#24746: Update Threatinteal Anomali pipeline (#27141)

(cherry picked from commit 7fa146c)
elastic · Aug 10, 2021 · 39fa875 · 39fa875
1 parent 589fd53
commit 39fa875
Show file tree

Hide file tree

Showing 3 changed files with 515 additions and 100 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -435,6 +435,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add support to `decode_cef` for MAC addresses that do not contain separator characters. {issue}27050[27050] {pull}27109[27109]
 - Update Elasticsearch module's ingest pipeline for parsing new deprecation logs {issue}26857[26857] {pull}26880[26880]
 - Add new `hmac` template function for httpjson input {pull}27168[27168]
+- Update `tags` and `threatintel.indicator.provider` fields in `threatintel.anomali` ingest pipeline {issue}24746[24746] {pull}27141[27141]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/threatintel/anomali/ingest/pipeline.yml b/x-pack/filebeat/module/threatintel/anomali/ingest/pipeline.yml
@@ -100,6 +100,20 @@ processors:
     field: threatintel.indicator.type
     value: unknown
     if: ctx?.threatintel?.indicator?.type == null
+- foreach:
+    field: threatintel.anomali.labels
+    ignore_missing: true
+    processor:
+      append:
+        field: tags
+        value: "{{_ingest._value}}"
+        allow_duplicates: false
+- grok:
+    field: threatintel.anomali.description
+    patterns:
+      - "^%{GREEDYDATA}Source: %{GREEDYDATA:threatintel.indicator.provider}"
+    ignore_missing: true
+    ignore_failure: true
 ######################
 # Cleanup processors #
 ######################