1400_zeek_convert.conf

# Copyright (c) 2025 Battelle Energy Alliance, LLC.  All rights reserved.

filter {

  # set data types for fields that belong to various zeek logs


  # convert all zeek "time" types (minus zeek.ts, which was done earlier)
  # https://docs.zeek.org/en/current/script-reference/types.html#type-time

  if ([zeek][files][ftime]) {
    if ([zeek][files][ftime] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_files_ftime_zero"
               remove_field => [ "[zeek][files][ftime]" ] }
    } else {
      date {
        id => "date_zeek_files_ftime"
        match => [ "[zeek][files][ftime]", "UNIX" ]
        target => "[zeek][files][ftime]"
      }
    }
  }

  if ([zeek][kerberos][from]) {
    if ([zeek][kerberos][from] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_kerberos_from_zero"
               remove_field => [ "[zeek][kerberos][from]" ] }
    } else {
      date {
        id => "date_zeek_kerberos_from"
        match => [ "[zeek][kerberos][from]", "UNIX" ]
        target => "[zeek][kerberos][from]"
      }
    }
  }

  if ([zeek][kerberos][till]) {
    if ([zeek][kerberos][till] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_kerberos_till_zero"
               remove_field => [ "[zeek][kerberos][till]" ] }
    } else {
      date {
        id => "date_zeek_kerberos_till"
        match => [ "[zeek][kerberos][till]", "UNIX" ]
        target => "[zeek][kerberos][till]"
      }
    }
  }

  if ([zeek][ntp][org_time]) {
    if ([zeek][ntp][org_time] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_ntp_org_time_zero"
               remove_field => [ "[zeek][ntp][org_time]" ] }
    } else {
      date {
        id => "date_zeek_ntp_org_time"
        match => [ "[zeek][ntp][org_time]", "UNIX" ]
        target => "[zeek][ntp][org_time]"
      }
    }
  }

  if ([zeek][ntp][rec_time]) {
    if ([zeek][ntp][rec_time] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_ntp_rec_time_zero"
               remove_field => [ "[zeek][ntp][rec_time]" ] }
    } else {
      date {
        id => "date_zeek_ntp_rec_time"
        match => [ "[zeek][ntp][rec_time]", "UNIX" ]
        target => "[zeek][ntp][rec_time]"
      }
    }
  }

  if ([zeek][ntp][ref_time]) {
    if ([zeek][ntp][ref_time] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_ntp_ref_time_zero"
               remove_field => [ "[zeek][ntp][ref_time]" ] }
    } else {
      date {
        id => "date_zeek_ntp_ref_time"
        match => [ "[zeek][ntp][ref_time]", "UNIX" ]
        target => "[zeek][ntp][ref_time]"
      }
    }
  }

  if ([zeek][ntp][xmt_time]) {
    if ([zeek][ntp][xmt_time] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_ntp_xmt_time_zero"
               remove_field => [ "[zeek][ntp][xmt_time]" ] }
    } else {
      date {
        id => "date_zeek_ntp_xmt_time"
        match => [ "[zeek][ntp][xmt_time]", "UNIX" ]
        target => "[zeek][ntp][xmt_time]"
      }
    }
  }

  if ([zeek][ocsp][nextUpdate]) {
    if ([zeek][ocsp][nextUpdate] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_ocsp_nextUpdate_zero"
               remove_field => [ "[zeek][ocsp][nextUpdate]" ] }
    } else {
      date {
        id => "date_zeek_ocsp_nextUpdate"
        match => [ "[zeek][ocsp][nextUpdate]", "UNIX" ]
        target => "[zeek][ocsp][nextUpdate]"
      }
    }
  }

  if ([zeek][ocsp][revoketime]) {
    if ([zeek][ocsp][revoketime] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_ocsp_revoketime_zero"
               remove_field => [ "[zeek][ocsp][revoketime]" ] }
    } else {
      date {
        id => "date_zeek_ocsp_revoketime"
        match => [ "[zeek][ocsp][revoketime]", "UNIX" ]
        target => "[zeek][ocsp][revoketime]"
      }
    }
  }

