PNG  IHDRQgAMA a cHRMz&u0`:pQ<bKGDgmIDATxwUﹻ& ^CX(J I@ "% (** BX +*i"]j(IH{~R)[~>h{}gy)I$Ij .I$I$ʊy@}x.: $I$Ii}VZPC)I$IF ^0ʐJ$I$Q^}{"r=OzI$gRZeC.IOvH eKX $IMpxsk.쒷/&r[޳<v| .I~)@$updYRa$I |M.e JaֶpSYR6j>h%IRز if&uJ)M$I vLi=H;7UJ,],X$I1AҒJ$ XY XzI@GNҥRT)E@;]K*Mw;#5_wOn~\ DC&$(A5 RRFkvIR}l!RytRl;~^ǷJj اy뷦BZJr&ӥ8Pjw~vnv X^(I;4R=P[3]J,]ȏ~:3?[ a&e)`e*P[4]T=Cq6R[ ~ޤrXR Հg(t_HZ-Hg M$ãmL5R uk*`%C-E6/%[t X.{8P9Z.vkXŐKjgKZHg(aK9ڦmKjѺm_ \#$5,)-  61eJ,5m| r'= &ڡd%-]J on Xm|{ RҞe $eڧY XYrԮ-a7RK6h>n$5AVڴi*ֆK)mѦtmr1p| q:흺,)Oi*ֺK)ܬ֦K-5r3>0ԔHjJئEZj,%re~/z%jVMڸmrt)3]J,T K֦OvԒgii*bKiNO~%PW0=dii2tJ9Jݕ{7"I P9JKTbu,%r"6RKU}Ij2HKZXJ,妝 XYrP ެ24c%i^IK|.H,%rb:XRl1X4Pe/`x&P8Pj28Mzsx2r\zRPz4J}yP[g=L) .Q[6RjWgp FIH*-`IMRaK9TXcq*I y[jE>cw%gLRԕiFCj-ďa`#e~I j,%r,)?[gp FI˨mnWX#>mʔ XA DZf9,nKҲzIZXJ,L#kiPz4JZF,I,`61%2s $,VOϚ2/UFJfy7K> X+6 STXIeJILzMfKm LRaK9%|4p9LwJI!`NsiazĔ)%- XMq>pk$-$Q2x#N ؎-QR}ᶦHZډ)J,l#i@yn3LN`;nڔ XuX5pF)m|^0(>BHF9(cզEerJI rg7 4I@z0\JIi䵙RR0s;$s6eJ,`n 䂦0a)S)A 1eJ,堌#635RIgpNHuTH_SԕqVe ` &S)>p;S$魁eKIuX`I4춒o}`m$1":PI<[v9^\pTJjriRŭ P{#{R2,`)e-`mgj~1ϣLKam7&U\j/3mJ,`F;M'䱀 .KR#)yhTq;pcK9(q!w?uRR,n.yw*UXj#\]ɱ(qv2=RqfB#iJmmL<]Y͙#$5 uTU7ӦXR+q,`I}qL'`6Kͷ6r,]0S$- [RKR3oiRE|nӦXR.(i:LDLTJjY%o:)6rxzҒqTJjh㞦I.$YR.ʼnGZ\ֿf:%55 I˼!6dKxm4E"mG_ s? .e*?LRfK9%q#uh$)i3ULRfK9yxm܌bj84$i1U^@Wbm4uJ,ҪA>_Ij?1v32[gLRD96oTaR׿N7%L2 NT,`)7&ƝL*꽙yp_$M2#AS,`)7$rkTA29_Iye"|/0t)$n XT2`YJ;6Jx".e<`$) PI$5V4]29SRI>~=@j]lp2`K9Jaai^" Ԋ29ORI%:XV5]JmN9]H;1UC39NI%Xe78t)a;Oi Ҙ>Xt"~G>_mn:%|~ޅ_+]$o)@ǀ{hgN;IK6G&rp)T2i୦KJuv*T=TOSV>(~D>dm,I*Ɛ:R#ۙNI%D>G.n$o;+#RR!.eU˽TRI28t)1LWϚ>IJa3oFbu&:tJ*(F7y0ZR ^p'Ii L24x| XRI%ۄ>S1]Jy[zL$adB7.eh4%%누>WETf+3IR:I3Xה)3אOۦSRO'ٺ)S}"qOr[B7ϙ.edG)^ETR"RtRݜh0}LFVӦDB^k_JDj\=LS(Iv─aTeZ%eUAM-0;~˃@i|l @S4y72>sX-vA}ϛBI!ݎߨWl*)3{'Y|iSlEڻ(5KtSI$Uv02,~ԩ~x;P4ցCrO%tyn425:KMlD ^4JRxSهF_}شJTS6uj+ﷸk$eZO%G*^V2u3EMj3k%)okI]dT)URKDS 7~m@TJR~荪fT"֛L \sM -0T KfJz+nإKr L&j()[E&I ߴ>e FW_kJR|!O:5/2跌3T-'|zX ryp0JS ~^F>-2< `*%ZFP)bSn"L :)+pʷf(pO3TMW$~>@~ū:TAIsV1}S2<%ޟM?@iT ,Eūoz%i~g|`wS(]oȤ8)$ ntu`өe`6yPl IzMI{ʣzʨ )IZ2= ld:5+請M$-ї;U>_gsY$ÁN5WzWfIZ)-yuXIfp~S*IZdt;t>KūKR|$#LcԀ+2\;kJ`]YǔM1B)UbG"IRߊ<xܾӔJ0Z='Y嵤 Leveg)$znV-º^3Ւof#0Tfk^Zs[*I꯳3{)ˬW4Ւ4 OdpbZRS|*I 55#"&-IvT&/윚Ye:i$ 9{LkuRe[I~_\ؠ%>GL$iY8 9ܕ"S`kS.IlC;Ҏ4x&>u_0JLr<J2(^$5L s=MgV ~,Iju> 7r2)^=G$1:3G< `J3~&IR% 6Tx/rIj3O< ʔ&#f_yXJiގNSz; Tx(i8%#4 ~AS+IjerIUrIj362v885+IjAhK__5X%nV%Iͳ-y|7XV2v4fzo_68"S/I-qbf; LkF)KSM$ Ms>K WNV}^`-큧32ŒVؙGdu,^^m%6~Nn&͓3ŒVZMsRpfEW%IwdǀLm[7W&bIRL@Q|)* i ImsIMmKmyV`i$G+R 0tV'!V)֏28vU7͒vHꦼtxꗞT ;S}7Mf+fIRHNZUkUx5SAJㄌ9MqμAIRi|j5)o*^'<$TwI1hEU^c_j?Е$%d`z cyf,XO IJnTgA UXRD }{H}^S,P5V2\Xx`pZ|Yk:$e ~ @nWL.j+ϝYb퇪bZ BVu)u/IJ_ 1[p.p60bC >|X91P:N\!5qUB}5a5ja `ubcVxYt1N0Zzl4]7­gKj]?4ϻ *[bg$)+À*x쳀ogO$~,5 زUS9 lq3+5mgw@np1sso Ӻ=|N6 /g(Wv7U;zωM=wk,0uTg_`_P`uz?2yI!b`kĸSo+Qx%!