OPNsense-Dashboard/config/OPNsense-pack.json
2023-10-10 15:03:55 -05:00

711 lines
20 KiB
JSON

{
"v": "1",
"id": "6f88399d-9c58-4a70-b7fe-30d4a057132a",
"rev": 2,
"name": "OPNsense Dashboard",
"summary": "This pack includes everything needed to setup Graylog for the dashboard.",
"description": "",
"vendor": "bsmithio",
"url": "https://github.com/bsmithio/OPNsense-Dashboard",
"parameters": [],
"entities": [
{
"v": "1",
"type": {
"name": "input",
"version": "1"
},
"id": "a9e59e12-e4a8-4a9f-acda-960e78b8f9b6",
"data": {
"title": {
"@type": "string",
"@value": "Syslog UDP"
},
"configuration": {
"port": {
"@type": "integer",
"@value": 1514
},
"recv_buffer_size": {
"@type": "integer",
"@value": 262144
},
"force_rdns": {
"@type": "boolean",
"@value": false
},
"allow_override_date": {
"@type": "boolean",
"@value": true
},
"bind_address": {
"@type": "string",
"@value": "0.0.0.0"
},
"expand_structured_data": {
"@type": "boolean",
"@value": false
},
"store_full_message": {
"@type": "boolean",
"@value": true
},
"charset_name": {
"@type": "string",
"@value": "UTF-8"
},
"number_worker_threads": {
"@type": "integer",
"@value": 6
}
},
"static_fields": {},
"type": {
"@type": "string",
"@value": "org.graylog2.inputs.syslog.udp.SyslogUDPInput"
},
"global": {
"@type": "boolean",
"@value": false
},
"extractors": [
{
"target_field": {
"@type": "string",
"@value": "filterlog_ipv6_icmp"
},
"condition_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*,(in|out),6,.*,icmp,.*)$"
},
"order": {
"@type": "integer",
"@value": 5
},
"converters": [
{
"type": {
"@type": "string",
"@value": "CSV"
},
"configuration": {
"column_header": {
"@type": "string",
"@value": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,class,flowlabel,hoplimit,protocol-name,protocol-id,length,src-ip,dst-ip,datalength"
}
}
}
],
"configuration": {
"regex_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*)$"
}
},
"source_field": {
"@type": "string",
"@value": "full_message"
},
"title": {
"@type": "string",
"@value": "OPNsense: RFC5424 IPv6 ICMP"
},
"type": {
"@type": "string",
"@value": "REGEX"
},
"cursor_strategy": {
"@type": "string",
"@value": "COPY"
},
"condition_type": {
"@type": "string",
"@value": "REGEX"
}
},
{
"target_field": {
"@type": "string",
"@value": "filterlog_ipv6_tcp"
},
"condition_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*,(in|out),6,.*,tcp,.*)$"
},
"order": {
"@type": "integer",
"@value": 1
},
"converters": [
{
"type": {
"@type": "string",
"@value": "CSV"
},
"configuration": {
"column_header": {
"@type": "string",
"@value": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ipversion,class,flowlabel,hoplimit,protocol-name,protocol-id,length,src-ip,dst-ip,src-port,dst-port,datalength,tcp-flags,sequence,ack,window,urg,options,opnsense-rid"
},
"trim_leading_whitespace": {
"@type": "boolean",
"@value": true
}
}
}
],
"configuration": {
"regex_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*)$"
}
},
"source_field": {
"@type": "string",
"@value": "full_message"
},
"title": {
"@type": "string",
"@value": "OPNsense: RFC5424 IPv6 TCP"
},
"type": {
"@type": "string",
"@value": "REGEX"
},
"cursor_strategy": {
"@type": "string",
"@value": "COPY"
},
"condition_type": {
"@type": "string",
"@value": "REGEX"
}
},
{
"target_field": {
"@type": "string",
"@value": "filterlog_ipv4_tcp"
},
"condition_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*,(in|out),4,.*,tcp,.*)$"
},
"order": {
"@type": "integer",
"@value": 0
},
"converters": [
{
"type": {
"@type": "string",
"@value": "CSV"
},
"configuration": {
"column_header": {
"@type": "string",
"@value": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,ip-flags,protocol-id,protocol-name,length,src-ip,dst-ip,src-port,dst-port,datalength,tcp-flags,sequence,f1,f2,tcp-options,opnsense-rid"
},
"trim_leading_whitespace": {
"@type": "boolean",
"@value": true
}
}
}
],
"configuration": {
