512

Zone create

513

Zone delete

514

Zone updated

515

Record create

516

Record delete

517

RRSET delete

518

Node delete

519

Record create - dynamic update

520

Record delete - dynamic update

521

Record scavenge

522

Zone scope create

523

Zone scope delete

525

Zone sign

526

Zone unsign

527

Zone re-sign

528

Key rollover start

529

Key rollover end

530

Key retire

531

Key rollover triggered

533

Key poke rollover

534

Export DNSSEC

535

Import DNSSEC

536

Cache purge

537

Forwarder reset

540

Root hints

541

Server setting

542

Server scope create

543

Server scope delete

544

Add trust point DNSKEY

545

Add trust point DS

546

Remove trust point

547

Add trust point root

548

Restart server

549

Clear debug logs

550

Write dirty zones

551

Clear statistics

552

Start scavenging

553

Enlist directory partition

554

Abort scavenging

555

Prepare for demotion

556

Write root hints

557

Listen address

558

Active refresh trust points

559

Pause zone

560

Resume zone

561

Reload zone

562

Refresh zone

563

Expire zone

564

Update from DS

565

Write and notify

566

Force aging

567

Scavenge servers

568

Transfer primary key server

569

Add SKD

570

Modify SKD

571

Delete SKD

572

Modify SKD state

573

Add delegation

574

Create client subnet record

575

Delete client subnet record

576

Update client subnet record

577

Create server level policy

578

Create zone level policy

579

Create forwarding policy

580

Delete server level policy

581

Delete zone level policy

582

Delete forwarding policy

GIM categorization

GIM categorization is provided for the following messages:

GIM Event category

GIM Event subcategory

GIM event type

GIM event type code

name resolution

name resolution.dns request

dns query

140000

name resolution

name resolution.dns answer

dns response

140200

name resolution

name resolution.error

dns error

140300

name resolution

name resolution.default

dns message

149999

Parsed fields

This pack parses out the following fields. Note that this list is not comprehensive.

Common

Field Name

Example value

Field type

Description

event_created

2025-03-08T04:35:20.293Z

date

Date/time that the event occurred or was first read by the agent

event_reporter

dnssvr01

keyword

The name of the agent that delivered the message

event_reporter_ip

192.168.51.40

keyword

IP address of the agent host

event_reporter_hostname

dnssvr01

keyword

Hostname of the agent host

event_source

dnssvr01

keyword

Hostname or IP of source system that generated the event

event_source_product

windows_dns_server

keyword

Identifier for Windows DNS Server log source

network_protocol

dns

keyword

The network protocol used

Analytic logs

Field name

Example value

Field type

Description

event_code

257

long

The Event ID representing the Windows DNS Server Analytic log message type

event_outcome

success

keyword

The outcome (success/failure) of the event action

event_uid

{0254B809-BB52-4B64-9C49-A00E452ECA56}

keyword

A globally unique identifier associated with the event, useful for tracking complete conversations

event_error_code

2

keyword

Assigned from query_result_code when the value is non-zero, indicating an error response

message

DNS Response success

text

A concise summary of the event

network_bytes

875

long

The size in bytes of the DNS packet data

network_transport

udp

keyword

The transport layer protocol used

policy_name

AllowedSubnet

keyword

The name of any policy applied to the DNS query

query_record_type

TXT

keyword

The DNS record type being requested (QTYPE)

query_record_type_code

16

keyword

The code of the DNS record type being requested (QTYPE code)

query_request

google.com

keyword

The name being resolved in the DNS request (QNAME)

query_response

_undefined_

keyword

(NOT IMPLEMENTED) The name resolution answer, currently undefined for all events. Windows DNS Server Analytic logs do not include the query answers as explicit fields. Functionality to extract the answer data from the raw packet data is planned for a future iteration of this pack.

query_result

NOERROR

keyword

The DNS response status (RCODE name)

query_result_code

0

keyword

The DNS response code (RCODE)

source_ip

192.168.19.121

ip

IP address of the source from which the DNS query originated

source_port

55344

long

The port from which the DNS query originated

destination_ip

8.8.8.8

ip

IP address of the destination to which the DNS query is sent or the response is received

destination_port

61893

long

The port to which the DNS query is sent or the response is received

vendor_data_additional_info

VirtualizationInstance:.

