1name: openappsec/openappsec-logs
2description: "Parse openappsec logs"
3filter: "evt.Parsed.program == 'openappsec' && JsonExtract(evt.Parsed.message, 'eventAudience') == 'Security' && Lower(JsonExtract(evt.Parsed.message, 'eventSeverity')) in ['critical', 'high'] && Lower(JsonExtract(evt.Parsed.message, 'eventData.practiceSubType')) in ['web application','web api']"  
4debug: false
5onsuccess: next_stage
6statics:
7  - meta: service
8    value: openappsec
9  - meta: log_type
10    value: openappsec_security_log
11  - target: evt.StrTimeFormat
12    value: "2006-01-02T15:04:05"
13  - target: evt.StrTime
14    expression: JsonExtract(evt.Parsed.message, "eventTime")
15  - meta: event_name
16    expression: JsonExtract(evt.Parsed.message, "eventName")
17  - meta: event_severity
18    expression: JsonExtract(evt.Parsed.message, "eventSeverity")
19  - meta: event_priority
20    expression: JsonExtract(evt.Parsed.message, "eventPriority")
21  - meta: event_audience
22    expression: JsonExtract(evt.Parsed.message, "eventAudience")
23  - meta: source_ip
24    expression: JsonExtract(evt.Parsed.message, "eventData.httpSourceId")
25  - meta: event_confidence
26    expression: JsonExtract(evt.Parsed.message, "eventData.eventConfidence")
27  - meta: security_action
28    expression: JsonExtract(evt.Parsed.message, "eventData.securityAction")
29  - meta: source_identifier
30    expression: JsonExtract(evt.Parsed.message, "eventData.httpSourceId")
31  - meta: matched_sample
32    expression: JsonExtract(evt.Parsed.message, "eventData.matchedSample")
33  - meta: matched_parameter
34    expression: JsonExtract(evt.Parsed.message, "eventData.matchedParameter")
35  - meta: matched_location
36    expression: JsonExtract(evt.Parsed.message, "eventData.matchedLocation")
37  - meta: incident_type
38    expression: JsonExtract(evt.Parsed.message, "eventData.waapIncidentType")