tacacs-beats-content_pack.json

{"name":"tacacs-beats-input","description":"Tacacs+ Beats input with extractors","category":"tacacs","inputs":[{"id":"5b502d2545caeb36623cf6b5","title":"tacacs.beats.input","configuration":{"recv_buffer_size":1048576,"port":8375,"tls_key_file":"","tls_enable":false,"tls_key_password":"","tcp_keepalive":false,"tls_client_auth_cert_file":"","tls_client_auth":"disabled","override_source":null,"bind_address":"0.0.0.0","tls_cert_file":""},"static_fields":{},"type":"org.graylog.plugins.beats.BeatsInput","global":true,"extractors":[{"title":"tacacs_log","type":"GROK","cursor_strategy":"COPY","target_field":"","source_field":"message","configuration":{"grok_pattern":"%{SYSLOGTIMESTAMP:timestamp}%{GREEDYDATA:tacacs_log}"},"converters":[],"condition_type":"STRING","condition_value":"tty","order":0},{"title":"src-username-line-dst","type":"GROK","cursor_strategy":"COPY","target_field":"","source_field":"tacacs_log","configuration":{"grok_pattern":"%{IPV4:dst_ip}\t%{USERNAME:username}\t%{HOSTNAME:line}\t%{IPV4:src_ip}\t%{GREEDYDATA:tac_log}"},"converters":[],"condition_type":"NONE","condition_value":"","order":0},{"title":"cmd","type":"REGEX","cursor_strategy":"COPY","target_field":"cmd","source_field":"tac_log","configuration":{"regex_value":"((?<=cmd\\=).+?(?=\\s<cr>))"},"converters":[],"condition_type":"STRING","condition_value":"cmd","order":0}]}],"streams":[],"outputs":[],"dashboards":[],"grok_patterns":[],"lookup_tables":[],"lookup_caches":[],"lookup_data_adapters":[]}