cisco-umbrella-dns.yaml

# bypass-global-no-service-config-checks
id: cisco-umbrella-dns
metric_id: cisco-umbrella-dns
backend_only: false
facets:
  - groups:
      - DNS
    name: Answer Type
    path: dns.answer.type
    source: log
  - groups:
      - DNS
    name: Response Code
    path: dns.flags.rcode
    source: log
  - groups:
      - DNS
    name: Question Name
    path: dns.question.name
    source: log
  - groups:
      - Web Access
    name: Method
    path: http.method
    source: log
  - groups:
      - Web Access
    name: Referer
    path: http.referer
    source: log
  - groups:
      - Web Access
    name: Status Code
    path: http.status_code
    source: log
  - groups:
      - Web Access
    name: URL Path
    path: http.url
    source: log
  - groups:
      - Web Access
    name: URL Host
    path: http.url_details.host
    source: log
  - groups:
      - Web Access
    name: URL Path
    path: http.url_details.path
    source: log
  - groups:
      - Web Access
    name: URL Port
    path: http.url_details.port
    source: log
  - groups:
      - Web Access
    name: URL scheme
    path: http.url_details.scheme
    source: log
  - groups:
      - Web Access
    name: User-Agent
    path: http.useragent
    source: log
  - groups:
      - Web Access
    name: Browser
    path: http.useragent_details.browser.family
    source: log
  - groups:
      - Web Access
    name: Device
    path: http.useragent_details.device.family
    source: log
  - groups:
      - Web Access
    name: OS
    path: http.useragent_details.os.family
    source: log
  - groups:
      - Geoip
    name: City Name
    path: network.client.geoip.city.name
    source: log
  - groups:
      - Geoip
    name: Continent Code
    path: network.client.geoip.continent.code
    source: log
  - groups:
      - Geoip
    name: Continent Name
    path: network.client.geoip.continent.name
    source: log
  - groups:
      - Geoip
    name: Country ISO Code
    path: network.client.geoip.country.iso_code
    source: log
  - groups:
      - Geoip
    name: Country Name
    path: network.client.geoip.country.name
    source: log
  - groups:
      - Geoip
    name: Subdivision ISO Code
    path: network.client.geoip.subdivision.iso_code
    source: log
  - groups:
      - Geoip
    name: Subdivision Name
    path: network.client.geoip.subdivision.name
    source: log
  - groups:
      - Web Access
    name: Client IP
    path: network.client.ip
    source: log
  - groups:
      - Geoip
    name: Destination City Name
    path: network.destination.geoip.city.name
    source: log
  - groups:
      - Geoip
    name: Destination Continent Code
    path: network.destination.geoip.continent.code
    source: log
  - groups:
      - Geoip
    name: Destination Continent Name
    path: network.destination.geoip.continent.name
    source: log
  - groups:
      - Geoip
    name: Destination Country ISO Code
    path: network.destination.geoip.country.iso_code
    source: log
  - groups:
      - Geoip
    name: Destination Country Name
    path: network.destination.geoip.country.name
    source: log
  - groups:
      - Geoip
    name: Destination Subdivision ISO Code
    path: network.destination.geoip.subdivision.iso_code
    source: log
  - groups:
      - Geoip
    name: Destination Subdivision Name
    path: network.destination.geoip.subdivision.name
    source: log
  - groups:
      - Web Access
    name: Destination IP
    path: network.destination.ip
    source: log
  - facetType: list
    groups:
      - Cisco Umbrella DNS
    name: Client Country Code
    path: cisco.umbrella.dns.external.geoip.country.iso_code
    source: log
    type: string
  - facetType: range
    groups:
      - Cisco Umbrella DNS
    name: Request Size
    path: cisco.umbrella.dns.requestsize
    source: log
    type: integer
    unit:
      family: bytes
      name: byte
  - facetType: range
    groups:
      - Cisco Umbrella DNS
    name: Response Size
    path: cisco.umbrella.dns.responsesize
    source: log
    type: integer
    unit:
      family: bytes
      name: byte
  - groups:
      - OCSF
    name: Activity ID
    path: ocsf.activity_id
    source: log
    type: integer
  - groups:
      - OCSF
    name: Category ID
    path: ocsf.category_uid
    source: log
    type: integer
  - groups:
      - OCSF
    name: Category
    path: ocsf.category_name
    source: log
  - groups:
      - OCSF
    name: Class ID
    path: ocsf.class_uid
    source: log
    type: integer
  - groups:
      - OCSF
    name: Class
    path: ocsf.class_name
    source: log
  - groups:
      - OCSF
    name: Source IP Address
    path: ocsf.src_endpoint.ip
    source: log
  - groups:
      - OCSF
    name: Event Code
    path: ocsf.metadata.event_code
    source: log
  - groups:
      - OCSF
    name: Status
    path: ocsf.status
    source: log
  - groups:
      - OCSF
    name: Status ID
    path: ocsf.status_id