  if ([zeek][ocsp][thisUpdate]) {
    if ([zeek][ocsp][thisUpdate] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_ocsp_thisUpdate_zero"
               remove_field => [ "[zeek][ocsp][thisUpdate]" ] }
    } else {
      date {
        id => "date_zeek_ocsp_thisUpdate"
        match => [ "[zeek][ocsp][thisUpdate]", "UNIX" ]
        target => "[zeek][ocsp][thisUpdate]"
      }
    }
  }

  if ([zeek][omron_fins_detail][clock_time]) {
    if ([zeek][omron_fins_detail][clock_time] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_omron_fins_detail_clock_time_zero"
               remove_field => [ "[zeek][omron_fins_detail][clock_time]" ] }
    } else {
      date {
        id => "date_zeek_omron_fins_detail_clock_time"
        match => [ "[zeek][omron_fins_detail][clock_time]", "UNIX" ]
        target => "[zeek][omron_fins_detail][clock_time]"
      }
    }
  }

  if ([zeek][omron_fins_detail][date]) {
    if ([zeek][omron_fins_detail][date] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_omron_fins_detail_date_zero"
               remove_field => [ "[zeek][omron_fins_detail][date]" ] }
    } else {
      date {
        id => "date_zeek_omron_fins_detail_date"
        match => [ "[zeek][omron_fins_detail][date]", "UNIX" ]
        target => "[zeek][omron_fins_detail][date]"
      }
    }
  }

  if ([zeek][opcua_binary][req_hdr_timestamp]) {
    if ([zeek][opcua_binary][req_hdr_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_req_hdr_timestamp"
               remove_field => [ "[zeek][opcua_binary][req_hdr_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_req_hdr_timestamp"
        match => [ "[zeek][opcua_binary][req_hdr_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary][req_hdr_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary][res_hdr_timestamp]) {
    if ([zeek][opcua_binary][res_hdr_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_res_hdr_timestamp"
               remove_field => [ "[zeek][opcua_binary][res_hdr_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_res_hdr_timestamp"
        match => [ "[zeek][opcua_binary][res_hdr_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary][res_hdr_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary_aggregate_filter][revised_start_time]) {
    if ([zeek][opcua_binary_aggregate_filter][revised_start_time] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_aggregate_filter_revised_start_time"
               remove_field => [ "[zeek][opcua_binary_aggregate_filter][revised_start_time]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_aggregate_filter_revised_start_time"
        match => [ "[zeek][opcua_binary_aggregate_filter][revised_start_time]", "UNIX" ]
        target => "[zeek][opcua_binary_aggregate_filter][revised_start_time]"
      }
    }
  }

  if ([zeek][opcua_binary_aggregate_filter][start_time]) {
    if ([zeek][opcua_binary_aggregate_filter][start_time] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_aggregate_filter_start_time"
               remove_field => [ "[zeek][opcua_binary_aggregate_filter][start_time]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_aggregate_filter_start_time"
        match => [ "[zeek][opcua_binary_aggregate_filter][start_time]", "UNIX" ]
        target => "[zeek][opcua_binary_aggregate_filter][start_time]"
      }
    }
  }

  if ([zeek][opcua_binary_browse][browse_view_description_timestamp]) {
    if ([zeek][opcua_binary_browse][browse_view_description_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_browse_browse_view_description_timestamp"
               remove_field => [ "[zeek][opcua_binary_browse][browse_view_description_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_browse_browse_view_description_timestamp"
        match => [ "[zeek][opcua_binary_browse][browse_view_description_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary_browse][browse_view_description_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary_opensecure_channel][sec_token_created_at]) {
    if ([zeek][opcua_binary_opensecure_channel][sec_token_created_at] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_opensecure_channel_sec_token_created_at"
               remove_field => [ "[zeek][opcua_binary_opensecure_channel][sec_token_created_at]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_opensecure_channel_sec_token_created_at"
        match => [ "[zeek][opcua_binary_opensecure_channel][sec_token_created_at]", "UNIX" ]
        target => "[zeek][opcua_binary_opensecure_channel][sec_token_created_at]"
      }
    }
  }

