| { |
| "enrichment": { |
| "fieldMap": { |
| "geo": [ |
| "ip_src_addr", |
| "ip_dst_addr" |
| ], |
| "host": [ |
| "ip_src_addr", |
| "ip_dst_addr" |
| ], |
| "hbaseEnrichment": [ |
| "ip_src_addr", |
| "ip_dst_addr" |
| ], |
| "stellar" : { |
| "config" : { |
| "numeric" : { |
| "map" : "{ 'blah' : 1}" |
| ,"one" : "MAP_GET('blah', map)" |
| ,"foo": "1 + 1" |
| } |
| ,"ALL_CAPS" : "TO_UPPER(source.type)" |
| ,"src_enrichment" : { |
| "src_classification" : "ENRICHMENT_GET('playful_classification', ip_src_addr, 'enrichments', 'cf')" |
| } |
| ,"dst_enrichment" : { |
| "dst_classification" : "ENRICHMENT_GET('playful_classification', ip_dst_addr, 'enrichments', 'cf')" |
| } |
| } |
| } |
| } |
| ,"fieldToTypeMap": { |
| "ip_src_addr": [ |
| "playful_classification" |
| ], |
| "ip_dst_addr": [ |
| "playful_classification" |
| ] |
| } |
| }, |
| "threatIntel": { |
| "fieldMap": { |
| "hbaseThreatIntel": [ |
| "ip_src_addr", |
| "ip_dst_addr" |
| ], |
| "stellar" : { |
| "config" : { |
| "bar" : "TO_UPPER(source.type)" |
| ,"is_src_malicious" : "ENRICHMENT_EXISTS('malicious_ip', ip_src_addr, 'threat_intel', 'cf')" |
| } |
| } |
| }, |
| "fieldToTypeMap": { |
| "ip_src_addr": [ |
| "malicious_ip" |
| ], |
| "ip_dst_addr": [ |
| "malicious_ip" |
| ] |
| }, |
| "triageConfig" : { |
| "riskLevelRules" : [ |
| { |
| "name" : "The name of the triage rule", |
| "comment" : "A description of the triage rule", |
| "rule" : "ip_src_addr == '10.0.2.3' or ip_dst_addr == '10.0.2.3'", |
| "score": 10, |
| "reason": "'Reason field'" |
| } |
| ], |
| "aggregator" : "MAX" |
| } |
| } |
| } |
| |
