6502-kape_filefolderaccess.conf

# SOF-ELK® Configuration File
# Author: Phil Hagen
# Email: phil@lewestech.com
#
# (C)2019 Lewes Technology Consulting, LLC
#
# This conf file accepts logs from the KAPE forensic tool

# this file is currently disabled until the PECmd is updated to the new JSON output format

filter {
#  if [type] == "kape_filefolderaccess" and "json" not in [tags] {
#    # keep and handled: SourceCreated, SourceModified, SourceAccessed, TargetCreated, TargetModified, TargetAccessed, SourceFile, FileSize, RelativePath, WorkingDirectory, DriveType, VolumeSerialNum, FileAttributes, HeaderFlags
#
#    mutate {
#      # create two timestamp fields with the MACBs in subfields
#      rename => {
#        "[raw][SourceModified]" => "[Source][LastModified]"
#        "[raw][SourceAccessed]" => "[Source][LastAccess]"
#        "[raw][SourceCreated]" => "[Source][Created]"
#
#        "[raw][Header][TargetModificationDate]" => "[Target][LastModified]"
#        "[raw][Header][TargetLastAccessedDate]" => "[Target][LastAccess]"
#        "[raw][Header][TargetCreationDate]" => "[Target][Created]"
#      }
#    }
#
#    # strip timestamps to just their integers
#    mutate {
#      gsub => [ "[Source][LastModified]", "\/Date\((\d+)\)\/", "\1" ]
#      gsub => [ "[Source][LastAccess]", "\/Date\((\d+)\)\/", "\1" ]
#      gsub => [ "[Source][Created]", "\/Date\((\d+)\)\/", "\1" ]
#
#      gsub => [ "[Target][LastModified]", "\/Date\((\d+)\)\/", "\1" ]
#      gsub => [ "[Target][LastAccess]", "\/Date\((\d+)\)\/", "\1" ]
#      gsub => [ "[Target][Created]", "\/Date\((\d+)\)\/", "\1" ]
#    }
#
#    # convert all Source timestamps to date/time types
#    date {
#      match => [ "[Source][LastModified]", "UNIX_MS" ]
#      target => "[Source][LastModified]"
#    }
#    date {
#      match => [ "[Source][LastAccess]", "UNIX_MS" ]
#      target => "[Source][LastAccess]"
#    }
#    date {
#      match => [ "[Source][Created]", "UNIX_MS" ]
#      target => "[Source][Created]"
#    }
#
#    # convert all Target timestamps to date/time types
#    date {
#      match => [ "[Target][LastModified]", "UNIX_MS" ]
#      target => "[Target][LastModified]"
#    }
#    date {
#      match => [ "[Target][LastAccess]", "UNIX_MS" ]
#      target => "[Target][LastAccess]"
#    }
#    date {
#      match => [ "[Target][Created]", "UNIX_MS" ]
#      target => "[Target][Created]"
#    }
#
#    # convert FileAttributes to true/false array
#    mutate {
#      rename => {
#        "[raw][HeaderInfo][FileAttributes]" => "FileAttributes"
#      }
#    }
#    ruby {
#      path => "/usr/local/sof-elk/supporting-scripts/ntfs_flags_to_array.rb"
#      script_params => { "source_field" => "FileAttributes" }
#    }
#
#    # convert DataFlags to true/false array
#    mutate {
#      rename => {
#        "[raw][HeaderInfo][DataFlags]" => "DataFlags"
#      }
#    }
#    ruby {
#      path => "/usr/local/sof-elk/supporting-scripts/data_flags_to_array.rb"
#      script_params => { "source_field" => DataFlags}
#    }
#
#    # clean up by promoting needed fields to keep and removing [raw] placeholder
#    mutate {
#      rename => {
#        "[raw][SourceFile]" => "SourceFile"
#        "[raw][Header][FileSize]" => "FileSize"
#        "[raw][RelativePath]" => "RelativePath"
#        "[raw][WorkingDirectory]" => "WorkingDirectory"
#        "[raw][VolumeInfo][DriveType]" => "DriveType"
#        "[raw][VolumeInfo][VolumeSerialNum]" => "VolumeSerialNum"
#      }
#      remove_field => [ "raw" ]
#    }
#  }
}