beta_nessus = { # The name of the log format log.format.format_label = "Nessus Log Format (BETA)" log.miscellaneous.log_data_type = "other" log.miscellaneous.log_format_type = "other" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "^timestamps\\|\\|\\|scan_start\\|" # The format of dates and times in this log log.format.date_format = "mmm dd hh:mm:ss yyyy" log.format.time_format = "mmm dd hh:mm:ss yyyy" # All log field parsing will be done using the parsing filters # log.format.parse_only_with_filters = "true" # Log fields log.fields = { date_time = "" subnet = "" ip_address.type = "host" service = "" error_code = "" priority = "" message = "" } # log.fields # Log Parsing Filters log.parsing_filters.parse = ` if (matches_regular_expression(current_log_line(), '^timestamps\\|[^|]*\\|[^|]*\\|[^|]*\\|[A-Z][a-z][a-z] ([^|]*)\\|')) then ( v.date_time = $1; ); else if (matches_regular_expression(current_log_line(), '^results\\|([^|]*)\\|([^|]*)\\|([^|]*)\\|([0-9]+)\\|([^|]*)\\|([^|]*)')) then ( date_time = v.date_time; subnet = $1; ip_address = $2; service = $3; error_code = $4; priority = $5; message = replace_all($6, '\\\\n', ' '); ) ` # Database fields database.fields = { date_time = "" day_of_week = "" hour_of_day = "" subnet = "" ip_address = "" location = "" service = "" error_code = "" priority = "" message = "" } # database.fields database.numerical_fields = { events = { label = "$lang_stats.field_labels.events" default = true requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # events } # database.numerical_fields log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'events = 1;' } # mark_entry } # log.filters create_profile_wizard_options = { date_time_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" subnet = true ip_address = true location = true service = true error_code = true priority = true message = true } # report_groups } # create_profile_wizard_options } # beta_nessus