Skip to content

Instantly share code, notes, and snippets.

@lucabelluccini

lucabelluccini/cport-log-example.log

Last active April 2, 2017 17:10
Show Gist options
  • Save lucabelluccini/748aa610465803e971fbb1c4300900ce to your computer and use it in GitHub Desktop.
Save lucabelluccini/748aa610465803e971fbb1c4300900ce to your computer and use it in GitHub Desktop.
Download ZIP
CurrPorts to Kibana end to end configuration (Elastic stack 5.3.0)
Raw
cport-log-example.log
"java.exe","TCP","53472","127.0.0.1","53473","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","","02/04/2017 19.02.00","",""
02/04/2017 19.02.00 Added "java.exe","TCP","53473","127.0.0.1","53472","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","","02/04/2017 19.02.00","",""
02/04/2017 19.02.00 Removed "Unknown","TCP","1120","127.0.0.1","53106","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","LUCA-PC","02/04/2017 19.00.00","",""
02/04/2017 19.02.00 Removed "Unknown","TCP","1120","127.0.0.1","53107","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","LUCA-PC","02/04/2017 19.00.00","",""
02/04/2017 19.02.00 Removed "Unknown","TCP","53096","127.0.0.1","53097","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","LUCA-PC","02/04/2017 19.00.00","",""
02/04/2017 19.02.00 Removed "chrome.exe","UDP","62295","0.0.0.0","","","C:\Program Files (x86)\Google\Chrome\Application\chrome.exe","6860","","Google Chrome","Google Chrome","56.0.2924.87","Google Inc.","31/03/2017 19.14.26","","","LUCA-PC\lucab","","A","","02/04/2017 19.01.16","","Google Hangouts - lucabelluccini@gmail.com"
02/04/2017 19.02.00 Removed "chrome.exe","UDP","62295","::","","","C:\Program Files (x86)\Google\Chrome\Application\chrome.exe","6860","","Google Chrome","Google Chrome","56.0.2924.87","Google Inc.","31/03/2017 19.14.26","","","LUCA-PC\lucab","","A","","02/04/2017 19.01.16","","Google Hangouts - lucabelluccini@gmail.com"
02/04/2017 19.02.00 Removed "java.exe","TCP","53459","127.0.0.1","53460","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","LUCA-PC","02/04/2017 19.01.56","",""
02/04/2017 19.02.00 Removed "java.exe","TCP","53460","127.0.0.1","53459","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","LUCA-PC","02/04/2017 19.01.56","",""
02/04/2017 19.02.04 Added "Unknown","TCP","1120","127.0.0.1","53475","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","","02/04/2017 19.02.04","",""
02/04/2017 19.02.04 Added "Unknown","TCP","1120","127.0.0.1","53478","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","","02/04/2017 19.02.04","",""
02/04/2017 19.02.04 Added "Unknown","TCP","53472","127.0.0.1","53473","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","","02/04/2017 19.02.04","",""
02/04/2017 19.02.04 Added "java.exe","TCP","53476","127.0.0.1","53477","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","","02/04/2017 19.02.04","",""
02/04/2017 19.02.04 Added "java.exe","TCP","53477","127.0.0.1","53476","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","","02/04/2017 19.02.04","",""
02/04/2017 19.02.04 Removed "Unknown","TCP","1120","127.0.0.1","53112","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","LUCA-PC","02/04/2017 19.00.04","",""
02/04/2017 19.02.04 Removed "Unknown","TCP","9200","127.0.0.1","53108","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","LUCA-PC","02/04/2017 19.00.04","",""
02/04/2017 19.02.04 Removed "Unknown","TCP","9200","127.0.0.1","53111","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","LUCA-PC","02/04/2017 19.00.04","",""
02/04/2017 19.02.04 Removed "java.exe","TCP","53472","127.0.0.1","53473","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","LUCA-PC","02/04/2017 19.02.00","",""
02/04/2017 19.02.04 Removed "java.exe","TCP","53473","127.0.0.1","53472","127.0.0.1","E:\Applicazioni\CommonFiles\Java64\bin\java.exe","4696","Established","Java(TM) Platform SE 8","Java(TM) Platform SE binary","8.0.1110.14","Oracle Corporation","N/A","","","","","A","LUCA-PC","02/04/2017 19.02.00","",""
02/04/2017 19.02.04 Removed "Unknown","TCP","53104","127.0.0.1","53105","127.0.0.1","","0","Time Wait","","","","","N/A","","","","","","LUCA-PC","02/04/2017 19.00.04","",""
Raw
currports-log-format
"%Process_Name%","%Protocol%","%Local_Port%","%Local_Address%","%Remote_Port%","%Remote_Address%","%Process_Path%","%Process_ID%","%State%","%Product_Name%","%File_Description%","%File_Version%","%Company%","%Process_Created_On%","%Local_Port_Name%","%Remote_Port_Name%","%User_Name%","%Process_Services%","%Process_Attributes%","%Remote_Host_Name%","%Added_On%","%Module_Filename%","%Window_Title%"