keyword

Extra metadata related to the event

vendor_data_cache_scope

Default

keyword

The cache scope applied, such as if the response was retrieved from a local cache

vendor_data_dnssec

0

keyword

Whether DNSSEC was used in the transaction

vendor_data_elapsed_time

2

long

The time taken to process the request

vendor_data_flags

33152

keyword

DNS header information represented as a bitmask

vendor_data_header_flags

["AA"]

keyword

Array of DNS header flags

vendor_data_interface_ip

127.0.0.1

keyword

The IP address of the network interface on the DNS server processing the transaction

vendor_data_forward_interface_ip

10.50.1.253

The IP address of the network interface used by the DNS server when forwarding a query to an upstream resolver

vendor_data_packet_data

0x000381800001000C0000000006676F6F67...

keyword

The raw DNS packet data in hexadecimal format

vendor_data_queries_attached

0

keyword

The number of queries attached to an event

vendor_data_xid

11660

keyword

The transaction ID

vendor_data_qxid

4

keyword

The query transaction ID

vendor_data_recursion_depth

1

keyword

The number of recursive lookups performed to resolve the DNS query

vendor_data_recursion_scope

.

keyword

The scope of recursion allowed in handling the DNS query

vendor_data_scope

Default

keyword

The DNS scope in which the query was processed

vendor_data_secure

0

keyword

Whether the transaction took place over a secure channel

vendor_data_zone

..Cache

keyword

The DNS zone involved in the event

vendor_data_zone_scope

Default

keyword

The scope of the DNS zone involved in the event

vendor_domain_sld_tld

google.com

keyword

The combination of the question name's second level and top level domains (not eTLD)

vendor_domain_sld

google

keyword

The question name's second level domain

vendor_domain_tld

com

keyword

The question name's top level domain (not eTLD)

vendor_event_category

LOOK_UP

keyword

The category of the Analytic event describing the task performed

vendor_event_category_code

1

long

The category code of the Analytic event describing the task performed

vendor_event_channel

16

keyword

Specific to Windows ETW event processing

vendor_event_description

Response success

keyword

Description of the Event ID associated with the Analytic message

vendor_event_outcome_reason

System

keyword

The reason for the DNS query outcome, often given for failed or ignored queries and timeouts

vendor_event_provider

Microsoft-Windows-DNSServer

keyword

The name of the Windows ETW provider

vendor_event_provider_guid

{eb79061a-a566-4698-9119-3ed2807060e7}

keyword

The GUID of the Windows ETW provider

vendor_event_session

DNSServer-Analytical

keyword

The name of the Windows ETW session

vendor_event_severity

information

keyword

The event severity rating derived from the source log level

vendor_input_type

etw

keyword

The input type, expected to be ETW for Windows DNS Server Analytic logs

vendor_opcode_code

0

keyword

Specific to Windows ETW event processing

Audit logs

Field name

Example value

Field type

Description

event_code

516

long

The Event ID representing the Windows DNS Server Audit log message type

event_log_name

Microsoft-Windows-DNSServer/Audit

keyword

The Windows event log channel from which the event originates

event_uid

99

keyword

The unique event record ID

message

A resource record of type 1, name ns2.example.com, TTL 1200 and RDATA 0x0A000210 was created in scope Default of zone example.com via dynamic update from IP Address 192.168.19.121.

text

The Audit event text

network_bytes

4

long

The total bytes transferred during the event

policy_name

AllowedSubnet

keyword

The name of any policy associated with the event

query_record_type

*

keyword

The DNS record type being requested (QTYPE)

query_record_type_code

255

keyword

The code of the DNS record type being requested (QTYPE code)

