type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: [".gz$"]
tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

json.keys_under_root: false

fields_under_root: true
fields:
  network.transport: tcp
  network.protocol: kerberos

processors:
  - rename:
      fields:
        - from: "json"
          to: "zeek.kerberos"

        - from: "zeek.kerberos.id.orig_h"
          to: "source.address"

        - from: "zeek.kerberos.id.orig_p"
          to: "source.port"

        - from: "zeek.kerberos.id.resp_h"
          to: "destination.address"

        - from: "zeek.kerberos.id.resp_p"
          to: "destination.port"

        - from: "zeek.kerberos.uid"
          to: "zeek.session_id"

        - from: "zeek.kerberos.till"
          to: "zeek.kerberos.valid.until"

        - from: "zeek.kerberos.from"
          to: "zeek.kerberos.valid.from"

        - from: "zeek.kerberos.error_code"
          to: "zeek.kerberos.error.code"

        - from: "zeek.kerberos.error_msg"
          to: "zeek.kerberos.error.msg"

        - from: "zeek.kerberos.cert.client"
          to: "zeek.kerberos.cert.client.value"

        - from: "zeek.kerberos.cert.client_subject"
          to: "zeek.kerberos.cert.client.subject"

        - from: "zeek.kerberos.cert.client_fuid"
          to: "zeek.kerberos.cert.client.fuid"

        - from: "zeek.kerberos.cert.server"
          to: "zeek.kerberos.cert.server.value"

        - from: "zeek.kerberos.cert.server_subject"
          to: "zeek.kerberos.cert.server.subject"

        - from: "zeek.kerberos.cert.server_fuid"
          to: "zeek.kerberos.cert.server.fuid"

        - from: "zeek.kerberos.auth_ticket"
          to: "zeek.kerberos.ticket.auth"

        - from: "zeek.kerberos.new_ticket"
          to: "zeek.kerberos.ticket.new"

      ignore_missing: true
      fail_on_error: false
  - convert:
      fields:
        - {from: "zeek.session_id", to: "event.id"}
        - {from: "source.address", to: "source.ip", type: "ip"}
        - {from: "source.address", to: "client.address"}
        - {from: "destination.address", to: "destination.ip", type: "ip"}
        - {from: "destination.address", to: "server.address"}
        - {from: "zeek.kerberos.request_type", to: "event.action"}
      ignore_missing: true
      fail_on_error: false
  - add_fields:
      target: event
      fields:
        kind: event
        category:
          - network
        type:
          - connection
          - protocol
          - authentication
  - dissect:
      when:
        contains:
          zeek.kerberos.client: "/"
      tokenizer: "%{user.name}/%{user.domain}"
      field: zeek.kerberos.client
      target_prefix: ""
  - community_id:
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.9.0
