Add Extractor for msg_id: 1BFF-0007 - Githubissues

ThoZed / graylog-cp-watchguard

Graylog Content Pack for Watchguard Fireware Logging

MIT License

34 stars 13 forks source link

Add Extractor for msg_id: 1BFF-0007 #41

Closed ThoZed closed 5 years ago

ThoZed commented 5 years ago

Please provide following information

msg_id: 1BFF-0007
sample of log message: FWDeviceName (2020-01-01T11:11:11) smtp-proxy[4545]: msg_id="1BFF-0007" Allow WAN01 779-DMZ002 tcp 78.78.98.172 10.70.60.50 61784 33333 msg="ProxyStrip: SMTP filename" proxy_act="SMTP-Incoming.area03_r1.1" rule_name="*.name" filename="file.name" sender="sender@sender.snd" recipients="recipient@recipient.rcp" geo_src="DEU" (Policxyz-00)
Graylog Version 3.0.2

extractor rule definition(optional)

extractor type: GROK