Raw
kibana-tilemap.yml
# The following lines must be appended to the kibana.yml file in order to use Openstreet map
tilemap.url: "http://a.tile.openstreetmap.org/{z}/{x}/{y}.png"
tilemap.options.attribution: "© [Openstreetmap](https://www.openstreetmap.org)"
tilemap.options.maxZoom: 18
Raw
logstash-netstat.conf
input {
# Cports must be configured to log with a custom string matching: "%Process_Name%","%Protocol%","%Local_Port%","%Local_Address%","%Remote_Port%","%Remote_Address%","%Process_Path%","%Process_ID%","%State%","%Product_Name%","%File_Description%","%File_Version%","%Company%","%Process_Created_On%","%Local_Port_Name%","%Remote_Port_Name%","%User_Name%","%Process_Services%","%Process_Attributes%","%Remote_Host_Name%","%Added_On%","%Module_Filename%","%Window_Title%"
file {
path => "<PATH TO CPORTS LOGFILE>"
start_position => "beginning"
codec => plain {
charset => "ISO-8859-1"
}
}
}
filter {
grok {
match => { "message" => "(?<datetime>[\d\/]+\s[\d\.]+)\s(?<Event_Type>\w+)\s+(?<data>.*)" }
remove_field => "message"
}
date {
match => [ "datetime", "dd/MM/yyyy HH.mm.ss" ]
remove_field => "datetime"
timezone => "Europe/Paris"
}
csv {
source => "data"
remove_field => "data"
columns => ["Process_Name","Protocol","Local_Port","Local_Address","Remote_Port","Remote_Address","Process_Path","Process_ID","State","Product_Name","File_Description","File_Version","Company","Process_Created_On","Local_Port_Name","Remote_Port_Name","User_Name","Process_Services","Process_Attributes","Remote_Host_Name","Added_On","Module_Filename","Window_Title"]
skip_empty_columns => true
}
date {
match => [ "Added_On", "dd/MM/yyyy HH.mm.ss" ]
target => "Added_On"
}
if [Process_Created_On] != 'N/A' {
date {
match => [ "Process_Created_On", "dd/MM/yyyy HH.mm.ss" ]
target => "Process_Created_On"
}
} else {
mutate {
remove_field => "Process_Created_On"
}
}
if [Remote_Address] and [Remote_Address] != '127.0.0.1' {
geoip {
source => "Remote_Address"
target => "Remote_Address_Geo"
add_field => {
"Is_Remote" => true
"Remote_Address_Resolved" => "%{Remote_Address}"
}
remove_field => ["[Remote_Address_Geo][location]"]
}
dns {
action => "append"
reverse => ["Remote_Address_Resolved"]
nameserver => ["8.8.8.8", "8.8.4.4"]
}
if [Remote_Address_Geo][longitude] and [Remote_Address_Geo][latitude] {
mutate {
add_field => {
"[Remote_Address_Geo][location][lon]" => "%{[Remote_Address_Geo][longitude]}"
"[Remote_Address_Geo][location][lat]" => "%{[Remote_Address_Geo][latitude]}"
}
}
mutate {
remove_field => ["[Remote_Address_Geo][longitude]","[Remote_Address_Geo][latitude]"]
}
}
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
template => "<PATH TO TEMPLATE>\netstat.template.json"
template_overwrite => true
document_type => "netstat"
}
}
Raw
logstash-netstat.template.json
{
"template":"logstash-*",
"settings":{
"number_of_shards":1
},
"mappings":{
"netstat":{
"dynamic":"false",
"properties":{
"Added_On":{
"type":"date"
},
"Company":{
"type":"keyword"
},
"Window_Title":{
"type":"text"
},
"Remote_Host_Name":{
"type":"text"
},
"Process_Services":{
"type":"text"
},
"Module_Filename":{
"type":"text"
},
"File_Version":{
"type":"keyword"
},
"Event_Type":{
"type":"keyword"
},
"Local_Address":{
"type":"ip"
},
"Remote_Port_Name":{
"type":"keyword"
},
"path":{
"type":"text"
},
"Process_Name":{
"type":"keyword"
},
"Remote_Address":{
"type":"ip"
},
"Process_Created_On":{
"type":"date"
},
"File_Description":{
"type":"text"
},
"Remote_Port":{
"type":"keyword"
},
"host":{
"type":"keyword"
},
"Protocol":{
"type":"keyword"
},
"Remote_Address_Geo":{
"properties":{
"timezone":{
"type":"keyword"
},
"ip":{
"type":"ip"
},
"latitude":{
"type":"double"
},
"continent_code":{
"type":"keyword"
},
"city_name":{
"type":"keyword"
},
"country_code2":{
"type":"keyword"
},
"country_name":{
"type":"keyword"
},
"dma_code":{
"type":"keyword"
},
"country_code3":{
"type":"keyword"
},
"region_name":{
"type":"keyword"
},
"location":{
"type":"geo_point"
},
"postal_code":{
"type":"keyword"
},
"longitude":{
"type":"double"
},
"region_code":{
"type":"keyword"
}
}
},
"User_Name":{
"type":"keyword"
},
"Local_Port":{
"type":"keyword"
},
"Product_Name":{
"type":"keyword"
},
"Remote_Address_Resolved":{
"type":"text"
},
"Process_ID":{
"type":"keyword"
},
"Is_Remote":{
"type":"boolean"
},
"@timestamp":{
"type":"date"
},
"@version":{
"type":"string"
},
"State":{
"type":"keyword"
},
"Local_Port_Name":{
"type":"keyword"
},
"Process_Attributes":{
"type":"keyword"
},
"Process_Path":{
"type":"text"
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment