honeyd = {

  plugin_version = "1.0.2"

  # Initial creation - 1.0
  # 2010-05-03 - 1.0.1 - Benson - add support for sync and no comment lines.
  # 2010-12-14 - 1.0.2 - MSG - Edited info lines.

  info.1.manfacturer = "Provos"
  info.1.device = "honeyd"
  info.1.version.1 = ""

  # The name of the log format
  log.format.format_label = "honeyd Log Format"
  log.miscellaneous.log_data_type = "network"
  log.miscellaneous.log_format_type = "network_device"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]-[0-9][0-9]:[0-9][0-9]:[0-9][0-9]\\.[0-9][0-9][0-9][0-9] honeyd log started ------"

  log.format.parse_only_with_filters = "true"


  # Log fields
  log.fields = {

    date = ""
    time = ""
    protocol = ""
    type = ""
    source_ip.type = "host"
    source_port = ""
    destination_ip = ""
    destination_port = ""
    bytes_sent = ""
    bytes_received = ""
    flags = ""
    comment = ""

  } # log.fields


  # Log Parsing Filters
  log.parsing_filters.parse = `
if (matches_regular_expression(current_log_line(), '^([0-9]+-[0-9]+-[0-9]+)-([0-9:]+)\\.[0-9]+ ([^ ]+) ([^ ]+) ([0-9].*)$')) then (
  set_collected_field('', 'date', $1);
  set_collected_field('', 'time', $2);
  set_collected_field('', 'protocol', $3);
  set_collected_field('', 'type', $4);
  v.remainder = $5;
  # e.g. 2009-01-04-15:46:41.3138 tcp(6) S 12.34.56.78 1736 10.23.45.67 445
  if (matches_regular_expression(v.remainder, '^([0-9.]+) ([0-9]+) ([0-9.]+) ([0-9]+)$')) then (
    set_collected_field('', 'source_ip', $1);
    set_collected_field('', 'source_port', $2);
    set_collected_field('', 'destination_ip', $3);
    set_collected_field('', 'destination_port', $4);
  );
  # e.g. 2005-07-05-08:50:27.9273 tcp(6) - 12.191.140.166 4480 45.26.117.249 6129: 48 S
  if (matches_regular_expression(v.remainder, '^([0-9.]+) ([0-9]+) ([0-9.]+) ([0-9]+)(: | )(.*)')) then (
    set_collected_field('', 'source_ip', $1);
    set_collected_field('', 'source_port', $2);
    set_collected_field('', 'destination_ip', $3);
    set_collected_field('', 'destination_port', $4);
    v.remainder = $6;
    if (matches_regular_expression(v.remainder, '^(.*)\\\\[([^])]*)\\\\]$')) then (
      v.remainder = $1;
      set_collected_field('', 'comment', $2);
    );
    if (ends_with(v.remainder, ' ')) then
      v.remainder = substr(v.remainder, 0, length(v.remainder) - 1);
    # e.g. 2005-07-05-14:29:12.6994 tcp(6) E 12.83.11.241 3414 45.26.117.5 80: 221 121
    if (matches_regular_expression(v.remainder, '^([0-9]+) ([0-9]+)$')) then (
      set_collected_field('', 'bytes_sent', $1);
      set_collected_field('', 'bytes_received', $2);
    )
    # e.g. 2005-07-05-08:50:27.9273 tcp(6) - 12.191.140.166 4480 45.26.117.249 6129: 48 S
    else if (matches_regular_expression(v.remainder, '^[0-9]+ ([A-Z]+)$')) then
      set_collected_field('', 'flags', $1);
    else if (matches_regular_expression(v.remainder, '^([A-Z]+)$')) then
      set_collected_field('', 'flags', $1);
  )
  # e.g. 2005-07-05-08:57:19.8600 icmp(1) - 162.240.59.82 61.26.118.65: 8(0): 92
  else if (matches_regular_expression(v.remainder, '^([0-9.]+) ([0-9.]+): [0-9]+\\\\([0-9]+\\\\): [0-9]')) then (
    set_collected_field('', 'source_ip', $1);
    set_collected_field('', 'destination_ip', $2);
  );
  accept_collected_entry('', false);
)
`


  # Database fields
  database.fields = {

    date_time = ""
    hour_of_day = ""
    day_of_week = ""
    protocol = ""
    type = ""
    source_ip = ""
    location = ""
    source_port = ""
    destination_ip = ""
    destination_port = ""
    flags = ""
    comment = ""

  } # database.fields


  # Log Filters
  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'packets = 1;'
    } # mark_entry

  } # log.filters

  database.numerical_fields = {

    packets = {
      label = "$lang_stats.field_labels.packets"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # packets

    unique_source_ips = {
      label = "$lang_stats.field_labels.unique_source_ips"
      default = false
      requires_log_field = true
      log_field = "src_ip"
      type = "unique"
      display_format_type = "integer"
    } # unique_source_ips

    bytes_sent = {
      label = "$lang_stats.field_labels.bytes_sent"
      default = false
      log_field = "bytes_sent"
      requires_log_field = true
      type = "float"
      display_format_type = "bandwidth"
    }

    bytes_received = {
      label = "$lang_stats.field_labels.bytes_received"
      default = false
      log_field = "bytes_received"
      requires_log_field = true
      type = "float"
      display_format_type = "bandwidth"
    }

  } # database.numerical_fields


  create_profile_wizard_options = {
    host_tracking = true

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      protocol = ""
      type = ""
      source_ip = ""
      location = ""
      source_port = ""
      destination_ip = ""
      destination_port = ""
      flags = ""
      comment = ""
    } # report_groups

  } # create_profile_wizard_options

} # honeyd