  if ([zeek][opcua_binary_read_results][server_timestamp]) {
    if ([zeek][opcua_binary_read_results][server_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_read_results_server_timestamp"
               remove_field => [ "[zeek][opcua_binary_read_results][server_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_read_results_server_timestamp"
        match => [ "[zeek][opcua_binary_read_results][server_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary_read_results][server_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary_read_results][source_timestamp]) {
    if ([zeek][opcua_binary_read_results][source_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_read_results_source_timestamp"
               remove_field => [ "[zeek][opcua_binary_read_results][source_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_read_results_source_timestamp"
        match => [ "[zeek][opcua_binary_read_results][source_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary_read_results][source_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary_variant_data][variant_data_value_time]) {
    if ([zeek][opcua_binary_variant_data][variant_data_value_time] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_variant_data_variant_data_value_time"
               remove_field => [ "[zeek][opcua_binary_variant_data][variant_data_value_time]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_variant_data_variant_data_value_time"
        match => [ "[zeek][opcua_binary_variant_data][variant_data_value_time]", "UNIX" ]
        target => "[zeek][opcua_binary_variant_data][variant_data_value_time]"
      }
    }
  }

  if ([zeek][opcua_binary_variant_data_value][server_timestamp]) {
    if ([zeek][opcua_binary_variant_data_value][server_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_variant_data_value_server_timestamp"
               remove_field => [ "[zeek][opcua_binary_variant_data_value][server_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_variant_data_value_server_timestamp"
        match => [ "[zeek][opcua_binary_variant_data_value][server_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary_variant_data_value][server_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary_variant_data_value][source_timestamp]) {
    if ([zeek][opcua_binary_variant_data_value][source_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_variant_data_value_source_timestamp"
               remove_field => [ "[zeek][opcua_binary_variant_data_value][source_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_variant_data_value_source_timestamp"
        match => [ "[zeek][opcua_binary_variant_data_value][source_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary_variant_data_value][source_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary_write][server_timestamp]) {
    if ([zeek][opcua_binary_write][server_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_write_server_timestamp"
               remove_field => [ "[zeek][opcua_binary_write][server_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_write_server_timestamp"
        match => [ "[zeek][opcua_binary_write][server_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary_write][server_timestamp]"
      }
    }
  }

  if ([zeek][opcua_binary_write][source_timestamp]) {
    if ([zeek][opcua_binary_write][source_timestamp] == "0.000000") {
      mutate { id => "mutate_remove_zeek_opcua_binary_write_source_timestamp"
               remove_field => [ "[zeek][opcua_binary_write][source_timestamp]" ] }
    } else {
      date {
        id => "date_zeek_zeek_opcua_binary_write_source_timestamp"
        match => [ "[zeek][opcua_binary_write][source_timestamp]", "UNIX" ]
        target => "[zeek][opcua_binary_write][source_timestamp]"
      }
    }
  }

  if ([zeek][pe][compile_ts]) {
    if ([zeek][pe][compile_ts] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_pe_compile_ts_zero"
               remove_field => [ "[zeek][pe][compile_ts]" ] }
    } else {
      date {
        id => "date_zeek_pe_compile_ts"
        match => [ "[zeek][pe][compile_ts]", "UNIX" ]
        target => "[zeek][pe][compile_ts]"
      }
    }
  }

  if ([zeek][smb_files][times_accessed]) {
    if ([zeek][smb_files][times_accessed] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_smb_files_times_accessed_zero"
               remove_field => [ "[zeek][smb_files][times_accessed]" ] }
    } else {
      date {
        id => "date_zeek_smb_files_times_accessed"
        match => [ "[zeek][smb_files][times_accessed]", "UNIX" ]
        target => "[zeek][smb_files][times_accessed]"
      }
    }
  }

