forked from SEKOIA-IO/intake-formats
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request SEKOIA-IO#1136 from SEKOIA-IO/feat/improve_postfix…
…_parser Improve Postfix parser
- Loading branch information
Showing
137 changed files
with
5,763 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| { | ||
| "input": { | ||
| "message": "statistics: max connection count 10 for (smtp:1.2.3.4) at Sep 11 10:47:30" | ||
| }, | ||
| "expected": { | ||
| "message": "statistics: max connection count 10 for (smtp:1.2.3.4) at Sep 11 10:47:30", | ||
| "event": { | ||
| "category": [ | ||
| "email" | ||
| ], | ||
| "type": [ | ||
| "info" | ||
| ] | ||
| }, | ||
| "network": { | ||
| "protocol": "smtp" | ||
| }, | ||
| "related": { | ||
| "ip": [ | ||
| "1.2.3.4" | ||
| ] | ||
| }, | ||
| "source": { | ||
| "address": "1.2.3.4", | ||
| "ip": "1.2.3.4" | ||
| } | ||
| } | ||
| } |
43 changes: 43 additions & 0 deletions
43
Postfix/postfix/tests/wo_appname_appname_postfix_error.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| { | ||
| "input": { | ||
| "message": "2298F5F619: to=<[email protected]>, relay=none, delay=89758, delays=89758/0.02/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to mail.corp.com[1.1.1.1]:25: Connection timed out) 215" | ||
| }, | ||
| "expected": { | ||
| "message": "2298F5F619: to=<[email protected]>, relay=none, delay=89758, delays=89758/0.02/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to mail.corp.com[1.1.1.1]:25: Connection timed out) 215", | ||
| "event": { | ||
| "category": [ | ||
| "email" | ||
| ], | ||
| "outcome": "success", | ||
| "type": [ | ||
| "info" | ||
| ] | ||
| }, | ||
| "action": { | ||
| "name": "deferred", | ||
| "outcome": "success", | ||
| "target": "network-traffic" | ||
| }, | ||
| "destination": { | ||
| "address": "corp.com", | ||
| "domain": "corp.com", | ||
| "registered_domain": "corp.com", | ||
| "top_level_domain": "com" | ||
| }, | ||
| "email": { | ||
| "to": { | ||
| "address": [ | ||
| "[email protected]" | ||
| ] | ||
| } | ||
| }, | ||
| "network": { | ||
| "protocol": "smtp" | ||
| }, | ||
| "related": { | ||
| "hosts": [ | ||
| "corp.com" | ||
| ] | ||
| } | ||
| } | ||
| } |
44 changes: 44 additions & 0 deletions
44
Postfix/postfix/tests/wo_appname_appname_postfix_local.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| { | ||
| "input": { | ||
| "message": "11FDF5F62A: to=<[email protected]>, relay=local, delay=80181, delays=80181/0.02/0/0, dsn=4.0.0, status=deferred (user lookup error)" | ||
| }, | ||
| "expected": { | ||
| "message": "11FDF5F62A: to=<[email protected]>, relay=local, delay=80181, delays=80181/0.02/0/0, dsn=4.0.0, status=deferred (user lookup error)", | ||
| "event": { | ||
| "category": [ | ||
| "email" | ||
| ], | ||
| "outcome": "success", | ||
| "type": [ | ||
| "info" | ||
| ] | ||
| }, | ||
| "action": { | ||
| "name": "deferred", | ||
| "outcome": "success", | ||
| "target": "network-traffic" | ||
| }, | ||
| "destination": { | ||
| "address": "sub.corp.com", | ||
| "domain": "sub.corp.com", | ||
| "registered_domain": "corp.com", | ||
| "subdomain": "sub", | ||
| "top_level_domain": "com" | ||
| }, | ||
| "email": { | ||
| "to": { | ||
| "address": [ | ||
| "[email protected]" | ||
| ] | ||
| } | ||
| }, | ||
| "network": { | ||
| "protocol": "smtp" | ||
| }, | ||
| "related": { | ||
| "hosts": [ | ||
| "sub.corp.com" | ||
| ] | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| { | ||
| "input": { | ||
| "message": "3D770111AF50: to=<[email protected]>, relay=none, delay=1.2, delays=1.1/0/0.03/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=corp.com type=AAAA: Host not found)" | ||
| }, | ||
| "expected": { | ||
| "message": "3D770111AF50: to=<[email protected]>, relay=none, delay=1.2, delays=1.1/0/0.03/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=corp.com type=AAAA: Host not found)", | ||
| "event": { | ||
| "category": [ | ||
| "email" | ||