source_ip

192.168.19.121

ip

IP address of the source host

destination_ip

8.8.8.8

ip

IP address of the destination host

user_name

Administrator

keyword

Name of the user account associated with the event

user_id

S-1-5-21-313282886-420110098-1052476632-500

keyword

SID of the user account associated with the event

user_domain

SDL-TESTLAB

keyword

Domain of the user account associated with the event

user_type

User

keyword

The type of user account associated with the event

vendor_event_action

create

keyword

The action described in the event

vendor_event_category

ZONE_OP

keyword

The category of the Audit event describing the task performed

vendor_event_category_code

5

long

The category code of the Audit event describing the task performed

vendor_event_description

Zone updated

keyword

Description of the Event ID associated with the Audit message

vendor_event_provider

Microsoft-Windows-DNSServer

keyword

The event log source

vendor_event_provider_guid

{eb79061a-a566-4698-9119-3ed2807060e7}

keyword

The GUID of the event log source

vendor_event_severity

information

keyword

The event severity rating derived from the source log level

vendor_input_type

winlog

keyword

The input type, expected to be Winlog for Windows DNS Server Audit logs

vendor_opcode

Info

keyword

The opcode defined by the event record

vendor_data_action

keyword

vendor_data_active_key

keyword

vendor_data_base64_data

keyword

vendor_data_child_zone

keyword

vendor_data_client_subnet_list

keyword

vendor_data_client_subnet_record

keyword

vendor_data_condition

keyword

vendor_data_criteria

keyword

vendor_data_crypto_algorithm

keyword

vendor_data_current_rollover_status

keyword

vendor_data_current_state

keyword

vendor_data_denial_of_existence

keyword

vendor_data_digest

keyword

vendor_data_digest_type

keyword

vendor_data_distribute_trust_anchor

keyword

vendor_data_key_record_set_ttl

keyword

vendor_data_key_signature_validity_period

keyword

vendor_data_ds_record_generation_algorithm

keyword

vendor_data_ds_record_set_ttl

keyword

vendor_data_ds_signature_validity_period

keyword

vendor_data_enable_rfc_5011_key_rollover

keyword

vendor_data_errors_per_second

keyword

vendor_data_event_string

keyword

vendor_data_file_path

keyword

vendor_data_forwarders

keyword

vendor_data_friendly_name

keyword

vendor_data_guid

keyword

vendor_data_initial_rollover_offset

keyword

vendor_data_ipv4_prefix_length

keyword

vendor_data_ipv6_prefix_length

keyword

vendor_data_is_enabled

keyword

vendor_data_is_key_master_server

keyword

vendor_data_key_id

keyword

vendor_data_key_length

keyword

vendor_data_key_master_server

keyword

vendor_data_key_or_zone

keyword

vendor_data_ksk_or_zsk

keyword

vendor_data_key_protocol

keyword

vendor_data_key_storage_provider

keyword

vendor_data_key_tag

keyword

vendor_data_key_type

keyword

vendor_data_last_rollover_time

keyword

vendor_data_leak_rate

keyword

vendor_data_listen_addresses

keyword

vendor_data_lookup

keyword

vendor_data_master_server

keyword

vendor_data_mode

keyword

vendor_data_name

keyword

vendor_data_NAME

keyword

vendor_data_name_server

keyword

vendor_data_new_friendly_name

keyword

vendor_data_new_property_values

keyword

vendor_data_new_scope

keyword

vendor_data_new_value

keyword

vendor_data_next_key

keyword

vendor_data_next_rollover_action

keyword

vendor_data_next_rollover_time

keyword

vendor_data_node_name

keyword

vendor_data_nsec3_hash_algorithm

keyword

vendor_data_nsec3_iterations

keyword

vendor_data_nsec3_opt_out

keyword

vendor_data_nsec3_random_salt_length

keyword

vendor_data_nsec3_user_salt

keyword

vendor_data_old_friendly_name

keyword

vendor_data_old_property_values

keyword

vendor_data_old_scope

keyword

vendor_data_parent_has_secure_delegation

keyword

vendor_data_processing_order

keyword

vendor_data_propagation_time

keyword

vendor_data_property_key

keyword

vendor_data_qname

keyword

Deliberately not mapped to query_request to avoid GIM "dns query" categorization which is not always applicable in the Audit event context