\οe|އԁKS-s6pu_(ֿ$i++T8=eY; צP+phxWQv*|p1. ά. XRkIQYP,drZ | B%wP|S5`~́@i޾ E;Չaw{o'Q?%iL{u D?N1BD!owPHReFZ* k_-~{E9b-~P`fE{AܶBJAFO wx6Rox5 K5=WwehS8 (JClJ~ p+Fi;ŗo+:bD#g(C"wA^ r.F8L;dzdIHUX݆ϞXg )IFqem%I4dj&ppT{'{HOx( Rk6^C٫O.)3:s(۳(Z?~ٻ89zmT"PLtw䥈5&b<8GZ-Y&K?e8,`I6e(֍xb83 `rzXj)F=l($Ij 2*(F?h(/9ik:I`m#p3MgLaKjc/U#n5S# m(^)=y=đx8ŬI[U]~SцA4p$-F i(R,7Cx;X=cI>{Km\ o(Tv2vx2qiiDJN,Ҏ!1f 5quBj1!8 rDFd(!WQl,gSkL1Bxg''՞^ǘ;pQ P(c_ IRujg(Wz bs#P­rz> k c&nB=q+ؔXn#r5)co*Ũ+G?7< |PQӣ'G`uOd>%Mctz# Ԫڞ&7CaQ~N'-P.W`Oedp03C!IZcIAMPUۀ5J<\u~+{9(FbbyAeBhOSܳ1 bÈT#ŠyDžs,`5}DC-`̞%r&ڙa87QWWp6e7 Rϫ/oY ꇅ Nܶըtc!LA T7V4Jsū I-0Pxz7QNF_iZgúWkG83 0eWr9 X]㾮݁#Jˢ C}0=3ݱtBi]_ &{{[/o[~ \q鯜00٩|cD3=4B_b RYb$óBRsf&lLX#M*C_L܄:gx)WΘsGSbuL rF$9';\4Ɍq'n[%p.Q`u hNb`eCQyQ|l_C>Lb꟟3hSb #xNxSs^ 88|Mz)}:](vbۢamŖ࿥ 0)Q7@0=?^k(*J}3ibkFn HjB׻NO z x}7p 0tfDX.lwgȔhԾŲ }6g E |LkLZteu+=q\Iv0쮑)QٵpH8/2?Σo>Jvppho~f>%bMM}\//":PTc(v9v!gոQ )UfVG+! 35{=x\2+ki,y$~A1iC6#)vC5^>+gǵ@1Hy٪7u;p psϰu/S <aʸGu'tD1ԝI<pg|6j'p:tպhX{o(7v],*}6a_ wXRk,O]Lܳ~Vo45rp"N5k;m{rZbΦ${#)`(Ŵg,;j%6j.pyYT?}-kBDc3qA`NWQū20/^AZW%NQ MI.X#P#,^Ebc&?XR tAV|Y.1!؅⨉ccww>ivl(JT~ u`ٵDm q)+Ri x/x8cyFO!/*!/&,7<.N,YDŽ&ܑQF1Bz)FPʛ?5d 6`kQձ λc؎%582Y&nD_$Je4>a?! ͨ|ȎWZSsv8 j(I&yj Jb5m?HWp=g}G3#|I,5v珿] H~R3@B[☉9Ox~oMy=J;xUVoj bUsl_35t-(ՃɼRB7U!qc+x4H_Qo֮$[GO<4`&č\GOc[.[*Af%mG/ ňM/r W/Nw~B1U3J?P&Y )`ѓZ1p]^l“W#)lWZilUQu`-m|xĐ,_ƪ|9i:_{*(3Gѧ}UoD+>m_?VPۅ15&}2|/pIOʵ> GZ9cmíتmnz)yߐbD >e}:) r|@R5qVSA10C%E_'^8cR7O;6[eKePGϦX7jb}OTGO^jn*媓7nGMC t,k31Rb (vyܴʭ!iTh8~ZYZp(qsRL ?b}cŨʊGO^!rPJO15MJ[c&~Z`"ѓޔH1C&^|Ш|rʼ,AwĴ?b5)tLU)F| &g٣O]oqSUjy(x<Ϳ3 .FSkoYg2 \_#wj{u'rQ>o;%n|F*O_L"e9umDds?.fuuQbIWz |4\0 sb;OvxOSs; G%T4gFRurj(֍ڑb uԖKDu1MK{1^ q; C=6\8FR艇!%\YÔU| 88m)֓NcLve C6z;o&X x59:q61Z(T7>C?gcļxѐ Z oo-08jہ x,`' ҔOcRlf~`jj".Nv+sM_]Zk g( UOPyεx%pUh2(@il0ݽQXxppx-NS( WO+轾 nFߢ3M<;z)FBZjciu/QoF 7R¥ ZFLF~#ȣߨ^<쩡ݛкvџ))ME>ώx4m#!-m!L;vv#~Y[đKmx9.[,UFS CVkZ +ߟrY٧IZd/ioi$%͝ب_ֶX3ܫhNU ZZgk=]=bbJS[wjU()*I =ώ:}-蹞lUj:1}MWm=̛ _ ¾,8{__m{_PVK^n3esw5ӫh#$-q=A̟> ,^I}P^J$qY~Q[ Xq9{#&T.^GVj__RKpn,b=`żY@^՝;z{paVKkQXj/)y TIc&F;FBG7wg ZZDG!x r_tƢ!}i/V=M/#nB8 XxЫ ^@CR<{䤭YCN)eKOSƟa $&g[i3.C6xrOc8TI;o hH6P&L{@q6[ Gzp^71j(l`J}]e6X☉#͕ ׈$AB1Vjh㭦IRsqFBjwQ_7Xk>y"N=MB0 ,C #o6MRc0|$)ف"1!ixY<B9mx `,tA>)5ػQ?jQ?cn>YZe Tisvh# GMމȇp:ԴVuږ8ɼH]C.5C!UV;F`mbBk LTMvPʍϤj?ԯ/Qr1NB`9s"s TYsz &9S%U԰> {<ؿSMxB|H\3@!U| k']$U+> |HHMLޢ?V9iD!-@x TIî%6Z*9X@HMW#?nN ,oe6?tQwڱ.]-y':mW0#!J82qFjH -`ѓ&M0u Uγmxϵ^-_\])@0Rt.8/?ٰCY]x}=sD3ojަЫNuS%U}ԤwHH>ڗjܷ_3gN q7[q2la*ArǓԖ+p8/RGM ]jacd(JhWko6ڎbj]i5Bj3+3!\j1UZLsLTv8HHmup<>gKMJj0@H%,W΃7R) ">c, xixј^ aܖ>H[i.UIHc U1=yW\=S*GR~)AF=`&2h`DzT󑓶J+?W+}C%P:|0H܆}-<;OC[~o.$~i}~HQ TvXΈr=b}$vizL4:ȰT|4~*!oXQR6Lk+#t/g lԁߖ[Jڶ_N$k*". xsxX7jRVbAAʯKҎU3)zSNN _'s?f)6X!