1name: openappsec/openappsec-logs
2description: "Parse openappsec logs"
3filter: "evt.Parsed.program == 'openappsec' && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'openappsec') in ['', nil] && evt.Unmarshaled.openappsec.eventAudience == 'Security' && Lower(evt.Unmarshaled.openappsec.eventSeverity) in ['critical', 'high'] && Lower(evt.Unmarshaled.openappsec.eventData.practiceSubType) in ['web application','web api']"
4debug: false
5onsuccess: next_stage
6statics:
7  - meta: service
8    value: openappsec
9  - meta: log_type
10    value: openappsec_security_log
11  - target: evt.StrTimeFormat
12    value: "2006-01-02T15:04:05"
13  - target: evt.StrTime
14    expression: evt.Unmarshaled.openappsec.eventTime
15  - meta: event_name
16    expression: evt.Unmarshaled.openappsec.eventName
17  - meta: event_severity
18    expression: evt.Unmarshaled.openappsec.eventSeverity
19  - meta: event_priority
20    expression: evt.Unmarshaled.openappsec.eventPriority
21  - meta: event_audience
22    expression: evt.Unmarshaled.openappsec.eventAudience
23  - meta: source_ip
24    expression: evt.Unmarshaled.openappsec.eventData.httpSourceId
25  - meta: event_confidence
26    expression: evt.Unmarshaled.openappsec.eventData.eventConfidence
27  - meta: security_action
28    expression: evt.Unmarshaled.openappsec.eventData.securityAction
29  - meta: source_identifier
30    expression: evt.Unmarshaled.openappsec.eventData.httpSourceId
31  - meta: target_fqdn
32    expression: evt.Unmarshaled.openappsec.eventData.httpHostName
33  - meta: matched_sample
34    expression: evt.Unmarshaled.openappsec.eventData.matchedSample
35  - meta: matched_parameter
36    expression: evt.Unmarshaled.openappsec.eventData.matchedParameter
37  - meta: matched_location
38    expression: evt.Unmarshaled.openappsec.eventData.matchedLocation
39  - meta: incident_type
40    expression: evt.Unmarshaled.openappsec.eventData.waapIncidentType
41