File: //usr/share/filebeat/module/threatintel/malwarebazaar/config/config.yml
{{ if eq .input "httpjson" }}
type: httpjson
interval: {{ .interval }}
request.method: POST
{{ if .ssl }}
request.ssl: {{ .ssl | tojson }}
{{ end }}
{{ if .proxy_url }}
request.proxy_url: {{ .proxy_url }}
{{ end }}
request.url: {{ .url }}
request.encode_as: application/x-www-form-urlencoded
request.transforms:
- set:
target: url.params.query
value: get_recent
- set:
target: url.params.selector
value: time
response.split:
target: body.data
{{ else if eq .input "file" }}
type: log
paths:
{{ range $i, $path := .paths }}
- {{$path}}
{{ end }}
exclude_files: [".gz$"]
{{ end }}
tags:
{{if .preserve_original_event}}
- preserve_original_event
{{end}}
{{range $val := .tags}}
- {{$val}}
{{end}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
processors:
- add_locale: ~
- add_fields:
target: ''
fields:
ecs.version: 1.12.0