vendor_data_rdata

keyword

vendor_data_recursion_scope

keyword

vendor_data_replication_scope

keyword

vendor_data_response_per_second

keyword

vendor_data_rollover_period

keyword

vendor_data_rollover_type

keyword

vendor_data_rrl_exception_list

keyword

vendor_data_scavenge_servers

keyword

vendor_data_scope

keyword

vendor_data_scopes

keyword

vendor_data_scope_weight

keyword

vendor_data_scope_weight_new

keyword

vendor_data_scope_weight_old

keyword

vendor_data_secure_delegation_polling_period

keyword

vendor_data_seized_or_transfered

keyword

vendor_data_server_name

keyword

vendor_data_setting

keyword

vendor_data_signature_inception_offset

keyword

vendor_data_standby_key

keyword

vendor_data_store_keys_in_ad

keyword

vendor_data_subtree_aging

keyword

vendor_data_tc_rate

keyword

vendor_data_total_responses_in_window

keyword

vendor_data_ttl

long

vendor_data_type

keyword

vendor_data_virtualization_id

keyword

vendor_data_window_size

keyword

vendor_data_with_new_keys

keyword

vendor_data_with_without

keyword

vendor_data_zone

keyword

vendor_data_zone_file

keyword

vendor_data_zone_scope

keyword

vendor_data_zone_signature_validity_period

keyword

vendor_data_zone_name

keyword

Windows DNS Server Spotlight content pack

Windows DNS Server Spotlight offers a dashboard with 3 tabs:

  • DNS Analytic Events

  • DNS Audit Events

  • Domain Analysis

Windows PowerShell content pack

PowerShell is a task automation and configuration management program from Microsoft. This technology pack processes PowerShell logs.

Requirements

  • Windows 10, Windows 11, or Windows Server 2023

  • PowerShell 5.1 or 7

  • Log delivery agent: Winlogbeat 7.11/8.8 or NXLog 3.2

  • When using NXLog and Sidecar, the NXLog binaries must be installed under C:\Program Files (x86)\nxlog or the permissions for Sidecar file access must be adjusted.

  • A configured Security Data Lake input: Beats with Beats type prefix

Note

Windows does not log all PowerShell logs by default. If needed, activate advanced logging via Group Policy or the Registry.

Supported logs/event IDs

200, 300, 400, 403, 500, 501, 600, 800, 4100, 4101, 4102, 4103, 4104, 4105, 4106, 32784, 40961, 40962, 53504, 53506.

Supported event log names

  • Microsoft-Windows-PowerShell/Operational

  • PowerShellCore/Operational

  • Windows PowerShell

Note

Windows 11 currently has a bug affecting Winlogbeat. The message field may contain placeholders instead of actual data. While the pack will work with Windows 11 and Winlogbeat, important logging details may be missing. Microsoft is currently working on a patch. For Windows Server 2022, Winlogbeat 8 or NXLog is recommended. Note that Winlogbeat 7 may not ship the message field; this usually appears as an empty message.

This pack will normalize common fields for PowerShell if shipped to one of these three listed event log names.

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Powershell Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “powershell Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log examples

These logs come from Windows Event Viewer as .evtx files, which are not human readable.

Bitdefender Sidecar configuration

For detailed information on setting up Bitdefender Sidecar, refer to Sidecars. You must add the following paths in your Winlogbeat or NXLog configuration:

Winlogbeat (with Security logs) example:

winlogbeat:
  event_logs:
   - name: Security
   - name: Microsoft-Windows-PowerShell/Operational
   - name: PowerShellCore/Operational
   - name: Windows PowerShell

NXLog (with Security logs) example:

<Input eventlog>
        Module im_msvistalog
        PollInterval 1
        SavePos False
        ReadFromLast True
    <QueryXML>
        <QueryList>
            <Query Id='1'>
                <Select Path='Security'>*</Select>
                <Select Path='Windows Powershell'>*</Select>
                <Select Path='PowerShellCore/Operational'>*</Select>
                <Select Path='Microsoft-Windows-PowerShell/Operational'>*</Select>
            </Query>
        </QueryList>
    </QueryXML>       
</Input>

Adjust the host IP and port to match your Bitdefender Forwarder values. Configuration files are case sensitive, and correct spacing is necessary. Installation of NXlogs binaries in C:\Program Files (x86)\nxlog is recommended, but if you choose a different location, you must adjust the Sidecar file permissions and define a new ROOT location. If you are not using PowerShellCore (PowerShell 6.x and higher), omit the PowerShellCore line. To capture remote PowerShell access, add the Microsoft-Windows-WinRM/Operational path (not supported by this pack).

PowerShell configuration

  • Not all PowerShell logs are logged by default. If needed, activate Script Block Logging (event ID 4104), Module Logging (event ID 4103), and others via group policy.