    source: log
    type: integer
  - groups:
      - OCSF
    name: Request URL String
    path: ocsf.http_request.url.url_string
    source: log
pipeline:
  type: pipeline
  name: Cisco Umbrella DNS
  enabled: true
  filter:
    query: "source:cisco-umbrella-dns"
  processors:
    - type: date-remapper
      name: Define `timestamp` as the official date of the log
      enabled: true
      sources:
        - timestamp
    - type: service-remapper
      name: Define `type` as the official service of the log
      enabled: true
      sources:
        - type
    - type: pipeline
      name: Cisco Umbrella DNS logs
      enabled: true
      filter:
        query: "service:dns"
      processors:
        - type: attribute-remapper
          name: Map `querytype` to `dns.answer.type`
          enabled: true
          sources:
            - querytype
          sourceType: attribute
          target: dns.answer.type
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `returncode` to `dns.flags.rcode`
          enabled: true
          sources:
            - returncode
          sourceType: attribute
          target: dns.flags.rcode
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `domain` to `dns.question.name`
          enabled: true
          sources:
            - domain
          sourceType: attribute
          target: dns.question.name
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: geo-ip-parser
          name: GeoIP Parser for External IP
          enabled: true
          sources:
            - externalip
          target: external.geoip
          ip_processing_behavior: do-nothing
        - name: Lookup on `dns.flags.rcode` (returncode) to `returnmessage` field
          enabled: true
          source: dns.flags.rcode
          target: returnmessage
          lookupTable: |-
            0, NOERROR
            1, FORMERR
            2, SERVFAIL
            3, NXDOMAIN
            4, NOTIMP
            5, REFUSED
            6, YXDOMAIN
            7, XRRSET
            8, NOTAUTH
            9, NOTZONE
          type: lookup-processor
        - type: attribute-remapper
          name: Map `external.geoip.country.iso_code` to
            `cisco.umbrella.dns.external.geoip.country.iso_code`
          enabled: true
          sources:
            - external.geoip.country.iso_code
          sourceType: attribute
          target: cisco.umbrella.dns.external.geoip.country.iso_code
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
    - type: pipeline
      name: Cisco Umbrella Proxy logs
      enabled: true
      filter:
        query: "service:proxy"
      processors:
        - type: attribute-remapper
          name: Map `externalip` to `network.client.ip`
          enabled: true
          sources:
            - externalip
          sourceType: attribute
          target: network.client.ip
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `destinationip` to `network.destination.ip`
          enabled: true
          sources:
            - destinationip
          sourceType: attribute
          target: network.destination.ip
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `url` to `http.url`
          enabled: true
          sources:
            - url
          sourceType: attribute
          target: http.url
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `statuscode` to `http.status_code`
          enabled: true
          sources:
            - statuscode
          sourceType: attribute
          target: http.status_code
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `referer` to `http.referer`
          enabled: true
          sources:
            - referer
          sourceType: attribute
          target: http.referer
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `useragent` to `http.useragent`
          enabled: true
          sources:
            - useragent
          sourceType: attribute
          target: http.useragent
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `requestmethod` to `http.method`
          enabled: true
          sources:
            - requestmethod
          sourceType: attribute
          target: http.method
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `requestsize` to `network.bytes_read`
          enabled: true
          sources:
            - requestsize
          sourceType: attribute
          target: network.bytes_read
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `responsesize` to `network.bytes_written`
          enabled: true
          sources:
            - responsesize
          sourceType: attribute
          target: network.bytes_written
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: user-agent-parser
          name: Extract details from `http.useragent`
          enabled: true
          sources:
            - http.useragent
          target: http.useragent_details
          encoded: false
          combineVersionDetails: false
