#24746: Update Threatinteal Anomali pipeline (#27141) (#27298)

(cherry picked from commit 7fa146c) Co-authored-by: Alex Resnick <[email protected]> Co-authored-by: Marius Iversen <[email protected]>
elastic · Aug 21, 2021 · 7c86623 · 7c86623
1 parent be8a2b4
commit 7c86623
Show file tree

Hide file tree

Showing 2 changed files with 514 additions and 100 deletions.
diff --git a/x-pack/filebeat/module/threatintel/anomali/ingest/pipeline.yml b/x-pack/filebeat/module/threatintel/anomali/ingest/pipeline.yml
@@ -100,6 +100,20 @@ processors:
     field: threatintel.indicator.type
     value: unknown
     if: ctx?.threatintel?.indicator?.type == null
+- foreach:
+    field: threatintel.anomali.labels
+    ignore_missing: true
+    processor:
+      append:
+        field: tags
+        value: "{{_ingest._value}}"
+        allow_duplicates: false
+- grok:
+    field: threatintel.anomali.description
+    patterns:
+      - "^%{GREEDYDATA}Source: %{GREEDYDATA:threatintel.indicator.provider}"
+    ignore_missing: true
+    ignore_failure: true
 ######################
 # Cleanup processors #
 ######################