%ssAkʱ>qƷb hg %n ~p1REGMHH=BJiy[<5 ǁJҖgKR*倳e~HUy)Ag,K)`Vw6bRR:qL#\rclK/$sh*$ 6덤 KԖc 3Z9=Ɣ=o>X Ώ"1 )a`SJJ6k(<c e{%kϊP+SL'TcMJWRm ŏ"w)qc ef꒵i?b7b('"2r%~HUS1\<(`1Wx9=8HY9m:X18bgD1u ~|H;K-Uep,, C1 RV.MR5άh,tWO8WC$ XRVsQS]3GJ|12 [vM :k#~tH30Rf-HYݺ-`I9%lIDTm\ S{]9gOڒMNCV\G*2JRŨ;Rҏ^ڽ̱mq1Eu?To3I)y^#jJw^Ńj^vvlB_⋌P4x>0$c>K†Aļ9s_VjTt0l#m>E-,,x,-W)سo&96RE XR.6bXw+)GAEvL)͞K4$p=Ũi_ѱOjb HY/+@θH9޼]Nԥ%n{ &zjT? Ty) s^ULlb,PiTf^<À] 62R^V7)S!nllS6~͝V}-=%* ʻ>G DnK<y&>LPy7'r=Hj 9V`[c"*^8HpcO8bnU`4JȪAƋ#1_\ XϘHPRgik(~G~0DAA_2p|J묭a2\NCr]M_0 ^T%e#vD^%xy-n}-E\3aS%yN!r_{ )sAw ڼp1pEAk~v<:`'ӭ^5 ArXOI驻T (dk)_\ PuA*BY]yB"l\ey hH*tbK)3 IKZ򹞋XjN n *n>k]X_d!ryBH ]*R 0(#'7 %es9??ښFC,ՁQPjARJ\Ρw K#jahgw;2$l*) %Xq5!U᢯6Re] |0[__64ch&_}iL8KEgҎ7 M/\`|.p,~`a=BR?xܐrQ8K XR2M8f ?`sgWS%" Ԉ 7R%$ N}?QL1|-эټwIZ%pvL3Hk>,ImgW7{E xPHx73RA @RS CC !\ȟ5IXR^ZxHл$Q[ŝ40 (>+ _C >BRt<,TrT {O/H+˟Pl6 I B)/VC<6a2~(XwV4gnXR ϱ5ǀHٻ?tw똤Eyxp{#WK qG%5],(0ӈH HZ])ג=K1j&G(FbM@)%I` XRg ʔ KZG(vP,<`[ Kn^ SJRsAʠ5xՅF`0&RbV tx:EaUE/{fi2;.IAwW8/tTxAGOoN?G}l L(n`Zv?pB8K_gI+ܗ #i?ޙ.) p$utc ~DžfՈEo3l/)I-U?aԅ^jxArA ΧX}DmZ@QLےbTXGd.^|xKHR{|ΕW_h] IJ`[G9{).y) 0X YA1]qp?p_k+J*Y@HI>^?gt.06Rn ,` ?);p pSF9ZXLBJPWjgQ|&)7! HjQt<| ؅W5 x W HIzYoVMGP Hjn`+\(dNW)F+IrS[|/a`K|ͻ0Hj{R,Q=\ (F}\WR)AgSG`IsnAR=|8$}G(vC$)s FBJ?]_u XRvύ6z ŨG[36-T9HzpW̞ú Xg큽=7CufzI$)ki^qk-) 0H*N` QZkk]/tnnsI^Gu't=7$ Z;{8^jB% IItRQS7[ϭ3 $_OQJ`7!]W"W,)Iy W AJA;KWG`IY{8k$I$^%9.^(`N|LJ%@$I}ֽp=FB*xN=gI?Q{٥4B)mw $Igc~dZ@G9K X?7)aK%݅K$IZ-`IpC U6$I\0>!9k} Xa IIS0H$I H ?1R.Чj:4~Rw@p$IrA*u}WjWFPJ$I➓/6#! LӾ+ X36x8J |+L;v$Io4301R20M I$-E}@,pS^ޟR[/s¹'0H$IKyfŸfVOπFT*a$I>He~VY/3R/)>d$I>28`Cjw,n@FU*9ttf$I~<;=/4RD~@ X-ѕzἱI$: ԍR a@b X{+Qxuq$IЛzo /~3\8ڒ4BN7$IҀj V]n18H$IYFBj3̵̚ja pp $Is/3R Ӻ-Yj+L;.0ŔI$Av? #!5"aʄj}UKmɽH$IjCYs?h$IDl843.v}m7UiI=&=0Lg0$I4: embe` eQbm0u? $IT!Sƍ'-sv)s#C0:XB2a w I$zbww{."pPzO =Ɔ\[ o($Iaw]`E).Kvi:L*#gР7[$IyGPI=@R 4yR~̮´cg I$I/<tPͽ hDgo 94Z^k盇΄8I56^W$I^0̜N?4*H`237}g+hxoq)SJ@p|` $I%>-hO0eO>\ԣNߌZD6R=K ~n($I$y3D>o4b#px2$yڪtzW~a $I~?x'BwwpH$IZݑnC㧄Pc_9sO gwJ=l1:mKB>Ab<4Lp$Ib o1ZQ@85b̍ S'F,Fe,^I$IjEdù{l4 8Ys_s Z8.x m"+{~?q,Z D!I$ϻ'|XhB)=…']M>5 rgotԎ 獽PH$IjIPhh)n#cÔqA'ug5qwU&rF|1E%I$%]!'3AFD/;Ck_`9 v!ٴtPV;x`'*bQa w I$Ix5 FC3D_~A_#O݆DvV?<qw+I$I{=Z8".#RIYyjǪ=fDl9%M,a8$I$Ywi[7ݍFe$s1ՋBVA?`]#!oz4zjLJo8$I$%@3jAa4(o ;p,,dya=F9ً[LSPH$IJYЉ+3> 5"39aZ<ñh!{TpBGkj}Sp $IlvF.F$I z< '\K*qq.f<2Y!S"-\I$IYwčjF$ w9 \ߪB.1v!Ʊ?+r:^!I$BϹB H"B;L'G[ 4U#5>੐)|#o0aڱ$I>}k&1`U#V?YsV x>{t1[I~D&(I$I/{H0fw"q"y%4 IXyE~M3 8XψL}qE$I[> nD?~sf ]o΁ cT6"?'_Ἣ $I>~.f|'!N?⟩0G KkXZE]ޡ;/&?k OۘH$IRۀwXӨ<7@PnS04aӶp.:@\IWQJ6sS%I$e5ڑv`3:x';wq_vpgHyXZ 3gЂ7{{EuԹn±}$I$8t;b|591nءQ"P6O5i }iR̈́%Q̄p!I䮢]O{H$IRϻ9s֧ a=`- aB\X0"+5"C1Hb?߮3x3&gşggl_hZ^,`5?ߎvĸ%̀M!OZC2#0x LJ0 Gw$I$I}<{Eb+y;iI,`ܚF:5ܛA8-O-|8K7s|#Z8a&><a&/VtbtLʌI$I$I$I$I$I$IRjDD%tEXtdate:create2022-05-31T04:40:26+00:00!Î%tEXtdate:modify2022-05-31T04:40:26+00:00|{2IENDB` sh-3ll