        - type: url-parser
          name: Extract details from `http.url`
          enabled: true
          sources:
            - http.url
          target: http.url_details
          normalizeEndingSlashes: false
        - type: geo-ip-parser
          name: GeoIP Parser for `network.client.ip`  (externalip)
          enabled: true
          sources:
            - network.client.ip
          target: network.client.geoip
          ip_processing_behavior: do-nothing
        - type: geo-ip-parser
          name: GeoIP Parser for `network.destination.ip` (destinationip)
          enabled: true
          sources:
            - network.destination.ip
          target: network.destination.geoip
          ip_processing_behavior: do-nothing
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `requestsize` to `cisco.umbrella.dns.requestsize`
          enabled: true
          sources:
            - requestsize
          sourceType: attribute
          target: cisco.umbrella.dns.requestsize
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `responsesize` to `cisco.umbrella.dns.responsesize`
          enabled: true
          sources:
            - responsesize
          sourceType: attribute
          target: cisco.umbrella.dns.responsesize
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
    - type: pipeline
      name: OCSF pre transformations
      enabled: true
      ocsf:
        isOcsf: true
      filter:
        query: "*"
      processors:
        - type: string-builder-processor
          name: Add ocsf.metadata.product.name
          enabled: true
          template: Cisco Umbrella
          target: ocsf.metadata.product.name
          replaceMissing: true
        - type: string-builder-processor
          name: Add ocsf.metadata.product.vendor_name
          enabled: true
          template: Cisco
          target: ocsf.metadata.product.vendor_name
          replaceMissing: true
    - type: pipeline
      name: OCSF sub pipeline for HTTP Activity [4002]
      enabled: true
      ocsf:
        isOcsf: true
      filter:
        query: service:proxy
      processors:
        - type: schema-processor
          name: Apply OCSF schema for 4002
          enabled: true
          schema:
            schemaType: ocsf
            version: 1.5.0
            className: HTTP Activity
            classUid: 4002
            extensions: []
            profiles:
              - network_proxy
              - security_control
          mappers:
            - name: ocsf.activity_id
              categories:
                - filter:
                    query: '@requestmethod:"CONNECT"'
                  name: Connect
                  id: 1
                - filter:
                    query: '@requestmethod:"DELETE"'
                  name: Delete
                  id: 2
                - filter:
                    query: '@requestmethod:"GET"'
                  name: Get
                  id: 3
                - filter:
                    query: '@requestmethod:"HEAD"'
                  name: Head
                  id: 4
                - filter:
                    query: '@requestmethod:"OPTIONS"'
                  name: Options
                  id: 5
                - filter:
                    query: '@requestmethod:"POST"'
                  name: Post
                  id: 6
                - filter:
                    query: '@requestmethod:"PUT"'
                  name: Put
                  id: 7
                - filter:
                    query: '@requestmethod:"TRACE"'
                  name: Trace
                  id: 8
              targets:
                name: ocsf.activity_name
                id: ocsf.activity_id
              fallback:
                values: {}
                sources: {}
              type: schema-category-mapper
            - name: Map `ocsf.metadata` to `ocsf.metadata`
              sources:
                - ocsf.metadata
              sourceType: attribute
              target: ocsf.metadata
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: ocsf.severity_id
              categories:
                - filter:
                    query: "*"
                  name: Informational
                  id: 1
              targets:
                name: ocsf.severity
                id: ocsf.severity_id
              fallback:
                values: {}
                sources: {}
              type: schema-category-mapper
            - name: Map `timestamp` to `ocsf.time`
              sources:
                - timestamp
              sourceType: attribute
              target: ocsf.time
              targetFormat: integer
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `statuscode` to `ocsf.http_response.code`
              sources:
                - statuscode
              sourceType: attribute
              target: ocsf.http_response.code
              targetFormat: integer
