pfSense Graylog Pipeline Rules

This repository contains pfSense related graylog pipeline rules.

Graylog doesn't support pipeline in content packs yet, in the future this will become a content pack. #4222

Getting Started

Install syslog-ng package

Services/syslog-ng/General Enable the service, set Interface to your LAN and port 5140
Services/syslog-ng/Advanced Add:
Object Type: Destination, Object Name: graylog

{ syslog("[your_graylog_ip]" transport(udp) port(514)); };

Object Type: Log, Object Name: sent_to_graylog

{ source(_DEFAULT); destination(graylog); };

Status/System Logs/Settings Enable Remote Logging, Source Address LAN, IPv4, Remote Log Server [your_pfsense_lan_ip]:5140, and select Everything

Create a new stream

Example:

Field source must match exactly pfsense
Field application_name must match exactly filterlog

Create the pipeline rules

System/Pipelines/Manage rules
Copy/paste this repository txt files one on each rule

Create the pipeline

System/Pipelines/Manage pipelines/Add a new pipeline
Edit connections and select the stream you created
Edit stage 0 and add all pfsense rules you created

Additional scripts

generate_fields_from_csv.awk will help you to generate new rules based on existing CSV extractors.

Example

$ echo "RuleNumber,SubRuleNumber,Anchor,Tracker,Interface,Reason,Action,Direction,IPVersion,Class,FlowLabel,HopLimit,Protocol,ProtocolID,Length,SourceIP,DestIP,SourcePort,DestPort,DataLength" | ./generate_fields_from_csv.awk 
  set_field("RuleNumber", m[0]);
  set_field("SubRuleNumber", m[1]);
  set_field("Anchor", m[2]);
  set_field("Tracker", m[3]);
  set_field("Interface", m[4]);
  set_field("Reason", m[5]);
  set_field("Action", m[6]);
  set_field("Direction", m[7]);
  set_field("IPVersion", m[8]);
  set_field("Class", m[9]);
  set_field("FlowLabel", m[10]);
  set_field("HopLimit", m[11]);
  set_field("Protocol", m[12]);
  set_field("ProtocolID", m[13]);
  set_field("Length", m[14]);
  set_field("SourceIP", m[15]);
  set_field("DestIP", m[16]);
  set_field("SourcePort", m[17]);
  set_field("DestPort", m[18]);
  set_field("DataLength", m[19]);

Authors

Wagner Sartori Junior - Initial work - trunet

Contributors

Some of these rules were ported from:

https://github.com/Hobadee/Graylog_Extractors_pfSense

License

This project is licensed under the GPL License - see the COPYING.md file for details

trunet / graylog-pfsense-pipeline