GRAYLOG_SymantecSSLV-v3x_Extractors.json

{
  "extractors": [
    {
      "title": "SSLV-[dhclient]",
      "extractor_type": "grok",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{HOSTNAME:sname} %{DATA:process}: %{DATA:command}: %{DATA:object}, interval %{BASE10NUM:rate}ms."
      },
      "condition_type": "string",
      "condition_value": "dhclient"
    },
    {
      "title": "SSLV-[sslcontrol]",
      "extractor_type": "grok",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{HOSTNAME:sname} %{DATA:process}: %{GREEDYDATA:object}"
      },
      "condition_type": "string",
      "condition_value": "sslcontrol"
    },
    {
      "title": "SSLV-[sslmanage]",
      "extractor_type": "grok",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{HOSTNAME:sname} %{DATA:process}: %{GREEDYDATA:object}"
      },
      "condition_type": "string",
      "condition_value": "sslmanage"
    },
    {
      "title": "SSLV-[syslog-ng]",
      "extractor_type": "grok",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{HOSTNAME:sname} %{DATA:process}\\[%{BASE10NUM:session}\\]: %{GREEDYDATA:object}"
      },
      "condition_type": "string",
      "condition_value": "syslog-ng"
    },
    {
      "title": "SSLV-[ssldata]",
      "extractor_type": "grok",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{HOSTNAME:sname} %{DATA:process}\\[%{BASE10NUM:processId}\\]: \\[%{DATA:ssl_segmentId}\\] %{DATA:session} %{IPV4:sip}:%{DATA:sport} -> %{IPV4:dip}:%{DATA:dport} %{DATA:ssl_type} %{DATA:ssl_cypher} %{DATA:URL} %{DATA:ssl_unknown} cert fp: %{DATA:ssl_certificate} rule:%{BASE10NUM:ssl_ruleId} %{DATA:command} %{DATA:ssl_status}"
      },
      "condition_type": "string",
      "condition_value": "ssldata"
    }
  ],
  "version": "2.2.0-SNAPSHOT"
}