logstash.conf

input {
  tcp {
    port => 8515
    type => "nap"
    codec => plain {
      charset => "ISO-8859-1"
    }    
  }

}

filter {
  grok {
    match => { "message" => "<%{POSINT:syslog_pri}>%{TIMESTAMP_ISO8601:timestamp} %{HOSTNAME:host} ASM:%{GREEDYDATA:syslog_message}" }
  }

  json {
    source => "syslog_message"
    remove_field => [ "Host", "message", "[event][original]", "syslog_pri", "syslog_message" ]
    add_field => { "temp_ip" => "%{[json_log][clientIp]}" }

  }

  cidr {
    address => [ "%{[json_log][clientIp]}" ]
    add_tag => [ "internalIP" ]
    network => [ "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16" ]
  }
  if "internalIP" not in [tags] {
    geoip {
      source => "temp_ip"
      target => "src_geoip"    
      ecs_compatibility => disabled
    }    
  }
  else {
    mutate {
      add_field => {
          "country_name" => "InternalIP"
          "country" => "DataCenter"
      }
    }
  } 


  ruby {
    code => '
      
      json_log=event.get("json_log")
      geo=event.get("src_geoip")
      event.set("id", json_log["id"])
      event.set("violations", json_log["violations"])
      event.set("enforcementAction", json_log["enforcementAction"])
      if json_log["method"]
        # Set "method" field to the value of json_log[method]
        event.set("method", json_log["method"])
      else
        # Set "method" field to "N/A"
        event.set("method", "N/A")        
      end
      event.set("clientPort", json_log["clientPort"])
      event.set("clientIp", json_log["clientIp"])
      event.set("host", json_log["host"])
      event.set("responseCode", json_log["responseCode"])
      event.set("serverIp", json_log["serverIp"])
      event.set("serverPort", json_log["serverPort"])
      event.set("requestStatus", json_log["requestStatus"])
      event.set("url", json_log["url"])
      event.set("url-decode", Base64.decode64(json_log["url"]))
      event.set("geoCode", json_log["geolocationCountryCode"])
      event.set("enforcementState", json_log["enforcementState"])
      event.set("requestDatetime", json_log["requestDatetime"])
      event.set("rawRequest", json_log["rawRequest"])
      event.set("request-decode", Base64.decode64(json_log["rawRequest"]["httpRequest"]))
      event.set("requestPolicy", json_log["requestPolicy"])
      event.set("enforcementState", json_log["enforcementState"])
      event.set("virtualServerName_full", json_log["virtualServerName"])
      vsName = json_log["virtualServerName"].match(/^\d+-(.*?):/)
      event.set("virtualServerName", vsName[1])

      event.set("geoip", geo["location"])
      event.set("country_name", geo["country_name"])
      event.set("country", geo["country_code2"])
    '
  }

  if "_geoip_lookup_failure" in [tags] {
    mutate {
      add_field => {
          "country_name" => "UnkownIP"
          "country" => "N/A"
      }
      remove_field => ["json_log", "temp_ip"]
    }
  }
  else {
    mutate {
      remove_field => ["json_log", "src_geoip", "temp_ip"]
    }
  }

  if [violations] {
    clone {  
        clones => ["decoded"]
    }
    if "decoded" in [tags]  
    {
      split {
        field => ["[violations]"]
      }
    }  
  }
    
