Add OCSF rule and template for paloalto network traffic logs (#5087)

* Add OCSF rule and template for paloalto network traffic logs Signed-off-by: Krishna Kondaka <krishkdk@dev-dsk-krishkdk-2c-bd29c437.us-west-2.amazon.com> * Addressed review comments Signed-off-by: Krishna Kondaka <krishkdk@dev-dsk-krishkdk-2c-bd29c437.us-west-2.amazon.com> --------- Signed-off-by: Krishna Kondaka <krishkdk@dev-dsk-krishkdk-2c-bd29c437.us-west-2.amazon.com> Co-authored-by: Krishna Kondaka <krishkdk@dev-dsk-krishkdk-2c-bd29c437.us-west-2.amazon.com>
opensearch-project · Oct 22, 2024 · 5bfcac8 · 5bfcac8
1 parent b2f51f5
commit 5bfcac8
Show file tree

Hide file tree

Showing 4 changed files with 687 additions and 1 deletion.
diff --git a/data-prepper-plugins/ocsf/build.gradle b/data-prepper-plugins/ocsf/build.gradle
@@ -0,0 +1,6 @@
+
+dependencies {
+    implementation project(':data-prepper-api')
+}
+
+
diff --git a/...in/resources/org/opensearch/dataprepper/transforms/rules/ocsf-v1.1-panw-traffic-rule.yaml b/...in/resources/org/opensearch/dataprepper/transforms/rules/ocsf-v1.1-panw-traffic-rule.yaml
@@ -0,0 +1,6 @@
+plugin_name: "ocsf-v1.1-panw-traffic"
+apply_when:
+  - "$..processor[?(@.ocsf.type == 'palo_alto_networks_traffic_logs')]"
+  - "$..processor[?(@.ocsf.version == '1.1')]"
+
+