  • PowerShell version 5 (and older) and PowerShellCore version 6.x (and newer) have separate policy and registry settings. If you want to log both versions, you must adjust both keys.

  • PowerShellCore uses PowerShellCore/Operational as an additional log source.

Note

Depending on your environment, PowerShell logging might generate very large volumes of data.

What is provided

  • Rules to normalize and enrich PowerShell log messages

  • Dashboards

PowerShell message processing

The Illuminate processing of PowerShell log messages provides the following:

  • Field extraction, normalization, and message enrichment for PowerShell log messages.

  • GIM categorization of the following messages:

vendor_command_name

GIM event type code

GIM event type

Add-LocalGroupMember

111007

group member added

New-LocalUser

110000

account created

New-LocalGroup

110002

group created

Enable-LocalUser

112001

account enabled

Disable-LocalUser

111501

account disabled

Remove-LocalUser

110500

account locked

Remove-LocalGroupMember

111008

group member removed

Remove-LocalGroup

110501

group deleted

Rename-LocalUser

111003

account renamed

Rename-LocalGroup

111009

group properties modified

Set-LocalGroup

111009

group properties modified

Set-LocalUser

111000

account modified

Clear-EventLog

220000

audit log cleared

Start-Process

190000

process started

Stop-Process

190100

process stopped

Start-Service

210000

service started

Stop-Service

210100

service stopped

Get-LocalGroupMember

119500

group membership enumerated

PowerShell Spotlight content pack

PowerShell offers one dashboard with four tabs: one overview dashboard and three dashboards around relevant data for Sigma rules.

Windows Security Event Logs content pack

This technology pack will process Windows Security event logs, providing normalization and enrichment of common events of interest. In addition, it will identify all Windows logs that have not been processed by any other technology pack, normalize common event log fields, and index these messages in a separate index.

Supported versions

  • Currently supported versions of the Windows operating system

Requirements

  • Winlogbeat 8.x or NXLog Enterprise 3.2 / NXLog Community Edition 2.10

  • The Beats type prefix should be enabled when using the Winlogbeat agent

Stream configuration

This technology pack includes two streams:

  • “Illuminate:Windows Security Event Log Messages”, which contains all messages from the Windows Security event log

  • “Illuminate:Windows Event Log Messages”, which contains all event log messages that have not been processed by this or any other technology pack

Index set configuration

This technology pack includes two index set definitions:

  • “Windows Security Event Log Messages”, which contains all messages from the Windows Security event log

  • “Windows Event Log Messages”, which contains all event log messages not processed by this or any other technology pack

If these index sets are already defined, then nothing will be changed. If these index sets do not exist, then they will be created according to your license entitlement.

What is provided

  • Parsing and normalization to extract Windows event logs into Security Data Lake schema-compatible fields

  • Security Data Lake Information Model categorization of messages

  • Illuminate Spotlight

Events processed by this technology pack

Illuminate will perform some basic processing of all event logs ingested by Winlogbeat, normalizing fields common to all events:

Field Name

Field description

event_code

Windows "Event ID" value

event_log_name

The lower-case Windows event log "name" or channel

event_reporter

The system that delivered the event to Security Data Lake

event_source

The computer name that originally generated the event

event_uid

The unique system record entry number for the event message

vendor_event_category

The Microsoft-defined event category derived from the "Task" field

The Windows Security technology pack will apply normalization of common event log fields, such as Event ID, to all Windows event log messages. The Windows Security technology pack will provide normalization and enrichment to the following Windows security event log IDs:

Event ID

Additional data

gim_event_type_code

gim_event_category

gim_event_subcategory

gim_event_type

1100

220101

audit

audit.state

audit service stopped

1101

220102

audit

audit.state

audit error

1102

220000

audit

audit.integrity

audit log cleared

1104

220102

audit

audit.state

audit error

4610

270000

registry

registry.default

registry event

4611

270000

registry

registry.default

registry event

4614

270000

registry

registry.default

registry event

4616

260000

registry

registry.default

registry event

4622

270000

registry

registry.default

registry event

4624

100000

authentication

authentication.logon

logon

4625

100000

authentication

authentication.logon

logon

4634

102500

authentication

authentication.logoff

logoff

4647

102500

authentication

authentication.logoff

logoff

4648

100003

authentication

authentication.logon

logon with alternate credentials

4663

Access Type: ReadEA

209999

file

file.default

file event

4663

Access Type: ReadData (or ListDirectory)

