cato-networks.yaml

# bypass-global-no-service-config-checks
id: cato-networks
metric_id: cato-networks
backend_only: false
facets:
  - groups:
      - DNS
    name: Question Name
    path: dns.question.name
    source: log
  - groups:
      - Event
    name: Event Name
    path: evt.name
    source: log
  - groups:
      - Geoip
    name: City Name
    path: network.client.geoip.city.name
    source: log
  - groups:
      - Geoip
    name: Continent Code
    path: network.client.geoip.continent.code
    source: log
  - groups:
      - Geoip
    name: Continent Name
    path: network.client.geoip.continent.name
    source: log
  - groups:
      - Geoip
    name: Country ISO Code
    path: network.client.geoip.country.iso_code
    source: log
  - groups:
      - Geoip
    name: Country Name
    path: network.client.geoip.country.name
    source: log
  - groups:
      - Geoip
    name: Subdivision ISO Code
    path: network.client.geoip.subdivision.iso_code
    source: log
  - groups:
      - Geoip
    name: Subdivision Name
    path: network.client.geoip.subdivision.name
    source: log
  - groups:
      - Web Access
    name: Client IP
    path: network.client.ip
    source: log
  - groups:
      - Web Access
    name: Client Port
    path: network.client.port
    source: log
  - groups:
      - Geoip
    name: Destination City Name
    path: network.destination.geoip.city.name
    source: log
  - groups:
      - Geoip
    name: Destination Continent Code
    path: network.destination.geoip.continent.code
    source: log
  - groups:
      - Geoip
    name: Destination Continent Name
    path: network.destination.geoip.continent.name
    source: log
  - groups:
      - Geoip
    name: Destination Country ISO Code
    path: network.destination.geoip.country.iso_code
    source: log
  - groups:
      - Geoip
    name: Destination Country Name
    path: network.destination.geoip.country.name
    source: log
  - groups:
      - Geoip
    name: Destination Subdivision ISO Code
    path: network.destination.geoip.subdivision.iso_code
    source: log
  - groups:
      - Geoip
    name: Destination Subdivision Name
    path: network.destination.geoip.subdivision.name
    source: log
  - groups:
      - Web Access
    name: Destination IP
    path: network.destination.ip
    source: log
  - groups:
      - Web Access
    name: Destination Port
    path: network.destination.port
    source: log
  - groups:
      - User
    name: User Email
    path: usr.email
    source: log
  - groups:
      - User
    name: User ID
    path: usr.id
    source: log
  - groups:
      - User
    name: User Name
    path: usr.name
    source: log
pipeline:
  type: pipeline
  name: Cato Networks
  enabled: true
  filter:
    query: source:cato-networks
  processors:
    - type: pipeline
      name: Parsing events
      enabled: true
      filter:
        query: -service:audit-logs
      processors:
        - type: string-builder-processor
          name: Set `service` to events
          enabled: true
          template: events
          target: service
          replaceMissing: true
    - type: service-remapper
      name: Define `service` as the official service of the log
      enabled: true
      sources:
        - service
    - type: date-remapper
      name: Define `fieldsMap.insertion_date`, `time` as the official date of the log
      enabled: true
      sources:
        - fieldsMap.insertion_date
        - time
    - type: pipeline
      name: Audit Logs
      enabled: true
      filter:
        query: service:audit-logs
      processors:
        - type: attribute-remapper
          name: Map `fieldsMap.admin_id` to `usr.id`
          enabled: true
          sources:
            - fieldsMap.admin_id
          sourceType: attribute
          target: usr.id
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `fieldsMap.admin` to `usr.name`
          enabled: true
          sources:
            - fieldsMap.admin
          sourceType: attribute
          target: usr.name
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
    - type: pipeline
      name: Events
      enabled: true
      filter:
        query: service:events
      processors:
        - type: attribute-remapper
          name: Map `event_type` to `evt.name`
          enabled: true
          sources:
            - event_type
          sourceType: attribute
          target: evt.name
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `src_ip` to `network.client.ip`
          enabled: true
          sources:
            - src_ip
          sourceType: attribute
          target: network.client.ip
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `src_port` to `network.client.port`
          enabled: true
          sources:
            - src_port
          sourceType: attribute
          target: network.client.port
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `dest_ip` to `network.destination.ip`
          enabled: true
          sources:
            - dest_ip
          sourceType: attribute
          target: network.destination.ip
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `dest_port` to `network.destination.port`
          enabled: true
          sources:
            - dest_port
          sourceType: attribute
          target: network.destination.port
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `user_id` to `usr.id`
          enabled: true
          sources:
            - user_id
          sourceType: attribute
          target: usr.id
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `user_name` to `usr.name`
          enabled: true
          sources:
            - user_name
          sourceType: attribute
          target: usr.name
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `vpn_user_email` to `usr.email`
          enabled: true
          sources:
            - vpn_user_email
          sourceType: attribute
          target: usr.email
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `domain_name` to `dns.question.name`
          enabled: true
          sources:
            - domain_name
          sourceType: attribute
          target: dns.question.name
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: geo-ip-parser
          name: GeoIP Parser for `network.client.ip`
          enabled: true
          sources:
            - network.client.ip
          target: network.client.geoip
          ip_processing_behavior: do-nothing
        - type: geo-ip-parser
          name: GeoIP Parser for `network.destination.ip`
          enabled: true
          sources:
            - network.destination.ip
          target: network.destination.geoip
          ip_processing_behavior: do-nothing
        - type: string-builder-processor
          name: Set `event_status` to info
          enabled: true
          template: info
          target: event_status
          replaceMissing: true
        - type: status-remapper
          name: Define `event_status` as the official status of the log
          enabled: true
          sources:
            - event_status