security_content/data_sources/web/Splunk_Stream_HTTP.yml at develop · samson4649/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
name: Splunk Stream HTTP
id: b0070a33-92ed-49e5-8f38-576cdf300710
author: Patrick Bareiss, Splunk
source: stream:http
sourcetype: stream:http
supported_TA:
  name: Splunk App for Stream
  version: 8.1.1
  url: https://splunkbase.splunk.com/app/1809
event_names: []
fields:
  - _time
  - count
  - date_hour
  - date_mday
  - date_minute
  - date_month
  - date_second
  - date_wday
  - date_year
  - date_zone
  - dest_ip
  - endtime
  - host
  - index
  - linecount
  - punct
  - source
  - sourcetype
  - splunk_server
  - src_ip
  - sum(bytes)
  - sum(packets_in)
  - sum(packets_out)
  - timeendpos
  - timestamp
  - timestartpos
  - values(flow_id){}
  - vxlan_id
example_log: ""