Merge pull request #281 from airbnb/mimeframe-streamalert-schemas-update

[streamalert] logs - update CB and osquery schemas
airbnb · Sep 6, 2017 · 8942c7d · 8942c7d
2 parents 08b9dc5 + d7e640e
commit 8942c7d
Showing 1 changed file with 34 additions and 6 deletions.
diff --git a/conf/logs.json b/conf/logs.json
@@ -7,7 +7,7 @@
       "md5": "string",
       "node_id": "string",
       "size": "string",
-      "timestamp": "float",
+      "timestamp": "string",
       "type": "string"
     },
     "parser": "json"
@@ -151,13 +151,21 @@
       "alert_resolution": "string",
       "cb_server": "string",
       "feed_name": "string",
+      "ioc_query_index": "string",
+      "ioc_query_string": "string",
       "ioc_type": "string",
       "ioc_value": "string",
       "report_id": [],
       "timestamp": "string",
       "type": "string"
     },
-    "parser": "json"
+    "parser": "json",
+    "configuration": {
+      "optional_top_level_keys": [
+        "ioc_query_index",
+        "ioc_query_string"
+      ]
+    }
   },
   "carbonblack:alert.watchlist.hit.feedsearch.binary": {
     "schema": {
@@ -273,7 +281,7 @@
   },
   "carbonblack:alert.watchlist.hit.query.process": {
     "schema": {
-      "alert_severity": "integer",
+      "alert_severity": "float",
       "alert_type": "string",
       "assigned_to": "string",
       "cb_server": "string",
@@ -290,7 +298,7 @@
       "hostname": "string",
       "interface_ip": "string",
       "ioc_attr": "string",
-      "ioc_confidence": "integer",
+      "ioc_confidence": "float",
       "ioc_type": "string",
       "md5": "string",
       "modload_count": "integer",
@@ -804,6 +812,7 @@
       "hostIdentifier": "string",
       "calendarTime": "string",
       "unixTime": "string",
+      "epoch": "integer",
       "columns": {},
       "action": "string",
       "decorations": {},
@@ -812,8 +821,9 @@
     "parser": "json",
     "configuration": {
       "optional_top_level_keys": [
-        "log_type",
-        "decorations"
+        "decorations",
+        "epoch",
+        "log_type"
       ]
     }
   },
@@ -837,6 +847,24 @@
       ]
     }
   },
+  "osquery_snapshot": {
+    "schema": {
+      "snapshot": [],
+      "name": "string",
+      "hostIdentifier": "string",
+      "calendarTime": "string",
+      "unixTime": "string",
+      "action": "string",
+      "decorations": {},
+      "log_type": "string"
+    },
+    "parser": "json",
+    "configuration": {
+      "optional_top_level_keys": [
+        "decorations"
+      ]
+    }
+  },
   "pan": {
     "schema": {
       "messageId": "string",