HOME


sh-3ll 1.0
DIR:/proc/self/root/usr/share/filebeat/module/radware/defensepro/config/
Upload File :
Current File : //proc/self/root/usr/share/filebeat/module/radware/defensepro/config/pipeline.js
//  Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
//  or more contributor license agreements. Licensed under the Elastic License;
//  you may not use this file except in compliance with the Elastic License.

function DeviceProcessor() {
	var builder = new processor.Chain();
	builder.Add(save_flags);
	builder.Add(strip_syslog_priority);
	builder.Add(chain1);
	builder.Add(populate_fields);
	builder.Add(restore_flags);
	var chain = builder.Build();
	return {
		process: chain.Run,
	}
}

var dup1 = match("MESSAGE#0:Intrusions:01/0", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} %{id->} %{category->} \"%{event_type}\" %{protocol->} %{p0}");

var dup2 = match("MESSAGE#0:Intrusions:01/1_0", "nwparser.p0", "%{saddr}:%{p0}");

var dup3 = match("MESSAGE#0:Intrusions:01/1_1", "nwparser.p0", "%{saddr->} %{p0}");

var dup4 = match("MESSAGE#0:Intrusions:01/2", "nwparser.p0", "%{sport->} %{p0}");

var dup5 = match("MESSAGE#0:Intrusions:01/3_0", "nwparser.p0", "%{daddr}:%{p0}");

