---
description: Pipeline for parsing Sophos XG firewall logs (authentication events pipeline).
processors:
#######################
## ECS Event Mapping ##
#######################
- set:
    field: event.kind
    value: event
- set:
    field: event.outcome
    value: success
    if: 'ctx.sophos?.xg?.log_subtype == "Authentication" && ctx.sophos?.xg?.status == "Successful"'
- set:
    field: event.outcome
    value: failure
    if: 'ctx.sophos?.xg?.log_subtype == "Authentication" && ctx.sophos?.xg?.status == "Failed"'
- set:
    field: event.outcome
    value: success
    if: 'ctx.sophos?.xg?.log_subtype == "Admin" && ctx.sophos?.xg?.status == "Successful" && ctx.event?.code == "17507"'
- set:
    field: event.outcome
    value: failure
    if: 'ctx.sophos?.xg?.log_subtype == "Admin" && ctx.sophos?.xg?.status == "Failed" && ctx.event?.code == "17507"'
- append:
    field: event.type
    value:
    - user
    - start
    if: "['17701', '17704', '17707', '17710', '17713'].contains(ctx.event?.code)"
- append:
    field: event.type
    value:
    - user
    - end
    if: "['17703', '17706', '17709', '17712', '17715'].contains(ctx.event?.code)"
- append:
    field: event.type
    value: connection
    if: "['SSLVPN', 'IPSec', 'Thin Client', 'Radius SSO'].contains(ctx.sophos?.xg?.auth_client)"
- append:
    field: event.category
    value: network
    if: "['SSLVPN', 'IPSec', 'Thin Client', 'Radius SSO'].contains(ctx.sophos?.xg?.auth_client)"
- append:
    field: event.category
    value: authentication
    if: 'ctx.sophos?.xg?.log_subtype == "Authentication"'
- append:
    field: event.type
    value: info
    if: 'ctx.event?.code == "17819"'
- append:
    field: event.category
    value:
    - host
    - malware
    if: 'ctx.event?.code == "17819"'

####################################
## ECS Server/Destination Mapping ##
####################################
- rename:
    field: sophos.xg.dst_ip
    target_field: destination.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.dst_ip != null"
- rename:
    field: sophos.xg.localinterfaceip
    target_field: destination.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.localinterfaceip != null"

###############################
## ECS Client/Source Mapping ##
###############################
- rename:
    field: sophos.xg.src_ip
    target_field: source.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.src_ip != null"
- rename:
    field: sophos.xg.remoteinterfaceip
    target_field: source.ip
    ignore_missing: true
    if: "ctx.sophos?.xg?.remoteinterfaceip != null"
- rename:
    field: sophos.xg.user_name
    target_field: source.user.name
    ignore_missing: true
    if: "ctx.sophos?.xg?.user_name != null"
- set:
    field: source.user.name
    value: '{{sophos.xg.name}}'
    if: "ctx.sophos?.xg?.name != null"
- set:
    field: user.name
    value: '{{source.user.name}}'
    ignore_empty_value: true
    if: 'ctx.sophos?.xg?.log_subtype == "Authentication"'
- rename:
    field: sophos.xg.usergroupname
    target_field: source.user.group.name
    ignore_missing: true
    if: "ctx.sophos?.xg?.usergroupname != null"

#########################
## ECS Message Mapping ##
#########################
- rename:
    field: sophos.xg.message
    target_field: message
    ignore_missing: true

#############
## Cleanup ##
#############
- remove:
    field:
        - sophos.xg.dst_port
        - sophos.xg.src_port
        - sophos.xg.name
    ignore_missing: true
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'

