Skip to main content
adem_netsys
Explorer III
July 8, 2024
Question

MongoDB Integration

  • July 8, 2024
  • 4 replies
  • 1971 views

Hi,

 

Has anyone done SIEM integration with mongoDB before, does SIEM support this?

4 replies

kcanalichio
New Member
July 8, 2024

Never heard on mangodb, however if you are referring to mongodb here is a quick parser I put together for it.

 


 

<eventFormatRecognizer><![CDATA[<:gPatSyslogPRI><:gPatMon>\s+<:gPatDay>\s+<:gPatTime>\s+.*mongod(?:\[\d+\]\:)|.*mongod\:]]></eventFormatRecognizer><parsingInstructions><switch><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostName:gPatStr>\s+mongod\[<_pid:gPatStr>\]: <_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute></case><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostIp:gPatIpAddr>\s+mongod\[<_pid:gPatStr>\]: <_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute></case><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostName:gPatStr>\s+mongod: <_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute></case><case><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<hostIp:gPatIpAddr>\s+mongod: <_body:gPatMesgBody>]]></regex></collectFieldsByRegex><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute></case></switch><collectAndSetAttrByJSON src="$_body"><attrKeyMap attr="type" key="c"/><attrKeyMap attr="_type" key="s"/><attrKeyMap attr="timeGrain" key="t.$date"/><attrKeyMap attr="id" key="id"/><attrKeyMap attr="categoryType" key="ctx"/><attrKeyMap attr="msg" key="msg"/><attrKeyMap attr="usrMsg" key="attr.message"/></collectAndSetAttrByJSON><setEventAttribute attr="eventType">combineMsgId("mongod", "_", $_type, "_", $type)</setEventAttribute><when test="$eventType IN 'mongod_I_STORAGE'"><collectFieldsByRegex src="$usrMsg"><regex><![CDATA[.* snapshot min: <fsCapacitySnapshotLower:gPatInt>]]></regex></collectFieldsByRegex><collectFieldsByRegex src="$usrMsg"><regex><![CDATA[.* snapshot max: <fsCapacitySnapshotUpper:gPatInt>]]></regex></collectFieldsByRegex><collectFieldsByRegex src="$usrMsg"><regex><![CDATA[.* snapshot count: <totalSnapshot:gPatInt>]]></regex></collectFieldsByRegex></when><setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_time)</setEventAttribute><setEventAttribute attr="eventAction">0</setEventAttribute><choose><when test="$_type IN 'E,ERROR,error,Error'"><setEventAttribute attr="eventSeverity">9</setEventAttribute></when><when test="$_type IN 'W,WARN,Warn,warn,WARNING,Warning,warning'"><setEventAttribute attr="eventSeverity">5</setEventAttribute></when><when test="$_type IN 'N,NOTICE,Notice,notice'"><setEventAttribute attr="eventSeverity">2</setEventAttribute></when><when test="$_type IN 'I,INFO,Info,info'"><setEventAttribute attr="eventSeverity">1</setEventAttribute></when></choose><when test="exist srcName"><setEventAttribute attr="hostName">$srcName</setEventAttribute></when></parsingInstructions>​

 


 

 

 

 

adem_netsys
Explorer III
July 8, 2024

Thanks for the correction, I didn't realise it was a keyboard error :)

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!