201500

file

file.access

file access

4663

Access Type: WriteData (or AddFile)

201000

file

file.modify

file modified

4663

Access Type: AppendData (or AddSubdirectory or CreatePipeInstance)

201000

file

file.modify

file modified

4663

Access Type: Notify about changes to keys

259999

registry

registry.default

registry event

4663

Access Type: Enumerate sub-key

259999

registry

registry.default

registry event

4663

Access Type: Create sub-key

250500

registry

registry.key_change

registry key added

4663

Access Type: Set key value

250000

registry

registry.value_change

registry value set

4663

Access Type: Query key value

259999

registry

registry.default

registry event

4663

Access Type: WriteEA

209999

file

file.default

file event

4672

101000

authentication

authentication.access notice

special logon

4688

190000

process

process.execution

process started

4689

190100

process

process.end

process stopped

4697

211500

service

service.state

service installed

4720

110000

iam

iam.object create

account created

4722

112001

iam

iam.object enable

account enabled

4723

111004

iam

iam.object modify

password change

4724

111005

iam

iam.object modify

administrative password reset

4725

111501

iam

iam.object disable

account disabled

4726

110500

iam

iam.object delete

account deleted

4727

110002

iam

iam.object create

group created

4728

111007

iam

iam.object modify

group member added

4729

111008

iam

iam.object modify

group member removed

4730

110501

iam

iam.object delete

group deleted

4731

110002

iam

iam.object create

group created

4732

111007

iam

iam.object modify

group member added

4733

111008

iam

iam.object modify

group member removed

4734

110501

iam

iam.object delete

group deleted

4735

111009

iam

iam.object modify

group properties modified

4737

111009

iam

iam.object modify

group properties modified

4738

111000

iam

iam.object modify

account account modified

4740

111500

iam

iam.object disable

account locked

4741

110000

iam

iam.object create

Account created

4742

111000

iam

iam.object modify

account account modified

4743

110500

iam

iam.object delete

account deleted

4754

110002

iam

iam.object create

group created

4755

111009

iam

iam.object modify

group properties modified

4756

111007

iam

iam.object modify

group member added

4757

111008

iam

iam.object modify

group member removed

4758

110501

iam

iam.object delete

group deleted

4764

111009

iam

iam.object modify

group properties modified

4767

112000

iam

iam.object enable

account unlocked

4768

100000

102002

authentication

authentication.logon

authentication.kerberos requests

logon

tgt request

4769

102001

authentication

authentication.kerberos requests

service ticket requested

4770

102000

authentication

authentication.kerberos requests

service ticket renewed

4771

100000

100500

authentication

authentication.logon

authentication.credential validation

logon

credential validation

4776

100500

authentication

authentication.credential validation

credential validation

4778

100004

authentication

authentication.logon

session reconnect

4779

102501

authentication

authentication.logoff

session disconnect

4781

111003

iam

iam.object modify

account renamed

4798

119500

iam

iam.information

IAM message

4799

119500

iam

iam.information

IAM message

4820

101501

authentication

authentication.access policy

device policy violation

4821

101500

authentication

authentication.access policy

access policy violation

4822

101502

authentication

authentication.access policy

account policy violation

4823

101502

authentication

authentication.access policy

account policy violation

4824

101502

authentication

authentication.access policy

account policy violation

Windows Security Sigma Rules content pack

The Windows Security Sigma Rules content pack is a collection of Sigma rules selected from SOC Prime's Threat Detection Marketplace. The rules in this content pack are focused on Windows security threats at a system or environmental level. They are configured to work directly with existing Windows Illuminate content.

When you enable this content pack, these rules appear on the Sigma Rules page. By default, new rules are disabled. You can select which rules to enable for your environment.

Note

Make sure you review the alerts before enabling them. Each rule can have a performance impact, depending on your network configuration. You might need to add other streams as well (for example, Sysmon or PowerShell).

Requirements

Stream configuration

This technology pack uses one stream:

  • Illuminate:Windows Security Event Log Messages

What is provided

This content pack includes 93 Sigma rules.

