barrier_group = {

  plugin_version = "1.1"

  # 2006-03-28: 1.1beta: various improvements:
  #                      1. Detected By is now Detector
  #                      2. Reports are grouped in the left menu (please suggest an alternative grouping if you wish).
  #                      3. 0/1 values have been changed to true/false
  #                      4. All fields with 0/1 values now have corresponding numerical fields, which appear in all reports.
  # 2006-03-31: 1.1: renumbered to remove beta after testing by Barrier Group.


  # The name of the log format
  log.format.format_label = "Barrier Group Log Format"
  log.miscellaneous.log_data_type = "firewall"  
  log.miscellaneous.log_format_type = "firewall"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^Source,Priority,Detected By,Description,Event Date/Time,Event Protocol,Source IP,Source Port,Source URL,Source MAC,Internal Source"

  log.format.field_separator = ","  
  log.format.ignore_format_lines = "true"

  # Log fields
  log.fields = {

#    source.index = 1
    priority.index = 2
    detector.index = 3
    description.index = 4
    event_date_time.index = 5
    event_protocol.index = 6
    source_ip = {
      type = "host"
      index = 7
    }
    source_port.index = 8

    source_url = {
      type = "hierarchical"
      hierarchy_dividers = "/"
      left_to_right = true
      leading_divider = false
      index = 9
    }

    source_mac.index = 10
    internal_source.index = 11
    blocked_source.index = 12
    dest_ip.index = 13
    dest_port.index = 14

    dest_url = {
      type = "hierarchical"
      hierarchy_dividers = "/"
      left_to_right = true
      leading_divider = false
      index = 15
    }

    dest_mac.index = 16
    internal_dest.index = 17
    blocked_dest.index = 18
    good_host.index = 19
    bad_host.index = 20

    date = ""
    time = ""

    internal_sources = ""
    blocked_sources = ""
    internal_destinations = ""
    blocked_destinations = ""
    good_hosts = ""
    bad_hosts = ""

    events = ""
  
  } # log.fields


log.parsing_filters.parse = `
if (matches_regular_expression(event_date_time, '^([0-9/]+) ([0-9:]+)')) then (
  date = $1;
  time = $2;
);

# Categorize internal sources
internal_sources = internal_source;
internal_source = if (internal_source == 1) then "true" else "false";

# Categorize blocked sources
blocked_sources = blocked_source;
blocked_source = if (blocked_source == 1) then "true" else "false";

# Categorize internal destinations
internal_destinations = internal_dest;
internal_dest = if (internal_dest == 1) then "true" else "false";

# Categorize blocked destinations
blocked_destinations = blocked_dest;
blocked_dest = if (blocked_dest == 1) then "true" else "false";

# Categorize good hosts
good_hosts = good_host;
good_host = if (good_host == 1) then "true" else "false";

# Categorize bad hosts
bad_hosts = bad_host;
bad_host = if (bad_host == 1) then "true" else "false";

events = 1;
`


  # Database fields
  database.fields = {

    date_time = ""
    day_of_week = ""
    hour_of_day = ""

#    source = ""
    priority = ""
    detector = ""
    description = ""
    event_protocol = ""
    source_ip = ""
    location = ""
    source_port = ""
    source_url = ""
    source_mac = ""
    internal_source = ""
    blocked_source = ""
    dest_ip = ""
    dest_port = ""
    dest_url = ""
    dest_mac = ""
    internal_dest = ""
    blocked_dest = ""
    good_host = ""
    bad_host = ""

  } # database.fields


  database.numerical_fields = {

    events.default = true

    internal_sources = ""
    blocked_sources = ""
    internal_destinations = ""
    blocked_destinations = ""
    good_hosts = ""
    bad_hosts = ""

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {

      date_time_group = ""

      source_group = {
#        source = true
        source_ip = true
        location = true
        source_port = true
        source_url = true
        source_mac = true
        internal_source = true
        blocked_source = true
      }

      destination_group = {
        dest_ip = true
        dest_port = true
        dest_url = true
        dest_mac = true
        internal_dest = true
        blocked_dest = true
      }

      other_group = {
        priority = true
        detector = true
        description = true
        event_protocol = true
        good_host = true
        bad_host = true
      }

    } # report_groups

  } # create_profile_wizard_options

} # barrier_group