  
  if "decoded" in [tags] {
    if [violations][violation][name] in ["VIOL_ATTACK_SIGNATURE", "VIOL_PARAMETER_VALUE_METACHAR", "VIOL_URL_METACHAR", "VIOL_PARAMETER_NAME_METACHAR", "VIOL_URL_LENGTH", "VIOL_PARAMETER", "VIOL_FILETYPE", "VIOL_POST_DATA_LENGTH", "VIOL_QUERY_STRING_LENGTH", "VIOL_REQUEST_LENGTH", "VIOL_COOKIE_LENGTH", "VIOL_HEADER_LENGTH", "VIOL_PARAMETER_EMPTY_VALUE", "VIOL_PARAMETER_DATA_TYPE", "VIOL_PARAMETER_NUMERIC_VALUE", "VIOL_PARAMETER_VALUE_LENGTH", "VIOL_PARAMETER_ARRAY_VALUE", "VIOL_PARAMETER_LOCATION", "VIOL_PARAMETER_STATIC_VALUE", "VIOL_EVASION", "VIOL_HTTP_PROTOCOL"] {
      mutate {
        remove_field => [
          "rawRequest", "[enforcementState][attackType]","clientPort", "request-decode", "bot_anomalies","bot_category","bot_signature_name", "client_application", "campaign_names", "enforced_bot_anomalies", "country"
        ]
      }

      ruby {
        code => '
            require "base64";
            violations=event.get("violations")

            case violations["violation"]["name"]
            
            when "VIOL_COOKIE_LENGTH", "VIOL_HEADER_LENGTH", "VIOL_URL_METACHAR"
              event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
            
            when "VIOL_ATTACK_SIGNATURE"

              #Based on observedEntity we will determined if it is cookie/header/url/parameter/etc
              if violations.has_key?("observedEntity")

                  #If attack signature is found on cookies
                  if violations["policyEntity"].has_key?("cookies")
                    event.set("[violations][context]", "cookies") #Create context that is missing
                    event.set("[violations][observedEntity][value-decode]", Base64.decode64(violations["observedEntity"]["value"]))
                    event.set("[violations][snippet][buffer-decode]", Base64.decode64(violations["snippet"]["buffer"])) if violations.has_key?("snippet")
                    
                    # If cookie is explicit then the NAP does NOT provide the "observedEntity". This creates a problem with reporting later on, so we added the record "name"
                    if violations["policyEntity"]["cookies"][0]["type"]=="wildcard"
                      event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
                    else
                      event.set("[violations][observedEntity][name-decode]", violations["policyEntity"]["cookies"][0]["name"])
                    end
                  end

                  if violations["policyEntity"].has_key?("headers")
                    event.set("[violations][context]", "headers") #Create context that is missing
                    event.set("[violations][observedEntity][value-decode]", Base64.decode64(violations["observedEntity"]["value"]))
                    event.set("[violations][snippet][buffer-decode]", Base64.decode64(violations["snippet"]["buffer"])) if violations.has_key?("snippet")

                    # If header is explicit then the NAP does NOT provide the "observedEntity". This creates a problem with reporting later on, so we added the record "name"
                    if violations["policyEntity"]["headers"][0]["type"]=="wildcard"
                      event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
                    else
                      event.set("[violations][observedEntity][name-decode]", violations["policyEntity"]["headers"][0]["name"])
                    end
                  end

                  if violations["policyEntity"].has_key?("parameters")
                    event.set("[violations][context]", "parameters") #Create context that is missing
                    event.set("[violations][observedEntity][value-decode]", Base64.decode64(violations["observedEntity"]["value"]))
                    event.set("[violations][snippet][buffer-decode]", Base64.decode64(violations["snippet"]["buffer"])) if violations.has_key?("snippet")

                    # If parameter is explicit then the NAP does NOT provide the "observedEntity". This creates a problem with reporting later on, so we added the record "name"
                    if violations["policyEntity"]["parameters"][0]["type"]=="wildcard"
                      event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
                    else
                      event.set("[violations][observedEntity][name-decode]", violations["policyEntity"]["parameters"][0]["name"])
                    end

                  end

                  if violations["policyEntity"].has_key?("urls")
                    event.set("[violations][context]", "urls") #Create context that is missing
                    event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
                    event.set("[violations][snippet][buffer-decode]", Base64.decode64(violations["snippet"]["buffer"])) if violations.has_key?("snippet")
                  end
              else
                event.set("[violations][context]", "request") #Create context that is missing
                event.set("[violations][snippet][buffer-decode]", Base64.decode64(violations["snippet"]["buffer"])) if violations.has_key?("snippet")
              end

