Adding dynamic filters

SplunkAppForWazuh/default/addon_builder.conf

@@ -0,0 +1,5 @@
+[base]
+builder_version = 2.2.0
+builder_build = 12
+is_edited = 1
+

SplunkAppForWazuh/local/data/ui/views/logs.xml

@@ -0,0 +1,25 @@
+<form>
+  <label>Manager Logs</label>
+  <fieldset submitButton="false" autoRun="true">
+    <input type="dropdown" token="value" searchWhenChanged="true">
+      <label>Filter by level</label>
+      <choice value="WARNING">WARNING</choice>
+      <choice value="INFO">INFO</choice>
+      <choice value="*">*</choice>
+      <initialValue>*</initialValue>
+    </input>
+  </fieldset>
+  <row>
+    <panel>
+      <table>
+        <title>Manager logs</title>
+        <search>
+          <query>index=wazuh_api sourcetype="wazuh:api:info:basic" | table logs_timestamp, logs_tag, logs_description, logs_level | search logs_level=$value$</query>
+          <earliest>-24h@h</earliest>
+          <latest>now</latest>
+        </search>
+        <option name="drilldown">none</option>
+      </table>
+    </panel>
+  </row>
+</form>

SplunkAppForWazuh/local/props.conf

@@ -0,0 +1,26 @@
+[wazuh]
+DATETIME_CONFIG = 
+INDEXED_EXTRACTIONS = json
+KV_MODE = none
+NO_BINARY_CHECK = true
+category = Application
+disabled = false
+pulldown_type = true
+FIELDALIAS-rule.groups = "rule.groups{}" AS "rule.groups"
+FIELDALIAS-dstuser = "data.dstuser" AS srcuser
+FIELDALIAS-srcip = "data.srcip" AS srcip
+FIELDALIAS-data.title = "data.title" AS title
+FIELDALIAS-oscap.scan.id = "data.oscap.scan.id" AS "oscap.scan.id"
+FIELDALIAS-oscap.scan.content = "data.oscap.scan.content" AS "oscap.scan.content"
+FIELDALIAS-oscap.scan.profile.title = "data.oscap.scan.profile.title" AS "oscap.scan.profile.title"
+FIELDALIAS-oscap.scan.score = "data.oscap.scan.score" AS "oscap.scan.score"
+FIELDALIAS-oscap.check.title = "data.oscap.check.title" AS "oscap.check.title"
+FIELDALIAS-oscap.check.result = "data.oscap.check.result" AS "oscap.check.result"
+FIELDALIAS-oscap.check.severity = "data.oscap.check.severity" AS "oscap.check.severity"
+FIELDALIAS-audit.exe = "data.audit.exe" AS "audit.exe"
+FIELDALIAS-audit.file.mode = "data.audit.file.mode" AS "audit.file.mode"
+FIELDALIAS-audit.egid = "data.audit.egid" AS "audit.egid"
+FIELDALIAS-audit.euid = "data.audit.euid" AS "audit.euid"
+
+[wazuh_api]
+FIELDALIAS-agent-last-syscheck = las_syscheck AS last_syscheck

SplunkAppForWazuh/local/transforms.conf

@@ -0,0 +1,4 @@
+[pci1.csv]
+batch_index_query = 0
+case_sensitive_match = 1
+filename = pci1.csv

SplunkAppForWazuh/metadata/local.meta

@@ -1364,3 +1364,7 @@ export = none
 owner = admin
 version = 6.6.0
 modtime = 1502598678.925916000
+
+[views/logs]
+version = 7.0.2
+modtime = 1520596415.232658000

TA-wazuh-api-connector/bin/input_module_wazuh_api_info_basic.py

@@ -39,23 +39,16 @@ def collect_events(helper, ew):
     for key in agent_summary:
         data['agent_summary_' + key.lower().replace(' ', '')] = agent_summary[key]
 
-    dataLogs = {}
-    for row in logs:
-        for key in row:
-            dataLogs['logs_'+key] = row[key]
-        dataLogs = json.dumps(dataLogs)
 
-        # event = helper.new_event(source=helper.get_input_type(), index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=data)
-        # ew.write_event(event)
     data = json.dumps(data)
-    mergedJson = merge_two_dicts(data,dataLogs)
+    # mergedJson = merge_two_dicts(data,dataLogs)
     event = helper.new_event(source=helper.get_input_type(), index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=data)
     ew.write_event(event)
 
-    # for row in logs:
-    #     data = {}
-    #     for key in row:
-    #         data['logs_'+key] = row[key]
-    #     data = json.dumps(data)
-    #     event = helper.new_event(source=helper.get_input_type(), index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=data)
-    #     ew.write_event(event)
+    for row in logs:
+        data = {}
+        for key in row:
+            data['logs_'+key] = row[key]
+        data = json.dumps(data)
+        event = helper.new_event(source=helper.get_input_type(), index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=data)
+        ew.write_event(event)