"regex_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*)$"
}
},
"source_field": {
"@type": "string",
"@value": "full_message"
},
"title": {
"@type": "string",
"@value": "OPNsense: RFC5424 IPv4 TCP"
},
"type": {
"@type": "string",
"@value": "REGEX"
},
"cursor_strategy": {
"@type": "string",
"@value": "COPY"
},
"condition_type": {
"@type": "string",
"@value": "REGEX"
}
},
{
"target_field": {
"@type": "string",
"@value": "filterlog_ipv4_udp"
},
"condition_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*,(in|out),4,.*,udp,.*)$"
},
"order": {
"@type": "integer",
"@value": 2
},
"converters": [
{
"type": {
"@type": "string",
"@value": "CSV"
},
"configuration": {
"column_header": {
"@type": "string",
"@value": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-name,length,src-ip,dst-ip,src-port,dst-port,opnsense-rid"
},
"trim_leading_whitespace": {
"@type": "boolean",
"@value": true
}
}
}
],
"configuration": {
"regex_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*)$"
}
},
"source_field": {
"@type": "string",
"@value": "full_message"
},
"title": {
"@type": "string",
"@value": "OPNsense: RFC5424 IPv4 UDP"
},
"type": {
"@type": "string",
"@value": "REGEX"
},
"cursor_strategy": {
"@type": "string",
"@value": "COPY"
},
"condition_type": {
"@type": "string",
"@value": "REGEX"
}
},
{
"target_field": {
"@type": "string",
"@value": "filterlog_ipv4_icmp"
},
"condition_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*,(in|out),4,.*,icmp,.*)$"
},
"order": {
"@type": "integer",
"@value": 4
},
"converters": [
{
"type": {
"@type": "string",
"@value": "CSV"
},
"configuration": {
"column_header": {
"@type": "string",
"@value": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,tos,ecn,ttl,id,offset,flags,protocol-id,protocol-name,length,src-ip,dst-ip,datalength"
}
}
}
],
"configuration": {
"regex_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*)$"
}
},
"source_field": {
"@type": "string",
"@value": "full_message"
},
"title": {
"@type": "string",
"@value": "OPNsense: RFC5424 IPv4 ICMP"
},
"type": {
"@type": "string",
"@value": "REGEX"
},
"cursor_strategy": {
"@type": "string",
"@value": "COPY"
},
"condition_type": {
"@type": "string",
"@value": "REGEX"
}
},
{
"target_field": {
"@type": "string",
"@value": "filterlog_ipv6_udp"
},
"condition_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*,(in|out),6,.*,udp,.*)$"
},
"order": {
"@type": "integer",
"@value": 3
},
"converters": [
{
"type": {
"@type": "string",
"@value": "CSV"
},
"configuration": {
"column_header": {
"@type": "string",
"@value": "rule-number,sub-rule-number,anchor,tracker,interface,reason,action,direction,ip-version,class,flowlabel,hoplimit,protocol-name,protocol-id,length,src-ip,dst-ip,src-port,dst-port,opnsense-rid"
}
}
}
],
"configuration": {
"regex_value": {
"@type": "string",
"@value": "^(?i).*\\sfilterlog.+\\[.+\\]\\s(.*)$"
}
},
"source_field": {
"@type": "string",
"@value": "full_message"
},
"title": {
"@type": "string",
"@value": "OPNsense: RFC5424 IPv6 UDP"
},
"type": {
"@type": "string",
"@value": "REGEX"
},
"cursor_strategy": {
"@type": "string",
"@value": "COPY"
},
"condition_type": {
"@type": "string",
"@value": "REGEX"
}
}
]
},
"constraints": [
{
"type": "server-version",
"version": ">=5.0.2+59d96f8"
}
]
},
{
"v": "1",
"type": {
"name": "lookup_adapter",
"version": "1"
},
"id": "056ed2d3-38f8-41cc-8cb0-b9fdb8d95d32",
"data": {
"_scope": {
"@type": "string",
"@value": "DEFAULT"
},
"name": {
"@type": "string",
"@value": "geoip"
},
"title": {
"@type": "string",
"@value": "GeoIP"
},
"description": {
"@type": "string",
"@value": "Geo IP Lookup Table"
},
"configuration": {
"type": {
"@type": "string",
"@value": "maxmind_geoip"
},
"path": {
"@type": "string",
"@value": "/usr/share/graylog/data/data/GeoLite2-Country.mmdb"
},
"database_type": {
"@type": "string",
"@value": "MAXMIND_COUNTRY"
},
"check_interval": {
"@type": "long",
"@value": 1