var dup6 = match("MESSAGE#0:Intrusions:01/3_1", "nwparser.p0", "%{daddr->} %{p0}");

var dup7 = match("MESSAGE#0:Intrusions:01/4", "nwparser.p0", "%{dport->} %{interface->} %{context->} \"%{policyname}\" %{event_state->} %{packets->} %{dclass_counter1->} %{vlan->} %{fld15->} %{fld16->} %{risk->} %{p0}");

var dup8 = match("MESSAGE#0:Intrusions:01/5_0", "nwparser.p0", "%{action->} %{sigid_string}");

var dup9 = match_copy("MESSAGE#0:Intrusions:01/5_1", "nwparser.p0", "action");

var dup10 = setc("eventcategory","1001000000");

var dup11 = setc("ec_theme","TEV");

var dup12 = setf("msg","$MSG");

var dup13 = date_time({
	dest: "event_time",
	args: ["fld1","fld2"],
	fmts: [
		[dF,dc("-"),dG,dc("-"),dW,dN,dc(":"),dU,dc(":"),dO],
	],
});

var dup14 = setc("dclass_counter1_string","Bandwidth in Kbps");

var dup15 = match("MESSAGE#1:Intrusions:02/0", "nwparser.payload", "%{id->} %{category->} \\\"%{event_type}\\\" %{protocol->} %{p0}");

var dup16 = match("MESSAGE#1:Intrusions:02/4", "nwparser.p0", "%{dport->} %{interface->} %{context->} \\\"%{policyname}\\\" %{event_state->} %{packets->} %{dclass_counter1->} %{fld1->} %{risk->} %{action->} %{vlan->} %{fld15->} %{fld16->} %{direction}");

var dup17 = setc("eventcategory","1002000000");

var dup18 = setc("ec_subject","NetworkComm");

var dup19 = setc("ec_activity","Scan");

var dup20 = setc("eventcategory","1401000000");

var dup21 = setc("ec_subject","User");

var dup22 = setc("ec_theme","ALM");

var dup23 = setc("ec_activity","Modify");

var dup24 = setc("ec_theme","Configuration");

var dup25 = setc("eventcategory","1612000000");

var dup26 = match("MESSAGE#22:Login:04/1_0", "nwparser.p0", "for user%{p0}");

var dup27 = match("MESSAGE#22:Login:04/1_1", "nwparser.p0", "user%{p0}");

var dup28 = match("MESSAGE#22:Login:04/2", "nwparser.p0", "%{} %{username->} via %{network_service->} (IP: %{saddr})%{p0}");

var dup29 = match("MESSAGE#22:Login:04/3_0", "nwparser.p0", ": %{result}");

var dup30 = match_copy("MESSAGE#22:Login:04/3_1", "nwparser.p0", "result");

var dup31 = setc("eventcategory","1401030000");

var dup32 = setc("ec_activity","Logon");

var dup33 = setc("ec_theme","Authentication");

var dup34 = setc("ec_outcome","Failure");

var dup35 = setc("event_description","Login Failed");

var dup36 = setc("ec_outcome","Error");

var dup37 = setc("eventcategory","1603000000");

var dup38 = setc("ec_theme","AccessControl");

var dup39 = setc("eventcategory","1401060000");

var dup40 = setc("ec_outcome","Success");

var dup41 = setc("event_description","User logged in");

var dup42 = linear_select([
	dup2,
	dup3,
]);

var dup43 = linear_select([
	dup5,
	dup6,
]);

var dup44 = linear_select([
	dup8,
	dup9,
]);

var dup45 = linear_select([
	dup26,
	dup27,
]);

var dup46 = linear_select([
	dup29,
	dup30,
]);

var dup47 = all_match({
	processors: [
		dup1,
		dup42,
		dup4,
		dup43,
		dup7,
		dup44,
	],
	on_success: processor_chain([
		dup10,
		dup11,
		dup12,
		dup13,
		dup14,
	]),
});

var dup48 = all_match({
	processors: [
		dup15,
		dup42,
		dup4,
		dup43,
		dup16,
	],
	on_success: processor_chain([
		dup10,
		dup11,
		dup12,
		dup14,
	]),
});

var dup49 = all_match({
	processors: [
		dup1,
		dup42,
		dup4,
		dup43,
		dup7,
		dup44,
	],
	on_success: processor_chain([
		dup17,
		dup11,
		dup12,
		dup13,
		dup14,
	]),
});

var dup50 = all_match({
	processors: [
		dup15,
		dup42,
		dup4,
		dup43,
		dup16,
	],
	on_success: processor_chain([
		dup17,
		dup11,
		dup12,
		dup14,
	]),
});

var hdr1 = match("HEADER#0:0001", "message", "%DefensePro %{hfld1->} %{hfld2->} %{hfld3->} %{messageid->} \\\"%{hfld4}\\\" %{p0}", processor_chain([
	setc("header_id","0001"),
	call({
		dest: "nwparser.payload",
		fn: STRCAT,
		args: [
			field("hfld3"),
			constant(" "),
			field("messageid"),
			constant(" \\\""),
			field("hfld4"),
			constant("\\\" "),
			field("p0"),
		],
	}),
]));

var hdr2 = match("HEADER#1:0002", "message", "%DefensePro %{messageid->} %{p0}", processor_chain([
	setc("header_id","0002"),
	call({
		dest: "nwparser.payload",
		fn: STRCAT,
		args: [
			field("messageid"),
			constant(" "),
			field("p0"),
		],
	}),
]));

var hdr3 = match("HEADER#2:0003", "message", "DefensePro: %{hdate->} %{htime->} %{hfld1->} %{hfld2->} %{messageid->} \"%{hfld3}\" %{p0}", processor_chain([
	setc("header_id","0003"),
	call({
		dest: "nwparser.payload",
		fn: STRCAT,
		args: [
			field("hdate"),
			constant(" "),
			field("htime"),
			constant(" "),
			field("hfld1"),
			constant(" "),
			field("hfld2"),
			constant(" "),
			field("messageid"),
			constant(" \""),
			field("hfld3"),
			constant("\" "),
			field("p0"),
		],
	}),
]));

var hdr4 = match("HEADER#3:0004", "message", "DefensePro: %{hdate->} %{htime->} %{hfld1->} %{messageid->} %{p0}", processor_chain([
	setc("header_id","0004"),
	call({
		dest: "nwparser.payload",
		fn: STRCAT,
		args: [
			field("hdate"),
			constant(" "),
			field("htime"),
			constant(" "),
			field("hfld1"),
			constant(" "),
			field("messageid"),
			constant(" "),
			field("p0"),
		],
	}),
]));

var select1 = linear_select([
	hdr1,
	hdr2,
	hdr3,
	hdr4,
]);

var msg1 = msg("Intrusions:01", dup47);

var msg2 = msg("Intrusions:02", dup48);

var select2 = linear_select([
	msg1,
	msg2,
]);

var msg3 = msg("SynFlood:01", dup49);

var msg4 = msg("Behavioral-DoS:01", dup49);

var msg5 = msg("Behavioral-DoS:02", dup50);

var select3 = linear_select([
	msg4,
	msg5,
]);

var all1 = all_match({
	processors: [
		dup1,
		dup42,
		dup4,
		dup43,
		dup7,
		dup44,
	],
	on_success: processor_chain([
		dup10,
		dup18,
		dup19,
		dup11,
		dup12,
		dup13,
		dup14,
	]),
});

var msg6 = msg("Anti-Scanning:01", all1);

var all2 = all_match({
	processors: [
		dup15,
		dup42,
		dup4,
		dup43,
		dup16,
	],
	on_success: processor_chain([
		dup10,
		dup18,
		dup19,
		dup11,
		dup12,
		dup14,
	]),
});

var msg7 = msg("Anti-Scanning:02", all2);

var select4 = linear_select([
	msg6,
	msg7,
]);

var msg8 = msg("DoS:01", dup49);

var all3 = all_match({
	processors: [
		dup15,
		dup42,
		dup4,
		dup43,
		dup16,
	],
	on_success: processor_chain([
		dup17,
		dup18,
		dup19,
		dup11,
		dup12,
		dup14,
	]),
});

var msg9 = msg("DoS:02", all3);

var select5 = linear_select([
	msg8,
	msg9,
]);

var msg10 = msg("Cracking-Protection:01", dup47);

var msg11 = msg("Cracking-Protection:02", dup48);

var select6 = linear_select([
	msg10,
	msg11,
]);

var msg12 = msg("Anomalies:01", dup49);

var msg13 = msg("Anomalies:02", dup50);

var select7 = linear_select([
	msg12,
	msg13,
]);

var msg14 = msg("HttpFlood:01", dup49);

var msg15 = msg("HttpFlood:02", dup50);

var select8 = linear_select([
	msg14,
	msg15,
]);

var part1 = match("MESSAGE#15:COMMAND:", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} COMMAND: \"%{action}\" by user %{username->} via %{network_service}, source IP %{saddr}", processor_chain([
	dup20,
	dup21,
	setc("ec_activity","Execute"),
	dup22,
	dup12,
	dup13,
]));

var msg16 = msg("COMMAND:", part1);

var part2 = match("MESSAGE#16:Configuration:01", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} %{event_description->} set %{change_new}, Old Values: %{change_old}, ACTION: %{action->} by user %{username->} via %{network_service->} source IP %{saddr}", processor_chain([
	dup20,
	dup21,
	dup23,
	dup24,
	dup12,
	dup13,
]));

var msg17 = msg("Configuration:01", part2);

var part3 = match("MESSAGE#17:Configuration:02", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} %{event_description}, ACTION: %{action->} by user %{username->} via %{network_service->} source IP %{saddr}", processor_chain([
	dup20,
	dup21,
	dup24,
	dup12,
	dup13,
]));

var msg18 = msg("Configuration:02", part3);

var part4 = match("MESSAGE#18:Configuration:03", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Configuration File downloaded from device by user %{username->} via %{network_service}, source IP %{saddr}", processor_chain([
	dup20,
	dup21,
	dup24,
	dup12,
	setc("event_description","Configuration File downloaded"),
	dup13,
]));

var msg19 = msg("Configuration:03", part4);

var part5 = match("MESSAGE#19:Configuration:04", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Configuration Upload has been completed", processor_chain([
	dup25,
	dup24,
	dup12,
	setc("event_description","Configuration Upload has been completed"),
	dup13,
]));

var msg20 = msg("Configuration:04", part5);

var part6 = match("MESSAGE#20:Configuration:05", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Configuration Download has been completed", processor_chain([
	dup25,
	dup24,
	dup12,
	setc("event_description","Configuration Download has been completed"),
	dup13,
]));

var msg21 = msg("Configuration:05", part6);

var part7 = match("MESSAGE#21:Configuration:06", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Configuration file has been modified. Device may fail to load configuration file!", processor_chain([
	dup25,
	dup23,
	dup24,
	dup12,
	setc("event_description","Configuration file has been modified. Device may fail to load configuration file!"),
	dup13,
]));

var msg22 = msg("Configuration:06", part7);

var select9 = linear_select([
	msg17,
	msg18,
	msg19,
	msg20,
	msg21,
	msg22,
]);

var part8 = match("MESSAGE#22:Login:04/0", "nwparser.payload", "Login failed %{p0}");

