-
-
Save tnesmithWasTaken/7955d9ab03edc90066d4beeaa8922630 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"paloalto-traffic-*" : { | |
"mappings" : { | |
"doc" : { | |
"dynamic_templates" : [ | |
{ | |
"message_field" : { | |
"path_match" : "message", | |
"match_mapping_type" : "string", | |
"mapping" : { | |
"norms" : false, | |
"type" : "text" | |
} | |
} | |
}, | |
{ | |
"string_fields" : { | |
"match" : "*", | |
"match_mapping_type" : "string", | |
"mapping" : { | |
"fields" : { | |
"keyword" : { | |
"ignore_above" : 256, | |
"type" : "keyword" | |
} | |
}, | |
"norms" : false, | |
"type" : "text" | |
} | |
} | |
} | |
], | |
"properties" : { | |
"@timestamp" : { | |
"type" : "date" | |
}, | |
"@version" : { | |
"type" : "keyword" | |
}, | |
"Action" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"ActionSource" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"Application" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"Bytes" : { | |
"type" : "long" | |
}, | |
"BytesReceived" : { | |
"type" : "long" | |
}, | |
"BytesSent" : { | |
"type" : "long" | |
}, | |
"Category" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"ConfigVersion" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DGHierarchy1" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DGHierarchy2" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DGHierarchy3" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DGHierarchy4" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DestinationAddress" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DestinationCountry" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DestinationGeo" : { | |
"dynamic" : "true", | |
"properties" : { | |
"city_name" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"continent_code" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"country_code2" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"country_code3" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"country_name" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"dma_code" : { | |
"type" : "long" | |
}, | |
"ip" : { | |
"type" : "ip" | |
}, | |
"latitude" : { | |
"type" : "half_float" | |
}, | |
"location" : { | |
"type" : "geo_point" | |
}, | |
"longitude" : { | |
"type" : "half_float" | |
}, | |
"postal_code" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"region_code" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"region_name" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"timezone" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
} | |
} | |
}, | |
"DestinationPort" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DestinationZone" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"DeviceName" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"ElapsedTimeInSec" : { | |
"type" : "long" | |
}, | |
"Flags" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"GenerateTime" : { | |
"type" : "date", | |
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis" | |
}, | |
"IPProtocol" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"InboundInterface" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"LogAction" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"NATDestinationIP" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"NATDestinationPort" : { | |
"type" : "long" | |
}, | |
"NATSourceIP" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"NATSourcePort" : { | |
"type" : "long" | |
}, | |
"OutboundInterface" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"Packets" : { | |
"type" : "long" | |
}, | |
"Padding" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"PaloAltoDomain" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"ParentSessionID" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"ReceiveTime" : { | |
"type" : "date", | |
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis" | |
}, | |
"RepeatCount" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"Rule" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"SerialNum" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"SessionEndReason" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"SessionID" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"SourceAddress" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"SourceCountry" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"SourcePort" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"SourceZone" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"StartTime" : { | |
"type" : "date", | |
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis" | |
}, | |
"Threat-ContentType" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"TimeLogged" : { | |
"type" : "date", | |
"format" : "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis" | |
}, | |
"TunnelID_IMSI" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"TunnelType" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"Type" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"VirtualSystem" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"actionflags" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"cpadding" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"fingerprint" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"host" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"path" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"pkts_received" : { | |
"type" : "long" | |
}, | |
"pkts_sent" : { | |
"type" : "long" | |
}, | |
"seqno" : { | |
"type" : "long" | |
}, | |
"syslog_host" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"tags" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"type" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
}, | |
"vsysName" : { | |
"type" : "text", | |
"norms" : false, | |
"fields" : { | |
"keyword" : { | |
"type" : "keyword", | |
"ignore_above" : 256 | |
} | |
} | |
} | |
} | |
}, | |
"_default_" : { | |
"dynamic_templates" : [ | |
{ | |
"message_field" : { | |
"path_match" : "message", | |
"match_mapping_type" : "string", | |
"mapping" : { | |
"norms" : false, | |
"type" : "text" | |
} | |
} | |
}, | |
{ | |
"string_fields" : { | |
"match" : "*", | |
"match_mapping_type" : "string", | |
"mapping" : { | |
"fields" : { | |
"keyword" : { | |
"ignore_above" : 256, | |
"type" : "keyword" | |
} | |
}, | |
"norms" : false, | |
"type" : "text" | |
} | |
} | |
} | |
], | |
"properties" : { | |
"@timestamp" : { | |
"type" : "date" | |
}, | |
"@version" : { | |
"type" : "keyword" | |
}, | |
"DestinationGeo" : { | |
"dynamic" : "true", | |
"properties" : { | |
"ip" : { | |
"type" : "ip" | |
}, | |
"latitude" : { | |
"type" : "half_float" | |
}, | |
"location" : { | |
"type" : "geo_point" | |
}, | |
"longitude" : { | |
"type" : "half_float" | |
} | |
} | |
} | |
} | |
} | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment