---
description: Pipeline for parsing sophos firewall logs (firewall pipeline)
processors:
#######################
## ECS Event Mapping ##
#######################
- set:
    field: event.kind
    value: event
- set:
    field: event.action
    value: "{{sophos.xg.log_subtype}}"
    if: "ctx.sophos?.xg?.log_subtype != null"
- set:
    field: event.outcome
    value: success
    if: "ctx.sophos?.xg?.log_subtype != null"
- set:
    field: event.kind
    value: alert
    if: '["03001", "05001", "05151", "00003", "00004"].contains(ctx.event?.code)'
- append:
    field: event.category
    value: intrusion_detection
    if: '["03001", "05001", "05151", "00003", "00004"].contains(ctx.event?.code)'
- append:
    field: event.category
    value: network
- append:
    field: event.type
    value:
      - start
      - allowed
      - connection
    if: "['Start', 'Interim'].contains(ctx.sophos?.xg?.connevent)"
- append:
    field: event.type
    value:
      - end
      - allowed
      - connection
    if: "ctx.sophos?.xg?.connevent == 'Stop'"
- append:
    field: event.type
    value:
      - denied
      - connection
    if: "ctx.sophos?.xg?.status == 'Deny'"

####################################
## ECS Server/Destination Mapping ##
####################################
- rename:
    field: sophos.xg.dst_ip
    target_field: destination.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.dst_ip != null"
- rename:
    field: sophos.xg.tran_dst_ip
    target_field: destination.nat.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.tran_dst_ip != null"
- rename:
    field: sophos.xg.destinationip
    target_field: destination.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.destinationip !=null"
- convert:
    field: sophos.xg.dst_port
    target_field: destination.port
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.dst_port != null"
- convert:
    field: sophos.xg.tran_dst_port
    target_field: destination.nat.port
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.tran_dst_port != null"
- convert:
    field: sophos.xg.recv_pkts
    target_field: destination.packets
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.recv_pkts !=null"
- convert:
    field: sophos.xg.packets_received
    target_field: destination.packets
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.packets_received !=null"

###############################
## ECS Client/Source Mapping ##
###############################
- rename:
    field: sophos.xg.src_ip
    target_field: source.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_ip != null"
- rename:
    field: sophos.xg.tran_src_ip
    target_field: source.nat.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.tran_src_ip != null"
- rename:
    field: sophos.xg.src_trans_ip
    target_field: source.nat.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_trans_ip != null"
- rename:
    field: sophos.xg.sourceip
    target_field: source.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.sourceip != null"
- convert:
    field: sophos.xg.src_port
    target_field: source.port
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_port != null"
- convert:
    field: sophos.xg.tran_src_port
    target_field: source.nat.port
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.tran_src_port != null"
- rename:
    field: sophos.xg.src_mac
    target_field: source.mac
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_mac != null"
- trim:
    field: sophos.xg.sent_pkts
    ignore_missing: true
- trim:
    field: sophos.xg.packets_sent
    ignore_missing: true
- convert:
    field: sophos.xg.sent_pkts
    target_field: source.packets
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.sent_pkts != null"
- convert:
    field: sophos.xg.packets_sent
    target_field: source.packets
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.packets_sent != null"
- rename:
    field: sophos.xg.user_name
    target_field: source.user.name
    ignore_missing: true
    if: "ctx.sophos?.xg?.user_name != null"
- rename:
    field: sophos.xg.user_gp
    target_field: source.user.group.name
    ignore_missing: true
    if: "ctx.sophos?.xg?.user_gp != null"

######################
## ECS Rule Mapping ##
######################
- rename:
    field: sophos.xg.fw_rule_id
    target_field: rule.id
    ignore_missing: true
    if: "ctx.rule?.id == null"
- rename:
    field: sophos.xg.policy_type
    target_field: rule.ruleset
    ignore_missing: true
    if: "ctx.sophos?.xg?.policy_type != null"

######################
## ECS Network Mapping
######################
- rename:
    field: sophos.xg.application
    target_field: network.protocol
    ignore_missing: true
- rename:
    field: sophos.xg.protocol
    target_field: network.transport
    ignore_missing: true
- set:
    field: network.direction
    value: inbound
    if: "['LAN', 'DMZ', 'VPN', 'WiFi'].contains(ctx.observer?.egress?.zone) && ctx.observer?.ingress?.zone == 'WAN'"
- set:
    field: network.direction
    value: outbound
    if: "['LAN', 'DMZ', 'VPN', 'WiFi'].contains(ctx.observer?.ingress?.zone) && ctx.observer?.egress?.zone == 'WAN'"
- set:
    field: network.direction
    value: internal
    if: "['LAN', 'DMZ', 'VPN', 'WiFi'].contains(ctx.observer?.ingress?.zone) && ['LAN', 'DMZ', 'VPN', 'WiFi'].contains(ctx.observer?.egress?.zone)"
- set:
    field: network.direction
    value: external
    if: "ctx.observer?.ingress?.zone == 'WAN' && ctx.observer?.egress?.zone == 'WAN'"

#############
## Cleanup ##
#############
- lowercase:
      field: event.action
      ignore_failure: true
- remove:
    field:
    - sophos.xg.dst_port
    - sophos.xg.tran_dst_port
    - sophos.xg.recv_pkts
    - sophos.xg.src_port
    - sophos.xg.tran_src_port
    - sophos.xg.sent_pkts
    - sophos.xg.packets_received
    - sophos.xg.packets_sent
    ignore_missing: true
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'
