The Perl Toolchain Summit needs more sponsors. If your company depends on Perl, please support this very important event.
 / 
eris-0.006
River stage zero No dependents
++

Changes for version 0.006

  • Change: b1231e5a3f970d07f07ec4e00cc4746634293c09 Author: Brad Lhotsky <brad@divisionbyzero.net> Date : 2017-12-04 01:18:50 +0000
    • Release 0.006 with the indexers fixed and the iptables context.
  • Change: a121f4f64caa7b60bbbe9da6b422fb7e33991799 Author: Brad Lhotsky <brad@divisionbyzero.net> Date : 2017-12-04 01:14:28 +0000
    • Fix the eris-es-indexer.pl
    • The config was pointing to the wrong depth in the hash. Ensure when the config is passed from the commandline, eris::schemas are instantiated correctly. Fix the mapping for the geo_point field in the geoip mapping.
    • Add the eris::log::context::iptables to parse iptables logs into the indexes.

Documentation

eris-context.pl
Utility for testing the logging contextualizer
eris-eris-client.pl
Simple wrapper to spawn workers for handling syslog stream
eris-es-indexer.pl
Sample implementation using the eris toolkit to index data to elasticsearch
eris-field-lookup.pl
Utility for testing the logging contextualizer
eris-stdin-listener.pl
Simple wrapper to spawn workers for handling syslog stream

Modules

eris
Eris is the Greek Goddess of Chaos
eris::dictionary
Field dictionary loader
eris::dictionary::cee
Contains fields in the Common Event Expression syntax
eris::dictionary::eris
Contains fields eris adds to events
eris::dictionary::eris::debug
Debugging data in the event
eris::dictionary::syslog
Contains fields extracted from syslog messages
eris::log
Structured log or event object implementation
eris::log::context::GeoIP
Apply MaxMind GeoIPv2 Data to events
eris::log::context::attacks::url
Inspects URL's for common attack patterns
eris::log::context::crond
Parse crond messages to structured data
eris::log::context::dhcpd
Parses dhcpd messages into structured data.
eris::log::context::iptables
Parses iptables messages into structured data.
eris::log::context::pfSense::filterlog
Parse the pfsense filterlog
eris::log::context::postfix
Parses postfix messages into structured data
eris::log::context::snort
Parses the Snort and Suricata alert logs
eris::log::context::sshd
Parse sshd logs into structured data
eris::log::context::static
Add static keys/values to every message
eris::log::context::sudo
Parses the sudo key=value pairs into structured documents
eris::log::context::yum
Parse the yum syslog output into structured data
eris::log::contexts
Discovery and access for context objects
eris::log::contextualizer
Primary interface to the eris log parsing library
eris::log::decoder::json
Decodes any detected JSON in a log line from then opening curly brace
eris::log::decoder::syslog
Parse the syslog headers using Parse::Syslog::Line
eris::log::decoders
Discovery and access for decoders
eris::role::context
Role for implementing a log context
eris::role::decoder
Role for implementing decoders
eris::role::dictionary
Interface for implementing a dictionary object
eris::role::dictionary::hash
Simple dictionary implementation based off a hash
eris::role::pluggable
Implements the plumbing for an object to support plugins
eris::role::plugin
Common interface for implementing an eris plugin
eris::role::schema
Role for implementing a schema
eris::schema::syslog
Schema for the syslog data
eris::schemas
Discovery and access for schemas

Examples

Other files