  • Critical threat level: 4 rules

  • High threat level: 49 rules

  • Medium threat level: 27 rules

  • Low threat level: 13 rules

Each rule includes remediation steps, which display if an alert is triggered based on the Sigma rule. For details, refer to Remediation Steps.

Configure Sigma rules

When you enable this content pack, the new Sigma rules are added to the Sigma Rules page in Security Data Lake. Follow the steps below to enable rules and configure alerts.

  1. Enable your chosen Sigma rules on the Security > Sigma Rules page.

    Note

    To find the Sigma rules added by this content pack, search for Illuminate. All the rules from this pack have titles that begin with Illuminate – Windows Security.

    To enable an inactive Sigma rule, click the toggle in the Enabled column.

  2. Update rules if necessary. Some rules can result in many false positives and should be adjusted. Click the rule title to open the edit window where you can review the rule definition and other options. However, note that not all options are editable—including the rule definition.

    If you need to update the rule definition, first clone the rule by selecting Clone from the More menu. In the cloned rule, you can update any of the fields and options, including the rule definition.

    For complete information about creating and working with Sigma rules, refer to Sigma Rules.

  3. Edit and update the event definition, if necessary. Each Sigma rule has a matching event definition, found on the Event Definitions tab of the Alerts page. For Sigma rules you enable, review the matching event definitions. You can add search filters or alerts, as well as custom fields.

    Note

    When you enable the Sigma rule, the event definition is enabled by default. You can disable the event and any defined alert on the Event Definition page without disabling the Sigma rule.

Windows Security User Activity Sigma Rules content pack

The Windows Security User Activity Sigma Rules content pack is a collection of Sigma rules selected from SOC Prime's Threat Detection Marketplace. The rules in this content pack are focused on Windows security threats from end user actions. They are configured to work directly with existing Windows Illuminate content.

When you enable this content pack, these rules appear on the Sigma Rules page. By default, new rules are disabled. You can select which rules to enable for your environment.

Note

Make sure you review the alerts before enabling them. Each rule can have a performance impact, depending on your network configuration. You might need to add other streams as well (for example, Sysmon or PowerShell).

Requirements

Stream configuration

This technology pack uses one stream:

  • Illuminate:Windows Security Event Log Messages

What is provided

This content pack includes 38 Sigma rules.

  • Critical threat level: 1 rule

  • High threat level: 26 rules

  • Medium threat level: 11 rules

Each rule includes remediation steps, which display if an alert is triggered based on the Sigma rule. For details, refer to Remediation Steps.

Configure Sigma rules

When you enable this content pack, the new Sigma rules are added to the Sigma Rules page in Security Data Lake. Follow the steps below to enable rules and configure alerts.

  1. Enable your chosen Sigma rules on the Security > Sigma Rules page.

    Note

    To find the Sigma rules added by this content pack, search for Illuminate. All the rules from this pack have titles that begin with Illuminate – Windows Security.

    To enable an inactive Sigma rule, click the toggle in the Enabled column.

  2. Update rules if necessary. Some rules can result in many false positives and should be adjusted. Click the rule title to open the edit window where you can review the rule definition and other options. However, note that not all options are editable—including the rule definition.

    If you need to update the rule definition, first clone the rule by selecting Clone from the More menu. In the cloned rule, you can update any of the fields and options, including the rule definition.

    For complete information about creating and working with Sigma rules, refer to Sigma Rules.

  3. Edit and update the event definition, if necessary. Each Sigma rule has a matching event definition, found on the Event Definitions tab of the Alerts page. For Sigma rules you enable, review the matching event definitions. You can add search filters or alerts, as well as custom fields.

    Note

    When you enable the Sigma rule, the event definition is enabled by default. You can disable the event and any defined alert on the Event Definition page without disabling the Sigma rule.

Zeek content pack

Zeek is an open-source network security monitoring tool capable of passively analyzing network traffic and generating a number of logs describing the activity it sees. Zeek can be used to detect attacks and probes with a variety of different analyzers and scripts. This technology pack will process Zeek log messages by providing normalization and enrichment of common events of interest.

Requirements

  • Zeek 5.0.9+

  • Filebeat 7.13+ (ndjson parser)

  • A configured Beats input in Security Data Lake

Stream configuration

This technology pack includes one stream:

  • “Illuminate:Zeek Messages”

Note

If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index set configuration

This technology pack includes one index set definition:

  • “Zeek Logs”

Note

If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created according to your license entitlement.