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `internalip` to `ocsf.src_endpoint.ip`
              sources:
                - internalip
              sourceType: attribute
              target: ocsf.src_endpoint.ip
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `statuscode` to `ocsf.status_code`
              sources:
                - statuscode
              sourceType: attribute
              target: ocsf.status_code
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `useragent` to `ocsf.http_request.user_agent`
              sources:
                - useragent
              sourceType: attribute
              target: ocsf.http_request.user_agent
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `http.referer` to `ocsf.http_request.referrer`
              sources:
                - http.referer
              sourceType: attribute
              target: ocsf.http_request.referrer
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `http.url` to `ocsf.http_request.url.url_string`
              sources:
                - http.url
              sourceType: attribute
              target: ocsf.http_request.url.url_string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `externalip` to `ocsf.proxy_endpoint.ip`
              sources:
                - externalip
              sourceType: attribute
              target: ocsf.proxy_endpoint.ip
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: ocsf.status_id
              categories:
                - filter:
                    query: "@verdict:(allowed OR Allowed)"
                  name: Success
                  id: 1
                - filter:
                    query: "@verdict:(blocked OR Blocked)"
                  name: Failure
                  id: 2
              targets:
                name: ocsf.status
                id: ocsf.status_id
              fallback:
                values: {}
                sources: {}
              type: schema-category-mapper
        - type: grok-parser
          name: Parsing `ocsf.http_request.url.query_string` from `http.url`
          enabled: true
          source: http.url
          samples:
            - /datadoghq/company?test=var1%20Pl
          grok:
            supportRules: ""
            matchRules: >
              extract_query_string
              %{regex("[^?]+")}\?%{regex(".*"):ocsf.http_request.url.query_string}
    - type: pipeline
      name: OCSF sub pipeline for HTTP Activity [4002] malware transformations
      enabled: true
      ocsf:
        isOcsf: true
      filter:
        query: "service:proxy -@amp.malware:\"\""
      processors:
        - type: attribute-remapper
          name: Map `amp.disposition` to `ocsf.disposition`
          enabled: true
          sources:
            - amp.disposition
          sourceType: attribute
          target: ocsf.disposition
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: string-builder-processor
          name: Add ocsf.disposition_id
          enabled: true
          template: 99
          target: ocsf.disposition_id
          replaceMissing: true
        - type: attribute-remapper
          name: Map `ocsf.disposition_id` to `ocsf.disposition_id`
          enabled: true
          sources:
            - ocsf.disposition_id
          sourceType: attribute
          target: ocsf.disposition_id
          targetType: attribute
          targetFormat: integer
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `amp.malware` to `ocsf.malware.name`
          enabled: true
          sources:
            - amp.malware
          sourceType: attribute
          target: ocsf.malware.name
          targetType: attribute
          preserveSource: true
          overrideOnConflict: false
        - type: string-builder-processor
          name: Add ocsf.malware.classification_id
          enabled: true
          template: 0
          target: ocsf.malware.classification_id
          replaceMissing: true
        - type: attribute-remapper
          name: Map `ocsf.malware.classification_id` to `ocsf.malware.classification_id`
          enabled: true
          sources:
            - ocsf.malware.classification_id
          sourceType: attribute
          target: ocsf.malware.classification_id
          targetType: attribute
          targetFormat: integer
          preserveSource: false
          overrideOnConflict: false
        - type: array-processor
          name: Move classification_id into classification_ids array
          enabled: true
          operation:
            source: ocsf.malware.classification_id
            target: ocsf.malware.classification_ids
            preserveSource: false
            type: append
    - type: pipeline
      name: " OCSF sub pipeline for DNS Activity [4003]"
      enabled: true
      ocsf:
        isOcsf: true
      filter:
        query: service:dns
      processors:
        - type: schema-processor
          name: Apply OCSF schema for 4003