  if ([zeek][smb_files][times_changed]) {
    if ([zeek][smb_files][times_changed] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_smb_files_times_changed_zero"
               remove_field => [ "[zeek][smb_files][times_changed]" ] }
    } else {
      date {
        id => "date_zeek_smb_files_times_changed"
        match => [ "[zeek][smb_files][times_changed]", "UNIX" ]
        target => "[zeek][smb_files][times_changed]"
      }
    }
  }

  if ([zeek][smb_files][times_created]) {
    if ([zeek][smb_files][times_created] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_smb_files_times_created_zero"
               remove_field => [ "[zeek][smb_files][times_created]" ] }
    } else {
      date {
        id => "date_zeek_smb_files_times_created"
        match => [ "[zeek][smb_files][times_created]", "UNIX" ]
        target => "[zeek][smb_files][times_created]"
      }
    }
  }

  if ([zeek][smb_files][times_modified]) {
    if ([zeek][smb_files][times_modified] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_smb_files_times_modified_zero"
               remove_field => [ "[zeek][smb_files][times_modified]" ] }
    } else {
      date {
        id => "date_zeek_smb_files_times_modified"
        match => [ "[zeek][smb_files][times_modified]", "UNIX" ]
        target => "[zeek][smb_files][times_modified]"
      }
    }
  }

  if ([zeek][smb_files][ts]) {
    if ([zeek][smb_files][ts] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_smb_files_ts_zero"
               remove_field => [ "[zeek][smb_files][ts]" ] }
    } else {
      date {
        id => "date_zeek_smb_files_ts"
        match => [ "[zeek][smb_files][ts]", "UNIX" ]
        target => "[zeek][smb_files][ts]"
      }
    }
  }

  if ([zeek][snmp][up_since]) {
    if ([zeek][snmp][up_since] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_snmp_up_since_zero"
               remove_field => [ "[zeek][snmp][up_since]" ] }
    } else {
      date {
        id => "date_zeek_snmp_up_since"
        match => [ "[zeek][snmp][up_since]", "UNIX" ]
        target => "[zeek][snmp][up_since]"
      }
    }
  }

  if ([zeek][synchrophasor][header_time_stamp]) {
    if ([zeek][synchrophasor][header_time_stamp] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_synchrophasor_header_time_stamp"
               remove_field => [ "[zeek][synchrophasor][header_time_stamp]" ] }
    } else {
      date {
        id => "date_zeek_synchrophasor_header_time_stamp"
        match => [ "[zeek][synchrophasor][header_time_stamp]", "UNIX" ]
        target => "[zeek][synchrophasor][header_time_stamp]"
      }
    }
  }

  if ([zeek][x509][certificate_not_valid_after]) {
    if ([zeek][x509][certificate_not_valid_after] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_x509_certificate_not_valid_after_zero"
               remove_field => [ "[zeek][x509][certificate_not_valid_after]" ] }
    } else {
      date {
        id => "date_zeek_x509_certificate_not_valid_after"
        match => [ "[zeek][x509][certificate_not_valid_after]", "UNIX" ]
        target => "[zeek][x509][certificate_not_valid_after]"
      }
    }
  }

  if ([zeek][x509][certificate_not_valid_before]) {
    if ([zeek][x509][certificate_not_valid_before] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_x509_certificate_not_valid_before_zero"
               remove_field => [ "[zeek][x509][certificate_not_valid_before]" ] }
    } else {
      date {
        id => "date_zeek_x509_certificate_not_valid_before"
        match => [ "[zeek][x509][certificate_not_valid_before]", "UNIX" ]
        target => "[zeek][x509][certificate_not_valid_before]"
      }
    }
  }

