custom output to external destination referencing event fields

[jamestest11]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

26

RAM

134gb

Storage for /

200GB

Storage for /nsm

200TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I installed Security Onion 2.4.50 from scratch, and trying to get my custom pipeline output to an external destination (syslog) working properly again. I've written a custom pipeline as shown below and it works.

output {
if [event][module] =~ "suricata" {
syslog {
id => "cloned_events_out"
host => "10.1.10.144"
port => 10008
codec => "json"
}
}
}

However, I'm only interested in outputting alerts to syslog, and I cannot figure out how to reference fields within the event. For instance, [event][tags] =~ "alert" will not work. [event][dataset] =~ "suricata.alert" In version Security Onion 2.3, if [module] =~ "suricata" seemed to work fine. I see these fields when I look at the event in Kibana. I guess what it boils down to is I don't know how to correctly reference fields to use in if statements like above. Wondering if anyone can provide guidance on this? Yes I have referenced https://docs.securityonion.net/en/2.4/logstash.html#original-event-forwarding

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Are you using Suricata as metadata too? If not if [event][module] =~ "suricata" should be fine. Did you also add the config to a Logstash pipeline (manager or search)?

[jamestest11]

Yes I am using Suricata for metadata. Yes config is added to a Logstash pipeline (manager). And this works using if [event][module] =~ "suricata". My question is, if I want to reference other fields in the metadata, is there a way of doing this? The only two I can get working successfully are [event][module] =~ "suricata" and [event][category] =~ "network"

Let's say I want to reference tags. [event][tags] =~ "alert" doesn't seem to work. (this is my ultimate goal)

Or, how would I reference other fields, like event.dataset, or network.transport? These fields seem to be strings, but I cannot get them to work in my config

[cm-ops]

Instead of using [event][tags] =~ "alert" just use [tags] =~ "alert" or if [event][module] =~ "suricata" and "alert in [tags].

[jamestest11]

yes I have tried all the above what you suggested and it doesn't work. I even upgraded from version 2.4.50 to version 2.4.60 this morning to see if that made a difference, thinking it might be a bug.

[cm-ops]

This was handled with Professional Services.