Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
National Vulnerability Database (NVD) XML | JSON | logstash
input {
tcp {
port => 5000
codec => json_lines {
}
}
}
## Add your filters / logstash plugins configuration here
filter {
mutate {
add_field => {
published => "%{[published-datetime]}"
lastModified => "%{[last-modified-datetime]}"
productList => "%{[vulnerable-software-list][0][product]}"
}
rename => {
"cve-id" => "cveId"
}
}
if [cwe] {
mutate {
add_field => {
cweId => "%{[cwe][0][id]}"
}
}
}
if [cvss] {
mutate {
add_field => {
score => "%{[cvss][0][base_metrics][0][score]}"
authentication => "%{[cvss][0][base_metrics][0][authentication]}"
accessComplexity => "%{[cvss][0][base_metrics][0][access-complexity]}"
accessVector => "%{[cvss][0][base_metrics][0][access-vector]}"
availabilityImpact => "%{[cvss][0][base_metrics][0][availability-impact]}"
confidentialityImpact => "%{[cvss][0][base_metrics][0][confidentiality-impact]}"
integrityImpact => "%{[cvss][0][base_metrics][0][integrity-impact]}"
}
}
}
ruby {
code => "
objectArray = []
event.get('productList').split(',').each { |cpe|
this_object = {}
if match = cpe.match(/cpe:\/\w:([^:]+):([^:]+):?(.*)/i)
company, product, version = match.captures
this_object['company'] = company
this_object['product'] = product
this_object['version'] = version || ''
end
objectArray << this_object
}
event.set('products', objectArray)
"
}
mutate {
remove_field => ["cwe", "cvss", "id", "host", "port", "productList", "nvd_xml_version", "xmlns:xsi", "xmlns:vuln", "xmlns:scap-core", "xmlns:patch", "xmlns:cvss", "xmlns:cpe-lang", "pub_date", "last-modified-datetime", "published-datetime", "vulnerable-configuration", "vulnerable-software-list" ]
}
#date {
# match => [ "published-datetime", "YYYY-MM-dd'T'HH:mm:ss.SSS-ZZZ", "YYYY-MM-dd'T'HH:mm:ss.SSSZZZ" ]
#}
}
output {
#stdout { codec => rubydebug }
elasticsearch {
index => "cve-%{+YYYY.MM.dd}"
hosts => "localhost:9200"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.