# Copyright (c) 2012 Flowerfire, Inc.  All Rights Reserved.
juniper_idp = {

  plugin_version = "1.0"

  # 2012-06-15 - Benson - 1.0 - Initial creation

  info.1.manufacturer = "Juniper"
  info.1.device = "IDP"
  info.1.version.1 = "1.0"

  # The name of the log format
  log.format.format_label = "Juniper Log Format"
  log.miscellaneous.log_data_type = "syslog_required"
  log.miscellaneous.log_format_type = "firewall"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_expression = `
matches_regular_expression(volatile.log_data_line, "Jnpr Syslog [0-9]+ [0-9]+ \\\\[")
`

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    record_id = ""
    sent_time = ""
    domain = ""
    device_ip = ""
    cat = ""
    attack = ""
    source_zone = ""
    source_interface = ""
    source_ip.type = "host"
    source_port = ""
    nat_source_ip = ""
    nat_source_port = ""
    destination_zone = ""
    destination_interface = ""
    destination_ip = ""
    destination_port = ""
    nat_destination_ip = ""
    nat_destination_port = ""
    protocol = ""
    rule_ver = ""
    policy = ""
    rule_base = ""
    rule_number = ""
    action = ""
    alert = ""
    duration = ""
    inbytes.type = "size"
    outbytes.type = "size"
    total_bytes.type = "size"
    inpkts = ""
    outpkts = ""
    total_packets = ""
    repeat_count = ""
    packet_data = ""
    var_enum = ""
    miscellaneous = ""
    user = ""
    app = ""
    uri.type = "page"

  } # log.fields

# samples for fields introduced
#2012-06-08	10:50:10	daemon.info	123.45.67.89	1 2012-06-08T10:50:07 123.45.67.89 Jnpr Syslog 9577 1 [syslog@juniper.net dayId="20120608" recordId="3" timeRecv="2012/06/08 10:50:07" timeGen="2012/06/08 10:50:07" domain="" devDomVer2="0" device_ip="123.45.67.89" cat="Predefined" attack="HTTP:AUDIT:URL" srcZn="NULL" srcIntf="eth2" srcAddr="123.45.67.90" srcPort="4803" natSrcAddr="NULL" natSrcPort="0" dstZn="NULL" dstIntf="NULL" dstAddr="12.34.56.78" dstPort="80" natDstAddr="NULL" natDstPort="0" protocol="TCP" ruleDomain="" ruleVer="60" policy="Polit Run (2010_10_20)" rulebase="IDS" ruleNo="6" action="NONE" severity="INFO" alert="no" elaspedTime="0" inbytes="0" outbytes="0" totBytes="0" inPak="0" outPak="0" totPak="0" repCount="0" packetData="no" varEnum="7" misc="'interface=eth2','vlan-id=168'" user="NULL" app="NULL" uri="NULL"]
# Log Parsing Filters
  log.parsing_filters.parse = `

if (matches_regular_expression(v.syslog_message, '(dayId=.*$)')) then (
  collect_listed_fields('', $1, ' ', '=', 'recordId=record_id|timeGen=sent_time|srcZn=source_zone|srcIntf=source_interface|srcAddr=source_ip|srcPort=source_port|natSrcAddr=nat_source_ip|natSrcPort=nat_source_port|dstZn=destination_zone|dstIntf=destination_interface|dstAddr=destination_ip|dstPort=destination_port|natDstAddr=nat_destination_ip|natDstPort=nat_destination_port|ruleVer=rule_ver|rulebase=rule_base|ruleNo=rule_number|elaspedTime=duration|totBytes=total_bytes|inPak=inpkts|outPak=outpkts|totPak=total_packets|repCount=repeat_count|packetData=packet_data|varEnum=var_enum|misc=miscellaneous');

  if (matches_regular_expression(get_collected_field('', 'sent_time'), '^([0-9/]{10}) ([0-9:]{8})')) then (
    set_collected_field('', 'date', $1);
    set_collected_field('', 'time', $2);
  );
  accept_collected_entry('', false);
);

`

  # Database fields
  database.fields = {

    record_id = ""
    domain = ""
    device_ip = ""
    cat = ""
    attack = ""
    source_zone = ""
    source_interface = ""
    source_ip = ""
    source_port = ""
    nat_source_ip = ""
    nat_source_port = ""
    destination_zone = ""
    destination_interface = ""
    destination_ip = ""
    destination_port = ""
    nat_destination_ip = ""
    nat_destination_port = ""
    protocol = ""
    rule_ver = ""
    policy = ""
    rule_base = ""
    rule_number = ""
    action = ""
    alert = ""
    packet_data = ""
    var_enum = ""
    miscellaneous = ""
    user = ""
    app = ""
    uri = ""
    location = ""

  } # database.fields


  # Log Filters
  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'accesses = 1;'
    } # mark_entry

  } # log.filters

  database.numerical_fields = {

    accesses = {
      label = "$lang_stats.field_labels.accesses"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # accesses

    inbytes = {
      default = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # inbytes

    outbytes = {
      default = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # outbytes

    total_bytes = {
      default = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # total_bytes

#    inpkts = {
#      default = false
#      type = "int"
#      integer_bits = 64
#    } # inpkts

#    outpkts = {
#      default = false
#      type = "int"
#      integer_bits = 64
#    } # outpkts

#    total_packets = {
#      default = false
#      type = "int"
#      integer_bits = 64
#    } # total_packets

    repeat_count = {
      default = false
      type = "int"
      integer_bits = 32
    } # repeat_count

    unique_source_ips = {
      log_field = "source_ip"
      default = true
      type = "unique"
    } # unique_source_ips

    duration = {
      label = "$lang_stats.field_labels.duration"
      default = false
      requires_log_field = false
      type = "int"
      display_format_type = "duration_milliseconds"
    }

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      source_group = {
        source_zone = true
        source_interface = true
        source_ip = true
        source_port = true
        nat_source_ip = true
        nat_source_port = true
        location = true
        user = true
      } # source_group
      destination_group = {
        destination_zone = true
        destination_interface = true
        destination_ip = true
        destination_port = true
        nat_destination_ip = true
        nat_destination_port = true
      } # destination_group
      other_group = {
        cat = true
        uri = true
        app = true
        record_id = true
        domain = true
        device_ip = true
        attack = true
        protocol = true
        rule_ver = true
        policy = true
        rule_base = true
        rule_number = true
        action = true
        alert = true
        packet_data = true
        var_enum = true
        miscellaneous = true
      } # other_group

    } # report_groups

    snapons = {

      # Add the standard reports
      add_standard_reports = {
        name = "add_standard_reports"
	label = "add_standard_reports"
	snapon = "add_standard_reports"
      } # add_standard_reports

    } # snapons

  } # create_profile_wizard_options

} # juniper_idp