---
description: Pipeline for parsing sophos firewall logs (sandbox pipeline)
processors:
#######################
## ECS Event Mapping ##
#######################
- set:
    field: event.kind
    value: event
- set:
    field: event.action
    value: "{{sophos.xg.log_subtype}}"
    if: "ctx.sophos?.xg?.log_subtype != null"
- set:
    field: event.outcome
    value: success
    if: "ctx.sophos?.xg?.log_subtype != null"
- set:
    field: event.kind
    value: alert
    if: 'ctx.sophos?.xg?.log_subtype == "Denied"'
- append:
    field: event.category
    value:
      - malware
      - network
    if: 'ctx.sophos?.xg?.log_subtype == "Denied"'
- append:
    field: event.category
    value: network
    if: "ctx.sophos?.xg?.log_subtype != 'Denied'"
- append:
    field: event.type
    value: allowed
    if: "['Allowed'].contains(ctx.sophos?.xg?.log_subtype)"
- append:
    field: event.type
    value:
      - start
      - connection
    if: "['pending'].contains(ctx.sophos?.xg?.reason)"
- append:
    field: event.type
    value:
      - end
      - connection
    if: "ctx.sophos?.xg?.reason == 'eligible'"
- append:
    field: event.type
    value:
      - denied
      - connection
    if: "ctx.sophos?.xg?.log_subtype == 'Denied'"

- rename:
    if: ctx.sophos?.xg?.log_component == "Web"
    field: sophos.xg.source
    target_field: url.domain
    ignore_missing: true

########################
## ECS Source Mapping ##
########################
- rename:
    field: sophos.xg.src_ip
    target_field: source.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_ip != null"
- rename:
    field: sophos.xg.user_name
    target_field: source.user.name
    ignore_missing: true
    if: "ctx.sophos?.xg?.user_name != null"

#############################
## ECS Destination Mapping ##
#############################
- convert:
    field: url.domain
    target_field: destination.ip
    type: ip
    ignore_missing: true
    on_failure:
      - set:
          field: destination.domain
          copy_from: url.domain
          ignore_empty_value: true

######################
## ECS File Mapping ##
######################
- rename:
    field: sophos.xg.filename
    target_field: file.name
    ignore_missing: true
    if: ctx.sophos?.xg?.filename != null
- convert:
    field: sophos.xg.filesize
    target_field: file.size
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.filesize != null"
- rename:
    field: sophos.xg.filetype
    target_field: file.mime_type
    ignore_missing: true
    if: "ctx.sophos?.xg?.filetype != null"

# In 18.0 and later the sha1sum contains the sha256 checksum of the file.
- rename:
    field: sophos.xg.sha1sum
    target_field: file.hash.sha1
    ignore_missing: true
    if: "ctx.sophos?.xg?.sha1sum != null && ctx.sophos.xg.sha1sum.length() == 40"
- rename:
    field: sophos.xg.sha1sum
    target_field: file.hash.sha256
    ignore_missing: true
    if: "ctx.sophos?.xg?.sha1sum != null && ctx.sophos.xg.sha1sum.length() == 64"

#############
## Cleanup ##
#############
- remove:
    field:
      - sophos.xg.filesize
      - sophos.xg.sha1sum
    ignore_missing: true
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'