          enabled: true
          schema:
            schemaType: ocsf
            version: 1.5.0
            className: DNS Activity
            classUid: 4003
            extensions: []
            profiles: 
              - network_proxy
          mappers:
            - name: ocsf.severity_id
              categories:
                - filter:
                    query: "*"
                  name: Informational
                  id: 1
              targets:
                name: ocsf.severity
                id: ocsf.severity_id
              fallback:
                values: {}
                sources: {}
              type: schema-category-mapper
            - name: ocsf.activity_id
              categories:
                - filter:
                    query: "*"
                  name: Traffic
                  id: 6
              targets:
                name: ocsf.activity_name
                id: ocsf.activity_id
              fallback:
                values: {}
                sources: {}
              type: schema-category-mapper
            - name: Map `ocsf.metadata` to `ocsf.metadata`
              sources:
                - ocsf.metadata
              sourceType: attribute
              target: ocsf.metadata
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `timestamp` to `ocsf.time`
              sources:
                - timestamp
              sourceType: attribute
              target: ocsf.time
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: ocsf.rcode_id
              categories:
                - filter:
                    query: '@returnmessage:"NOERROR"'
                  name: NoError
                  id: 0
                - filter:
                    query: '@returnmessage:"FORMERR"'
                  name: FormError
                  id: 1
                - filter:
                    query: '@returnmessage:"SERVFAIL"'
                  name: ServError
                  id: 2
                - filter:
                    query: '@returnmessage:"NXDOMAIN"'
                  name: NXDomain
                  id: 3
                - filter:
                    query: '@returnmessage:"NOTIMP"'
                  name: NotImp
                  id: 4
                - filter:
                    query: '@returnmessage:"REFUSED"'
                  name: Refused
                  id: 5
                - filter:
                    query: '@returnmessage:"YXDOMAIN"'
                  name: YXDomain
                  id: 6
                - filter:
                    query: '@returnmessage:"XRRSET"'
                  name: YXRRSet
                  id: 7
                - filter:
                    query: '@returnmessage:"NOTAUTH"'
                  name: NotAuth
                  id: 9
                - filter:
                    query: '@returnmessage:"NOTZONE"'
                  name: NotZone
                  id: 10
              targets:
                name: ocsf.rcode
                id: ocsf.rcode_id
              fallback:
                values: {}
                sources: {}
              type: schema-category-mapper
            - name: Map `querytype` to `ocsf.query.type`
              sources:
                - querytype
              sourceType: attribute
              target: ocsf.query.type
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `internalip` to `ocsf.src_endpoint.ip`
              sources:
                - internalip
              sourceType: attribute
              target: ocsf.src_endpoint.ip
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `identities.0.id` to `ocsf.src_endpoint.uid`
              sources:
                - identities.0.id
              sourceType: attribute
              target: ocsf.src_endpoint.uid
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `externalip` to `ocsf.proxy_endpoint.ip`
              sources:
                - externalip
              sourceType: attribute
              target: ocsf.proxy_endpoint.ip
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: Map `domain` to `ocsf.query.hostname`
              sources:
                - domain
              sourceType: attribute
              target: ocsf.query.hostname
              targetFormat: string
              preserveSource: true
              overrideOnConflict: true
              type: schema-remapper
            - name: ocsf.status_id
              categories:
                - filter:
                    query: "@verdict:(allowed OR Allowed)"
                  name: Success
                  id: 1
                - filter:
                    query: "@verdict:(blocked OR Blocked)"
                  name: Failure
                  id: 2
              targets:
                name: ocsf.status
                id: ocsf.status_id
              fallback:
                values: {}
                sources: {}
              type: schema-category-mapper