| ], | ||
| "outcome": "success", | ||
| "type": [ | ||
| "info" | ||
| ] | ||
| }, | ||
| "action": { | ||
| "name": "bounced", | ||
| "outcome": "success", | ||
| "target": "network-traffic" | ||
| }, | ||
| "destination": { | ||
| "address": "corp.com", | ||
| "domain": "corp.com", | ||
| "registered_domain": "corp.com", | ||
| "top_level_domain": "com" | ||
| }, | ||
| "email": { | ||
| "to": { | ||
| "address": [ | ||
| "[email protected]" | ||
| ] | ||
| } | ||
| }, | ||
| "network": { | ||
| "protocol": "smtp" | ||
| }, | ||
| "related": { | ||
| "hosts": [ | ||
| "corp.com" | ||
| ] | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| { | ||
| "input": { | ||
| "message": "77EFFC0015: warning: header Content-Disposition: inline; filename=\"image003.jpg\"; size=26055;??creation-date=\"Thu, 12 Sep 2019 12:39:01 GMT\";??modification-date=\"Thu, 12 Sep 2019 12:40:01 GMT\" from mail.outbound.protection.outlook.com[1.1.1.1]; from=<> to=<[email protected]> proto=ESMTP helo=<NAM03.outbound.protection.outlook.com>" | ||
| }, | ||
| "expected": { | ||
| "message": "77EFFC0015: warning: header Content-Disposition: inline; filename=\"image003.jpg\"; size=26055;??creation-date=\"Thu, 12 Sep 2019 12:39:01 GMT\";??modification-date=\"Thu, 12 Sep 2019 12:40:01 GMT\" from mail.outbound.protection.outlook.com[1.1.1.1]; from=<> to=<[email protected]> proto=ESMTP helo=<NAM03.outbound.protection.outlook.com>", | ||
| "event": { | ||
| "category": [ | ||
| "email" | ||
| ], | ||
| "type": [ | ||
| "info" | ||
| ] | ||
| }, | ||
| "destination": { | ||
| "address": "exemple.com", | ||
| "domain": "exemple.com", | ||
| "registered_domain": "exemple.com", | ||
| "top_level_domain": "com" | ||
| }, | ||
| "email": { | ||
| "to": { | ||
| "address": [ | ||
| "[email protected]" | ||
| ] | ||
| } | ||
| }, | ||
| "file": { | ||
| "created": "2019-09-12T12:39:01Z", | ||
| "ctime": "2019-09-12T12:40:01Z", | ||
| "name": "image003.jpg", | ||
| "size": 26055 | ||
| }, | ||
| "network": { | ||
| "protocol": "smtp" | ||
| }, | ||
| "related": { | ||
| "hosts": [ | ||
| "exemple.com", | ||
| "mail.outbound.protection.outlook.com" | ||
| ], | ||
| "ip": [ | ||
| "1.1.1.1" | ||
| ] | ||
| }, | ||
| "source": { | ||
| "address": "mail.outbound.protection.outlook.com", | ||
| "domain": "mail.outbound.protection.outlook.com", | ||
| "ip": "1.1.1.1", | ||
| "registered_domain": "outlook.com", | ||
| "subdomain": "mail.outbound.protection", | ||
| "top_level_domain": "com" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| { | ||
| "input": { | ||
| "message": "3D770111AF50: warning: header Subject: Manquants LASTNAME GB Nouvelle version from unknown[10.1.1.1]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<SUBDOMAIN.CORP.COM>" | ||
| }, | ||
| "expected": { | ||
| "message": "3D770111AF50: warning: header Subject: Manquants LASTNAME GB Nouvelle version from unknown[10.1.1.1]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<SUBDOMAIN.CORP.COM>", | ||
| "event": { | ||
| "category": [ | ||
| "email" | ||
| ], | ||
| "type": [ | ||
| "info" | ||
| ] | ||
| }, | ||
| "destination": { | ||
| "address": "corp.com", | ||
| "domain": "corp.com", | ||
| "registered_domain": "corp.com", | ||
| "top_level_domain": "com" | ||
| }, | ||
| "email": { | ||
| "from": { | ||
| "address": [ | ||
| "[email protected]" | ||
| ] | ||
| }, | ||
| "to": { | ||
| "address": [ | ||
| "[email protected]" | ||
| ] | ||
| } | ||
| }, | ||
| "network": { | ||
| "protocol": "smtp" | ||
| }, | ||
| "related": { | ||
| "hosts": [ | ||
| "SUBDOMAIN.CORP.COM", | ||
| "corp.com" | ||
| ], | ||
| "ip": [ | ||
| "10.1.1.1" | ||
| ] | ||
| }, | ||
| "source": { | ||
| "address": "SUBDOMAIN.CORP.COM", | ||
| "domain": "SUBDOMAIN.CORP.COM", | ||
| "ip": "10.1.1.1", | ||
| "registered_domain": "CORP.COM", | ||
| "subdomain": "SUBDOMAIN", | ||
| "top_level_domain": "COM" | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.