},
"check_interval_unit": {
"@type": "string",
"@value": "MINUTES"
}
}
},
"constraints": [
{
"type": "server-version",
"version": ">=5.0.2+59d96f8"
}
]
},
{
"v": "1",
"type": {
"name": "lookup_cache",
"version": "1"
},
"id": "776809e0-ea08-45e0-9df3-f06bb15585ed",
"data": {
"_scope": {
"@type": "string",
"@value": "DEFAULT"
},
"name": {
"@type": "string",
"@value": "geoip"
},
"title": {
"@type": "string",
"@value": "GeoIP"
},
"description": {
"@type": "string",
"@value": "GeoIP Cache"
},
"configuration": {
"type": {
"@type": "string",
"@value": "guava_cache"
},
"max_size": {
"@type": "integer",
"@value": 1000
},
"expire_after_access": {
"@type": "long",
"@value": 1
},
"expire_after_access_unit": {
"@type": "string",
"@value": "SECONDS"
},
"expire_after_write": {
"@type": "long",
"@value": 0
}
}
},
"constraints": [
{
"type": "server-version",
"version": ">=5.0.2+59d96f8"
}
]
},
{
"v": "1",
"type": {
"name": "lookup_table",
"version": "1"
},
"id": "19a27a83-5ffc-4f8d-a39c-a00d7c4ea36a",
"data": {
"default_single_value_type": {
"@type": "string",
"@value": "NULL"
},
"cache_name": {
"@type": "string",
"@value": "776809e0-ea08-45e0-9df3-f06bb15585ed"
},
"name": {
"@type": "string",
"@value": "geoip"
},
"default_multi_value_type": {
"@type": "string",
"@value": "NULL"
},
"default_multi_value": {
"@type": "string",
"@value": ""
},
"data_adapter_name": {
"@type": "string",
"@value": "056ed2d3-38f8-41cc-8cb0-b9fdb8d95d32"
},
"_scope": {
"@type": "string",
"@value": "DEFAULT"
},
"title": {
"@type": "string",
"@value": "GeoIP"
},
"default_single_value": {
"@type": "string",
"@value": ""
},
"description": {
"@type": "string",
"@value": "Geo IP Lookup"
}
},
"constraints": [
{
"type": "server-version",
"version": ">=5.0.2+59d96f8"
}
]
},
{
"v": "1",
"type": {
"name": "pipeline",
"version": "1"
},
"id": "5a7ec7eb-d413-4d6f-96e1-70a73f4df8e1",
"data": {
"title": {
"@type": "string",
"@value": "GeoIP"
},
"description": {
"@type": "string",
"@value": "GeoIP"
},
"source": {
"@type": "string",
"@value": "pipeline \"GeoIP\"\nstage 0 match either\nrule \"GeoIP lookup: src-ip\"\nend"
},
"connected_streams": [
{
"@type": "string",
"@value": "67c8983f-c842-4a33-9650-94f19a793e0d"
}
]
},
"constraints": [
{
"type": "server-version",
"version": ">=5.0.2+59d96f8"
}
]
},
{
"v": "1",
"type": {
"name": "pipeline_rule",
"version": "1"
},
"id": "9bea4894-60ec-495b-8531-0f5e27fc8025",
"data": {
"title": {
"@type": "string",
"@value": "GeoIP lookup: src-ip"
},
"description": {
"@type": "string",
"@value": ""
},
"source": {
"@type": "string",
"@value": "rule \"GeoIP lookup: src-ip\"\nwhen\nhas_field(\"src-ip\")\nthen\nlet geo = lookup(\"geoip\", to_string($message.\"src-ip\"));\nset_field(\"src-ip-geo-location\", geo[\"coordinates\"]);\nset_field(\"src-ip-geo-country\", geo[\"country\"].iso_code);\nset_field(\"src-ip-geo-city\", geo[\"city\"].names.en);\nend"
}
},
"constraints": [
{
"type": "server-version",
"version": ">=5.0.2+59d96f8"
}
]
},
{
"v": "1",
"type": {
"name": "stream",
"version": "1"
},
"id": "67c8983f-c842-4a33-9650-94f19a793e0d",
"data": {
"alarm_callbacks": [],
"outputs": [],
"remove_matches": {
"@type": "boolean",
"@value": true
},
"title": {
"@type": "string",
"@value": "OPNsense / filterlog"
},
"stream_rules": [
{
"type": {
"@type": "string",
"@value": "CONTAINS"
},
"field": {
"@type": "string",
"@value": "application_name"
},
"value": {
"@type": "string",
"@value": "filterlog"
},
"inverted": {
"@type": "boolean",
"@value": false
},
"description": {
"@type": "string",
"@value": ""
}
}
],
"alert_conditions": [],
"matching_type": {
"@type": "string",
"@value": "OR"
},
"disabled": {
"@type": "boolean",
"@value": false
},
"description": {
"@type": "string",
"@value": "OPNsense filter logs"
},
"default_stream": {
"@type": "boolean",
"@value": false
}
},
"constraints": [
{
"type": "server-version",
"version": ">=5.0.2+59d96f8"
}
]
}
]
}