            when "VIOL_PARAMETER_VALUE_METACHAR"
              # There is a problem with sensitive parameters and NAP doesnt log the name or value of the parameter. It has been raised as a bug.
              # As soon as the bug is addressed the if statement will be removed
              if violations.has_key?("observedEntity") && violations.has_key?("policyEntity")
                event.set("[violations][observedEntity][value-decode]", Base64.decode64(violations["observedEntity"]["value"]))
                # If parameter is explicit then the NAP does NOT provide the "observedEntity". This creates a problem with reporting later on, so we added the record "name"
                if violations["policyEntity"]["parameters"][0]["type"]=="wildcard"
                    event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
                else
                    event.set("[violations][observedEntity][name-decode]", violations["policyEntity"]["parameters"][0]["name"])
                end
              end

            when "VIOL_PARAMETER_NAME_METACHAR", "VIOL_PARAMETER_DATA_TYPE", "VIOL_PARAMETER_NUMERIC_VALUE", "VIOL_PARAMETER_VALUE_LENGTH", "VIOL_PARAMETER_ARRAY_VALUE", "VIOL_PARAMETER_LOCATION", "VIOL_PARAMETER_STATIC_VALUE"
              event.set("[violations][observedEntity][value-decode]", Base64.decode64(violations["observedEntity"]["value"]))
              # If parameter is explicit then the NAP does NOT provide the "observedEntity". This creates a problem with reporting later on, so we added the record "name"
              if violations["policyEntity"]["parameters"][0]["type"]=="wildcard"
                  event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
              else
                  event.set("[violations][observedEntity][name-decode]", violations["policyEntity"]["parameters"][0]["name"])
              end

            when "VIOL_PARAMETER_EMPTY_VALUE", "VIOL_PARAMETER"
              # If filetype is explicit then the NAP does NOT provide the "observedEntity". This creates a problem with reporting later on, so we added the record "name"
              if violations["policyEntity"]["parameters"][0]["type"]=="wildcard"
                  event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
              else
                  event.set("[violations][observedEntity][name-decode]", violations["policyEntity"]["parameters"][0]["name"])
              end

            when "VIOL_URL_LENGTH", "VIOL_POST_DATA_LENGTH", "VIOL_QUERY_STRING_LENGTH", "VIOL_REQUEST_LENGTH"
              # If filetype is explicit then the NAP does NOT provide the "observedEntity". This creates a problem with reporting later on, so we added the record "name"
              if violations["policyEntity"]["filetypes"][0]["type"]=="wildcard"
                  event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
              else
                  event.set("[violations][observedEntity][name-decode]", violations["policyEntity"]["filetypes"][0]["name"])
              end

            when "VIOL_EVASION"
              # if the observed entity is parameter then base64-decode the parameter
              if violations["observedEntity"]["scope"]=="parameter"
                event.set("[violations][observedEntity][name-decode]", Base64.decode64(violations["observedEntity"]["name"]))
                event.set("[violations][observedEntity][value-decode]", Base64.decode64(violations["observedEntity"]["value"]))

                event.set("[violations][snippet][buffer-decode]", Base64.decode64(violations["snippet"]["buffer"])) if violations.has_key?("snippet")

              end
            
            end


        '
      }
    }
    else{
      drop { } 
    }
  }



}

output {

  if "decoded" in [tags] 
  {
    elasticsearch {
      hosts => ["elasticsearch:9200"]
      index => "nginx-nap-decoded-%{+YYY.MM.dd}"
    }
  }
  else{
    elasticsearch {
      hosts => ["elasticsearch:9200"]
      index => "nginx-nap-logs-%{+YYY.MM.dd}"
    }
  }  
}