diff --git a/LookupTables/fireware_msg_id_lookup_table.csv b/LookupTables/fireware_msg_id_lookup_table.csv index d659f12..8745077 100644 --- a/LookupTables/fireware_msg_id_lookup_table.csv +++ b/LookupTables/fireware_msg_id_lookup_table.csv @@ -574,3 +574,4 @@ "7001-0009","INFO","Mobile Security / Endpoint Manager","Mobile device user session recreated","User session is recreated because the mobile device IP address changed." "7002-0000","INFO","Mobile Security / Endpoint Manager","Mobile device Authorization Agreement sign action","The Device Authorization Agreement is either accepted or declined by a user at the specified local time." "1600-0065","INFO","Networking / DHCP Server","DHCP Message","DHCP related Messages generated by builtin DHCP-Server" +"1600-0066","INFO","Networking / DHCP Server","DHCP Message","DHCP related Messages generated by builtin DHCP-Server" diff --git a/content_pack_input.json b/content_pack_input.json index 84609d4..ef6dd8b 100644 --- a/content_pack_input.json +++ b/content_pack_input.json @@ -138,7 +138,7 @@ "converters": [], "condition_type": "NONE", "condition_value": "", - "order": 13 + "order": 14 }, { "title": "Firewall PacketFilter INFO 3000-0148", "type": "GROK", @@ -204,6 +204,19 @@ "condition_type": "REGEX", "condition_value": "^.*msg_id=\"1600-0065\".*", "order": 12 + }, { + "title": "Networking DHCP INFO 1600-0066", + "type": "GROK", + "cursor_strategy": "COPY", + "target_field": "", + "source_field": "message", + "configuration": { + "grok_pattern": "^.*\\) %{NOTSPACE:service}\\[%{NOTSPACE:process}\\]: msg_id=\"1600-0066\" %{DHCPMESSAGE:dhcp_message} (from|(for %{IPV4:dhcp_clientip}|for %{IPV4:dhcp_clientip} \\(%{IPV4:dhcp_serverip}\\)) from) %{MAC:dhcp_clientmac} (via|\\(%{NOTSPACE:dhcp_clientname}\\) via) vlan%{NUMBER:dhcp_clientvlan}" + }, + "converters": [], + "condition_type": "REGEX", + "condition_value": "^.*msg_id=\"1600-0066\".*", + "order": 13 } ] }],