Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Gis 8557 splunk fixes#201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
nazargesyk merged 3 commits intomainfromgis-8557
Oct 16, 2024
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
platform: ElasticSearch ES|QL
source: aws_cloudtrail
log_source:
index: [logs-*]
default_log_source:
index: logs-*
field_mapping:
additionalEventdata: aws.cloudtrail.additional_eventdata
apiVersion: aws.cloudtrail.api_version
awsRegion: cloud.region
errorCode: aws.cloudtrail.error_code
errorMessage: aws.cloudtrail.error_message
eventID: event.id
eventName: event.action
eventSource: event.provider
eventTime: '@timestamp'
eventType: aws.cloudtrail.event_type
eventVersion: aws.cloudtrail.event_version
managementEvent: aws.cloudtrail.management_event
readOnly: aws.cloudtrail.read_only
requestID: aws.cloudtrail.request_id
requestParameters: aws.cloudtrail.request_parameters
resources.accountId: aws.cloudtrail.resources.account_id
resources.ARN: aws.cloudtrail.resources.arn
resources.type: aws.cloudtrail.resources.type
responseElements: aws.cloudtrail.response_elements
serviceEventDetails: aws.cloudtrail.service_event_details
sharedEventId: aws.cloudtrail.shared_event_id
sourceIPAddress: source.address
userAgent: user_agent
userIdentity.accessKeyId: aws.cloudtrail.user_identity.access_key_id
userIdentity.accountId: cloud.account.id
userIdentity.arn: aws.cloudtrail.user_identity.arn
userIdentity.invokedBy: aws.cloudtrail.user_identity.invoked_by
userIdentity.principalId: user.id
userIdentity.sessionContext.attributes.creationDate: aws.cloudtrail.user_identity.session_context.creation_date
userIdentity.sessionContext.attributes.mfaAuthenticated: aws.cloudtrail.user_identity.session_context.mfa_authenticated
userIdentity.sessionContext.sessionIssuer.userName: role.name
userIdentity.type: aws.cloudtrail.user_identity.type
userIdentity.userName: user.name
vpcEndpointId: aws.cloudtrail.vpc_endpoint_id
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -29,6 +29,7 @@

class SplQueryParser(PlatformQueryParser):
log_source_pattern = r"^___source_type___\s*=\s*(?:\"(?P<d_q_value>[%a-zA-Z_*:0-9\-/]+)\"|(?P<value>[%a-zA-Z_*:0-9\-/]+))(?:\s+(?:and|or)\s+|\s+)?" # noqa: E501
rule_name_pattern = r"`(?P<name>(?:[:a-zA-Z*0-9=+%#\-_/,;`?~‘\'.<>$&^@!\]\[()\s])*)`"
log_source_key_types = ("index", "source", "sourcetype", "sourcecategory")

platform_functions: SplFunctions = None
Expand All@@ -53,6 +54,9 @@ def _parse_log_sources(self, query: str) -> tuple[dict[str, list[str]], str]:
return log_sources, query

def _parse_query(self, query: str) -> tuple[str, dict[str, list[str]], ParsedFunctions]:
if re.match(self.rule_name_pattern, query):
search = re.search(self.rule_name_pattern, query, flags=re.IGNORECASE)
query = query[:search.start()] + query[search.end():]
query = query.strip()
log_sources, query = self._parse_log_sources(query)
query, functions = self.platform_functions.parse(query)
Expand Down
[8]ページ先頭
©2009-2025 Movatter.jp