---
description: Pipeline for parsing sophos firewall logs (Content Filtering pipeline)
processors:
#######################
## ECS Event Mapping ##
#######################
- set:
    field: event.kind
    value: event
- set:
    field: event.action
    value: "{{sophos.xg.log_subtype}}"
    if: "ctx.sophos?.xg?.log_subtype != null"
- set:
    field: event.outcome
    value: success
    if: "ctx.sophos?.xg?.log_subtype != null"
- set:
    field: event.kind
    value: alert
    if: 'ctx.sophos?.xg?.log_subtype == "Denied"'
- append:
    field: event.category
    value:
      - malware
      - network
    if: 'ctx.sophos?.xg?.log_subtype == "Denied"'
- append:
    field: event.category
    value: network
    if: "ctx.sophos?.xg?.log_subtype != 'Denied'"
- append:
    field: event.type
    value:
     - allowed
     - connection
    if: '["Allowed", "Warned"].contains(ctx.sophos?.xg?.log_subtype)'
- append:
    field: event.type
    value:
      - info
      - denied
      - connection
    if: "ctx.sophos?.xg?.log_subtype == 'Denied'"

##########################
## ECS Destination Mapping
##########################
- rename:
    field: sophos.xg.dst_ip
    target_field: destination.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.dst_ip != null"
- convert:
    field: sophos.xg.dst_port
    target_field: destination.port
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.dst_port != null"

#####################
## ECS Source Mapping
#####################
- rename:
    field: sophos.xg.src_ip
    target_field: source.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_ip != null"
- convert:
    field: sophos.xg.src_port
    target_field: source.port
    type: long
    ignore_failure: true
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_port != null"
- rename:
    field: sophos.xg.user_name
    target_field: source.user.name
    ignore_missing: true
    if: "ctx.sophos?.xg?.user_name != null"
- rename:
    field: sophos.xg.user_gp
    target_field: source.user.group.name
    ignore_missing: true
    if: "ctx.sophos?.xg?.user_gp != null"

#####################
## ECS URL Mapping ##
#####################
- rename:
    field: sophos.xg.url
    target_field: url.original
    ignore_missing: true
- uri_parts:
    field: url.original
    target_field: url
    if: "ctx.url?.original != null"
- set:
    field: url.full
    copy_from: url.original
    ignore_empty_value: true
- rename:
    field: sophos.xg.domain
    target_field: url.domain
    ignore_missing: true
    if: ctx.url?.domain == null

############################
## ECS User Agent Mapping ##
############################
- rename:
    field: sophos.xg.referer
    target_field: http.request.referrer
    ignore_missing: true
    if: "ctx.sophos?.xg?.referer != null"
- convert:
    field: sophos.xg.status_code
    target_field: http.response.status_code
    type: long
    ignore_missing: true
    if: "ctx.sophos?.xg?.status_code != null && ctx.sophos?.xg?.status_code != ''"
- convert:
    field: sophos.xg.http_status
    target_field: http.response.status_code
    type: long
    ignore_missing: true
    if: "ctx.sophos?.xg?.http_status != null && ctx.sophos?.xg?.http_status != '' && ctx.sophos?.xg?.http_status != '0'"
- rename:
    field: sophos.xg.user_agent
    target_field: user_agent.original
    ignore_missing: true
- user_agent:
    field: user_agent.original
    target_field: user_agent
    ignore_missing: true

######################
## ECS Network Mapping
######################
- rename:
    field: sophos.xg.protocol
    target_field: network.transport
    ignore_missing: true
- set:
    field: network.protocol
    copy_from: url.scheme
    override: false
    ignore_empty_value: true

#############
## Cleanup ##
#############
- lowercase:
      field: event.action
      ignore_failure: true
- remove:
    field:
    - sophos.xg.dst_port
    - sophos.xg.src_port
    - sophos.xg.domain
    - sophos.xg.http_status
    - sophos.xg.http_user_agent
    ignore_missing: true
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'