var all4 = all_match({
	processors: [
		part8,
		dup45,
		dup28,
		dup46,
	],
	on_success: processor_chain([
		dup31,
		dup21,
		dup32,
		dup33,
		dup34,
		dup12,
		dup35,
	]),
});

var msg23 = msg("Login:04", all4);

var part9 = match("MESSAGE#23:Login:05", "nwparser.payload", "Login locked user %{username->} (IP: %{saddr}): %{result}", processor_chain([
	dup31,
	dup21,
	dup32,
	dup33,
	dup36,
	dup12,
	setc("event_description","Login Locked"),
]));

var msg24 = msg("Login:05", part9);

var part10 = match("MESSAGE#24:Login:01/0", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Login failed %{p0}");

var all5 = all_match({
	processors: [
		part10,
		dup45,
		dup28,
		dup46,
	],
	on_success: processor_chain([
		dup31,
		dup21,
		dup32,
		dup33,
		dup34,
		dup12,
		dup35,
		dup13,
	]),
});

var msg25 = msg("Login:01", all5);

var part11 = match("MESSAGE#25:Login:02", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Login failed via %{network_service->} (IP: %{saddr}): %{result}", processor_chain([
	dup31,
	dup21,
	dup32,
	dup33,
	dup34,
	dup12,
	dup35,
	dup13,
]));

var msg26 = msg("Login:02", part11);

var part12 = match("MESSAGE#26:Login:03", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Login locked user %{username->} (IP: %{saddr}): %{result}", processor_chain([
	dup31,
	dup21,
	dup32,
	dup33,
	dup36,
	dup12,
	dup35,
	dup13,
]));

var msg27 = msg("Login:03", part12);

var select10 = linear_select([
	msg23,
	msg24,
	msg25,
	msg26,
	msg27,
]);

var part13 = match("MESSAGE#27:Connection", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Connection to NTP server timed out", processor_chain([
	dup37,
	dup22,
	dup12,
	setc("event_description","Connection to NTP server timed out"),
	dup13,
]));

var msg28 = msg("Connection", part13);

var part14 = match("MESSAGE#28:Device", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Device was rebooted by user %{username->} via %{network_service}, source IP %{saddr}", processor_chain([
	dup20,
	dup21,
	dup22,
	dup12,
	setc("event_description","Device was rebooted"),
	dup13,
]));

var msg29 = msg("Device", part14);

var part15 = match("MESSAGE#29:Power", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Power supply fully operational", processor_chain([
	dup25,
	dup22,
	dup12,
	setc("event_description","Power supply fully operational"),
	dup13,
]));

var msg30 = msg("Power", part15);

var part16 = match("MESSAGE#30:Cold", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Cold Start", processor_chain([
	dup25,
	setc("ec_activity","Start"),
	dup22,
	dup12,
	setc("event_description","Cold Start"),
	dup13,
]));

var msg31 = msg("Cold", part16);

var part17 = match("MESSAGE#31:Port/0", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Port %{interface->} %{p0}");

var part18 = match("MESSAGE#31:Port/1_0", "nwparser.p0", "Down%{}");

var part19 = match("MESSAGE#31:Port/1_1", "nwparser.p0", "Up%{}");

var select11 = linear_select([
	part18,
	part19,
]);

var all6 = all_match({
	processors: [
		part17,
		select11,
	],
	on_success: processor_chain([
		dup25,
		dup22,
		dup12,
		setc("event_description","Port Status Change"),
		dup13,
	]),
});

var msg32 = msg("Port", all6);

var part20 = match("MESSAGE#32:DefensePro", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} DefensePro was powered off", processor_chain([
	dup25,
	dup22,
	dup12,
	setc("event_description","DefensePro Powered off"),
	dup13,
]));

var msg33 = msg("DefensePro", part20);

var part21 = match("MESSAGE#33:Access:01/0", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} %{id->} %{category->} \"%{event_type}\" %{protocol->} %{saddr->} %{sport->} %{daddr->} %{dport->} %{interface->} %{context->} \"%{policyname}\" %{event_state->} %{packets->} %{dclass_counter1->} %{vlan->} %{fld15->} %{fld16->} %{risk->} %{p0}");

var all7 = all_match({
	processors: [
		part21,
		dup44,
	],
	on_success: processor_chain([
		dup37,
		dup38,
		dup12,
		dup13,
	]),
});

var msg34 = msg("Access:01", all7);

var part22 = match("MESSAGE#34:Access", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Access attempted by unauthorized NMS, Community: %{fld3}, IP: \"%{saddr}\"", processor_chain([
	dup37,
	dup38,
	dup12,
	setc("event_description","Access attempted by unauthorized NMS"),
	dup13,
]));

var msg35 = msg("Access", part22);

var select12 = linear_select([
	msg34,
	msg35,
]);

var part23 = match("MESSAGE#35:Please", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Please reboot the device for the latest changes to take effect", processor_chain([
	dup20,
	dup22,
	dup12,
	setc("event_description","Reboot required for latest changes"),
	dup13,
]));

var msg36 = msg("Please", part23);

var part24 = match("MESSAGE#36:User:01", "nwparser.payload", "User %{username->} logged in via %{network_service->} (IP: %{saddr})", processor_chain([
	dup39,
	dup21,
	dup32,
	dup33,
	dup40,
	dup12,
	dup41,
]));

var msg37 = msg("User:01", part24);

var part25 = match("MESSAGE#37:User", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} User %{username->} logged in via %{network_service->} (IP: %{saddr})", processor_chain([
	dup39,
	dup21,
	dup32,
	dup33,
	dup40,
	dup12,
	dup41,
	dup13,
]));

var msg38 = msg("User", part25);

var select13 = linear_select([
	msg37,
	msg38,
]);