  # these hart IP date/time fields are not actually Zeek values yet, so track https://github.com/cisagov/icsnpp-hart-ip/issues/15
  # and adjust this appropriately once that is fixed

  if ([zeek][hart_ip][read_audit_log_power_up_time]) {
    if ([zeek][hart_ip][read_audit_log_power_up_time] == "0") {
      mutate { id => "mutate_remove_field_zeek_hart_ip_read_audit_log_power_up_time"
               remove_field => [ "[zeek][hart_ip][read_audit_log_power_up_time]" ] }
    } else {
      date {
        id => "date_zeek_hart_ip_read_audit_log_power_up_time"
        match => [ "[zeek][hart_ip][read_audit_log_power_up_time]", "UNIX" ]
        target => "[zeek][hart_ip][read_audit_log_power_up_time]"
      }
    }
  }
  if ([zeek][hart_ip][read_audit_log_last_security_change]) {
    if ([zeek][hart_ip][read_audit_log_last_security_change] == "0") {
      mutate { id => "mutate_remove_field_zeek_hart_ip_read_audit_log_last_security_change"
               remove_field => [ "[zeek][hart_ip][read_audit_log_last_security_change]" ] }
    } else {
      date {
        id => "date_zeek_hart_ip_read_audit_log_last_security_change"
        match => [ "[zeek][hart_ip][read_audit_log_last_security_change]", "UNIX" ]
        target => "[zeek][hart_ip][read_audit_log_last_security_change]"
      }
    }
  }
  if ([zeek][hart_ip_session_record][session_log_record_connect_time]) {
    if ([zeek][hart_ip_session_record][session_log_record_connect_time] == "0") {
      mutate { id => "mutate_remove_field_zeek_hart_ip_session_record_session_log_record_connect_time"
               remove_field => [ "[zeek][hart_ip_session_record][session_log_record_connect_time]" ] }
    } else {
      date {
        id => "date_zeek_hart_ip_session_record_session_log_record_connect_time"
        match => [ "[zeek][hart_ip_session_record][session_log_record_connect_time]", "UNIX" ]
        target => "[zeek][hart_ip_session_record][session_log_record_connect_time]"
      }
    }
  }
  if ([zeek][hart_ip_session_record][session_log_record_disconnect_time]) {
    if ([zeek][hart_ip_session_record][session_log_record_disconnect_time] == "0") {
      mutate { id => "mutate_remove_field_zeek_hart_ip_session_record_session_log_record_disconnect_time"
               remove_field => [ "[zeek][hart_ip_session_record][session_log_record_disconnect_time]" ] }
    } else {
      date {
        id => "date_zeek_hart_ip_session_record_session_log_record_disconnect_time"
        match => [ "[zeek][hart_ip_session_record][session_log_record_disconnect_time]", "UNIX" ]
        target => "[zeek][hart_ip_session_record][session_log_record_disconnect_time]"
      }
    }
  }

  if ([zeek][intel][cif_firstseen]) {
    if ([zeek][intel][cif_firstseen] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_intel_cif_firstseen_zero"
               remove_field => [ "[zeek][intel][cif_firstseen]" ] }
    } else {
      date {
        id => "date_zeek_intel_cif_firstseen"
        match => [ "[zeek][intel][cif_firstseen]", "UNIX" ]
        target => "[threat][indicator][first_seen]"
        remove_field => [ "[zeek][intel][cif_firstseen]" ]
      }
    }
  }
  if ([zeek][intel][cif_lastseen]) {
    if ([zeek][intel][cif_lastseen] == "0.000000") {
      mutate { id => "mutate_remove_field_zeek_intel_cif_lastseen_zero"
               remove_field => [ "[zeek][intel][cif_lastseen]" ] }
    } else {
      date {
        id => "date_zeek_intel_cif_lastseen"
        match => [ "[zeek][intel][cif_lastseen]", "UNIX" ]
        target => "[threat][indicator][last_seen]"
        remove_field => [ "[zeek][intel][cif_lastseen]" ]
      }
    }
  }

}