Fixed parsing error when ip address of ssh beacon is unknown
@@ -93,12 +93,17 @@ filter {
# Set the beacon id from the file name
# Need to match for 3 different occurence:
+ # - one where it states 'unknown'.
# - where the IP address is known based on the file name with beacon_*
# - where the IP address is known based on the file name with ssh_*
- # - one where it states 'unknown'.
+
# It is expected that the logs are in the default subdirectory of the folder cobaltstrike: /cobaltstrike/logs/
grok {
- match => { "[log][file][path]" => [ "/cobaltstrike/logs/((\d{6}))/unknown/beacon_(?<[implant][id]>(\d{1,10}))", "/cobaltstrike/logs/((\d{6}))/%{IPORHOST:[host][ip_int]}/beacon_(?<[implant][id]>(\d{1,10}))", "/cobaltstrike/logs/((\d{6}))/%{IPORHOST:[host][ip_int]}/ssh_(?<[implant][id]>(\d{1,10}))" ] }
+ match => { "[log][file][path]" => [
+ "/cobaltstrike/logs/((\d{6}))/unknown/(beacon|ssh)_(?<[implant][id]>(\d{1,10}))",
+ "/cobaltstrike/logs/((\d{6}))/%{IPORHOST:[host][ip_int]}/beacon_(?<[implant][id]>(\d{1,10}))",
+ "/cobaltstrike/logs/((\d{6}))/%{IPORHOST:[host][ip_int]}/ssh_(?<[implant][id]>(\d{1,10}))"
+ ] }
}
# matching lines like: [metadata] 1.2.3.4 <- 10.10.10.10; computer: SomeComputername; user: SomeUsername; pid: 7368; os: Windows; version: 6.1; beacon arch: x86