var part26 = match("MESSAGE#38:Certificate", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Certificate named %{fld3->} expired on %{fld4->} %{fld5}", processor_chain([
	dup20,
	dup12,
	setc("event_description","Certificate expired"),
	dup13,
	date_time({
		dest: "endtime",
		args: ["fld5"],
		fmts: [
			[dB,dF,dH,dc(":"),dU,dc(":"),dO,dW],
		],
	}),
]));

var msg39 = msg("Certificate", part26);

var part27 = match("MESSAGE#39:Vision", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} Vision %{event_description->} by user %{username->} via %{network_service}, source IP %{saddr}", processor_chain([
	dup20,
	dup12,
	dup13,
]));

var msg40 = msg("Vision", part27);

var part28 = match("MESSAGE#40:Updating", "nwparser.payload", "Updating policy database%{fld1}", processor_chain([
	dup25,
	dup22,
	dup12,
	setc("event_description","Updating policy database"),
]));

var msg41 = msg("Updating", part28);

var part29 = match("MESSAGE#41:Policy", "nwparser.payload", "Policy database updated successfully.%{}", processor_chain([
	dup25,
	dup24,
	dup40,
	dup12,
	setc("event_description","Policy database updated successfully"),
]));

var msg42 = msg("Policy", part29);

var chain1 = processor_chain([
	select1,
	msgid_select({
		"Access": select12,
		"Anomalies": select7,
		"Anti-Scanning": select4,
		"Behavioral-DoS": select3,
		"COMMAND:": msg16,
		"Certificate": msg39,
		"Cold": msg31,
		"Configuration": select9,
		"Connection": msg28,
		"Cracking-Protection": select6,
		"DefensePro": msg33,
		"Device": msg29,
		"DoS": select5,
		"HttpFlood": select8,
		"Intrusions": select2,
		"Login": select10,
		"Please": msg36,
		"Policy": msg42,
		"Port": msg32,
		"Power": msg30,
		"SynFlood": msg3,
		"Updating": msg41,
		"User": select13,
		"Vision": msg40,
	}),
]);

var part30 = match("MESSAGE#0:Intrusions:01/0", "nwparser.payload", "%{fld1->} %{fld2->} %{severity->} %{id->} %{category->} \"%{event_type}\" %{protocol->} %{p0}");

var part31 = match("MESSAGE#0:Intrusions:01/1_0", "nwparser.p0", "%{saddr}:%{p0}");

var part32 = match("MESSAGE#0:Intrusions:01/1_1", "nwparser.p0", "%{saddr->} %{p0}");

var part33 = match("MESSAGE#0:Intrusions:01/2", "nwparser.p0", "%{sport->} %{p0}");

var part34 = match("MESSAGE#0:Intrusions:01/3_0", "nwparser.p0", "%{daddr}:%{p0}");

var part35 = match("MESSAGE#0:Intrusions:01/3_1", "nwparser.p0", "%{daddr->} %{p0}");

var part36 = match("MESSAGE#0:Intrusions:01/4", "nwparser.p0", "%{dport->} %{interface->} %{context->} \"%{policyname}\" %{event_state->} %{packets->} %{dclass_counter1->} %{vlan->} %{fld15->} %{fld16->} %{risk->} %{p0}");

var part37 = match("MESSAGE#0:Intrusions:01/5_0", "nwparser.p0", "%{action->} %{sigid_string}");

var part38 = match_copy("MESSAGE#0:Intrusions:01/5_1", "nwparser.p0", "action");

var part39 = match("MESSAGE#1:Intrusions:02/0", "nwparser.payload", "%{id->} %{category->} \\\"%{event_type}\\\" %{protocol->} %{p0}");

var part40 = match("MESSAGE#1:Intrusions:02/4", "nwparser.p0", "%{dport->} %{interface->} %{context->} \\\"%{policyname}\\\" %{event_state->} %{packets->} %{dclass_counter1->} %{fld1->} %{risk->} %{action->} %{vlan->} %{fld15->} %{fld16->} %{direction}");

var part41 = match("MESSAGE#22:Login:04/1_0", "nwparser.p0", "for user%{p0}");

var part42 = match("MESSAGE#22:Login:04/1_1", "nwparser.p0", "user%{p0}");

var part43 = match("MESSAGE#22:Login:04/2", "nwparser.p0", "%{} %{username->} via %{network_service->} (IP: %{saddr})%{p0}");

var part44 = match("MESSAGE#22:Login:04/3_0", "nwparser.p0", ": %{result}");

var part45 = match_copy("MESSAGE#22:Login:04/3_1", "nwparser.p0", "result");

var select14 = linear_select([
	dup2,
	dup3,
]);

var select15 = linear_select([
	dup5,
	dup6,
]);

var select16 = linear_select([
	dup8,
	dup9,
]);

var select17 = linear_select([
	dup26,
	dup27,
]);

var select18 = linear_select([
	dup29,
	dup30,
]);

var all8 = all_match({
	processors: [
		dup1,
		dup42,
		dup4,
		dup43,
		dup7,
		dup44,
	],
	on_success: processor_chain([
		dup10,
		dup11,
		dup12,
		dup13,
		dup14,
	]),
});

var all9 = all_match({
	processors: [
		dup15,
		dup42,
		dup4,
		dup43,
		dup16,
	],
	on_success: processor_chain([
		dup10,
		dup11,
		dup12,
		dup14,
	]),
});

var all10 = all_match({
	processors: [
		dup1,
		dup42,
		dup4,
		dup43,
		dup7,
		dup44,
	],
	on_success: processor_chain([
		dup17,
		dup11,
		dup12,
		dup13,
		dup14,
	]),
});

var all11 = all_match({
	processors: [
		dup15,
		dup42,
		dup4,
		dup43,
		dup16,
	],
	on_success: processor_chain([
		dup17,
		dup11,
		dup12,
		dup14,
	]),
});