Log format example

{"filebeat_id_orig_p":58405,"filebeat_log_offset":908201,"filebeat_agent_name":"snort1","filebeat_history":"ShADadFf","filebeat_resp_pkts":7,"filebeat_id_orig_h":"74.96.110.140","filebeat_event_source_product":"zeek","beats_type":"filebeat","filebeat_@metadata_beat":"filebeat","filebeat_ts":"2023-06-05T14:15:05.682220Z","filebeat_@timestamp":"2023-06-05T14:15:23.109Z","filebeat_agent_type":"filebeat","filebeat_@metadata_version":"8.6.2","filebeat_host_name":"snort1","filebeat_proto":"tcp","filebeat_agent_version":"8.6.2","filebeat_orig_ip_bytes":1234,"filebeat_agent_ephemeral_id":"6a114e83-ca97-4925-b4c6-8971c97d191b","filebeat_local_orig":true,"filebeat_orig_bytes":942,"filebeat_input_type":"filestream","filebeat_id_resp_h":"172.65.251.78","filebeat_orig_pkts":7,"filebeat_resp_bytes":1960,"filebeat_duration":10.197248935699463,"message":"-","filebeat_ecs_version":"8.0.0","filebeat_id_resp_p":443,"filebeat_uid":"CyRQBS1i6zJKpZXgHl","filebeat_service":"ssl","filebeat_missed_bytes":0,"filebeat_@metadata_type":"_doc","filebeat_conn_state":"SF","filebeat_resp_ip_bytes":2252,"filebeat_local_resp":false,"filebeat_agent_id":"c2c08007-50ba-4d8e-948b-ca484ef0ece2","filebeat_log_file_path":"/opt/zeek5/logs/current/conn.log","host":"bg-devel","level":6,"replayed_log":"true"}

Requirements

Zeek

Zeek must be configured to log in JSON format in order to use this technology pack. Any existing logging configuration can still be used separately but this technology pack requires the JSON configuration below to capture detailed event information. The essential settings and file locations are below.

Additional information regarding Zeek installation and usage can be found by following the links below.

Zeek configuration

json-logs.zeek

This file is located in /zeek_install_path/share/zeek/policy/tuning/

Note

The ISO8601 setting is crucial for proper timestamp processing.

##! Loading this script will cause all logs to be written
##! out as JSON by default.

redef LogAscii::use_json=T;
redef LogAscii::json_timestamps = JSON::TS_ISO8601;
redef LogAscii::json_include_unset_fields=T;
local.zeek

This file is located in /zeek_install_path/share/zeek/site/

@load packages
@load policy/tuning/json-logs.zeek

Filebeat

Because Zeek is configured to log in JSON format, a delivery system that can parse each field and deliver them to Security Data Lake is required. This technology pack supports log delivery via Filebeat with a specific configuration of inputs and outputs, identifying logs for parsing and delivery to Security Data Lake for Illuminate processing.

The paths, fields, and parsers sections are required for this configuration. If the Zeek logs are stored in a location other than below, these paths must be updated. The event_source_product: zeek and target: "zeek" fields are critical for proper identification and parsing of logs.

Filebeat configuration

Additional information regarding the installation and configuration of Filebeat can be found by following the links below:

filebeat.yml
- type: filestream
  id: zeek-filestream
  enabled: true
  paths:
    - /zeek_install_path/logs/current/*.log
  parsers:
    - ndjson:
        target: "zeek"
        add_error_key: true
        overwrite_keys: true
  fields_under_root: true
  fields:
    event_source_product: zeek

What is provided

  • Rules to normalize and enrich Zeek log messages

Zeek log message processing

The Illuminate processing of Zeek log messages provides the following:

  • Field extraction, normalization, and message enrichment for Zeek log messages (IDS and AppID)

  • GIM categorization of the following messages:

Zeek log type

GIM category

GIM subcategory

http

http

http.communication

conn

network

network.flow

conn

network

network.default

dns

name resolution

name resolution.dns request

dns

name resolution

name resolution.dns request, name resolution.dns answer

Zeek Spotlight content pack

The Zeek Spotlight content pack contains:

  • Dashboard: Zeek Overview

In this section: