search

Security Logs Logstash Plugins Repository

Are you using or planning to use ELK and need to digest logs from various products? You’re in the right place…

Visit our Github page:  https://github.com/empow/logstash-parsers

empow’s SIEM logstash pipeline is an open source repository containing logstash-based configuration pipelines for the digestion of logs generated by various products and vendors. The output is mapped to the Elastic Common Schema (ECS). In some cases, additional fields that have security value and do not exist in the ECS can be added.

In addition, some plugins can be used to enrich security logs with information about the attacker’s intent according to the cyber-kill-chain and MITRE ATT&CK representation language, using empow’s threat classification plugin.

What do you get?

  1. Parsers for logs from various products and vendors
  2. Logstash pipeline-based structure to streamline the digestion of various logs
  3. Output to Elastic (or other destination) based on ECS
  4. Enrichment for intent classification, powered by empow (optional)
  5. Since Logstash is configurable, you can modify the plugins and pipeline for your specific needs
  6. Community to share and keep up-to-date plugins

Note: the plugins are based on log samples and vendors’ documentation. We are continuously updating and enriching the plugins. We encourage you to share examples and enhancements to improve the plugins and to keep them up-to-date with latest product versions. Please contact us at support@empow.co for and questions or updates.

To begin using the plugins repository, visit our Github page:  https://github.com/empow/logstash-parsers

Recommended: Extend your functionality of the pipeline with empow’s threat classification plugin

The empow classification plugin extends the functionality of logstash by classifying your log data, using the empow classification center, for attack intent and attack stage.  Click here for more information on the benefits of using empow’s threat classification plugin.

To add empow’s intent threat classification to the output based on the setup described above, the following steps are required:

  1. Register to empow’s classification center (it’s free and no private information is sent to empow’s classification center) – to register please fill out the form on this page.
    NOTE: the username and password in the registration form shall be used as the plugin credentials.
  2. Use empow’s classification virtual output, by modifying the output of each parser as described here.

For any questions or clarifications please contact us at support@empow.co

If you’d like to register to the empow classification center, please fill out this form:

  • at least 8 characters as well as small and big letters and special characters
  • Hidden
  • Hidden
  • Hidden
  • Hidden

Recommended: Extend your functionality of the pipeline with empow’s threat classification plugin

The empow classification plugin extends the functionality of logstash by classifying your log data, using the empow classification center, for attack intent and attack stage.  Click here for more information on the benefits of using empow’s threat classification plugin.

To add empow’s intent threat classification to the output based on the setup described above, the following steps are required:

  1. Register to empow’s classification center (it’s free and no private information is sent to empow’s classification center) – to register please fill out the form on this page.
    NOTE: the username and password in the registration form shall be used as the plugin credentials.
  2. Use empow’s classification virtual output, by modifying the output of each parser as described here.

For any questions or clarifications please contact us at support@empow.co

Forgot your password?
Enter your email to reset your password
After sending the request you will receive a confirmation code in the mail
Change password form

Terms of Use

 

THESE TERMS OF USE (THE “TERMS”) ARE OFFERED TO YOU (AN INDIVIDUAL OR ENTITY OBTAINING THE SERVICE (AS DEFINED BELOW) (“YOU”) BY EMPOW CYBER SECURITY LTD., (“EMPOW”, “WE”, “US”). EACH OF THE ABOVE MAY INDIVIDUALLY BE REFERRED TO AS A “PARTY” AND JOINTLY AS THE “PARTIES”.

 

empow has developed a Classification Services , empow Logstsh Classification Filter Plugging, and empow ELK module, aiming to analyze security threats – and enrich – incoming security log with its security intent and attack stage. (“Service”). The Service is offered subject to these Terms.

 

PLEASE SCROLL DOWN AND CAREFULLY REVIEW ALL OF THE TERMS AND CONDITIONS CONTAINED IN THESE TERMS BEFORE USING THE SERVICE. BY REQUESTING TO SUBSCRIVBE TO THE FREE USE OF THE SERVICE, YOU ACKNOWLEDGE AND AGREE THAT YOU: (I) HAVE READ AND UNDERSTOOD ALL THE TERMS HEREIN; (II) ACCEPT AND AGREE TO BE LEGALLY BOUND BY THESE TERMS.

 

IF YOU DO NOT AGREE WITH THESE TERMS, DO NOT REQUEST TO SUBSCRIBE TO THE SERVICE AND DO NOT USE IT. IF YOU ARE USING THE SERVICE AND DO NOT AGREE WITH THESE TERMS, YOU MUST IMMEDIATELY DISCONTINUE SUCH USE AND COMPLY WITH THE TERMINATION PROVISIONS HEREOF.

 

IF YOU ARE ENTERING INTO THESE TERMS ON BEHALF OF A COMPANY (OR OTHER ENTITY), YOU REPRESENT THAT YOU ARE AN EMPLOYEE OR AGENT OF SUCH COMPANY (OR OTHER ENTITY) AND YOU HAVE THE AUTHORITY TO ENTER INTO THESE TERMS ON BEHALF OF SUCH COMPANY (OR OTHER ENTITY). IF YOU ARE A MINOR, YOU ARE REQUIRED TO OBTAIN A PARENTAL CONSENT FOR AND PRIOR TO USING THE SERVICE.

  1. Definitions

“Agents” is that portion of the Service offered as downloadable code, used to interact with other, cloud based, parts of the Service (for instance the Empow Logstsh Classification Filter Plugging).

“Documentation” means the user manuals, licenses text and related explanatory written materials concerning the Service that may be made available (with no obligation) to you by us.

 “Software” is the proprietary software pertaining to the Service and Documentation with respect thereto as well as any updates, derivatives, modifications and/or enhancements that are made available by empow at its discretion.  Without limiting the foregoing, the term “Software” includes the code underlying any Servers and Agents made available to and accessed by You pursuant to these Terms and expressly excludes “Third Party Software”.

“Third Party Software” means software that has not been developed by empow (including without limitation any third-party plug-in) and that is licensed under various licenses including open source programs.

 

  1. Usage Rights.Subject to these Terms, during the term of these Terms, empow grants you a limited, revocable, nonexclusive, non-transferable, non-sublicensable right to access and use the Service worldwide (“Usage Rights”). Your Usage Rights are limited to the scope granted herein. empow reserves all rights not expressly granted in these Terms.  You acknowledge and agree that empow has the right to modify the Service at any time for any reason without notice to you.  empow may audit and track your access and use of the Service. The Service is offered for free with limited features but some elements may be offered for fees (subject to execution of a separate agreement between the Parties).

 

empow reserves the right to change the terms of these terms including by changing fees for the service. such change in terms shall be made upon prior notice (via email where possible or through a notification on empow’s website) of at least 30 days.

 

Agent is provided under Apache v. 2.0 license unless otherwise agreed between the Parties (for the terms of the Apache v. 2.0 license please click here: https://www.apache.org/licenses/LICENSE-2.0).

 

once a security log is detected, and its relevant information is sent to the Service (e.g. malware hash value, IDS signature ID, etc.), the classification service, using algorithms such as machine learning technology, aims to automatically acquires textual description of the threat if necessary, analyzes the information and map the log into the relevant one or more security intent and attack stage. empow shall not reveal any logs or information sent to its system but can use insights on a specific threat to train its system and upgrade its Services.

 

  1. Third Party Providers.  You acknowledge and agrees that the Service may contain Third Party Software which might be subject to separate terms.  NEITHER EMPOW NOR THE THIRD-PARTY SOFTWARE PROVIDERS ARE RESPONSIBLE AND SHALL HAVE NO LIABILITY AS A RESULT OF YOUR USE OF THE THIRD-PARTY SOFTWARE.  You acknowledge that the Service may be available pursuant to a hosted solution provided by third-party on-demand cloud services providers.  NEITHER EMPOW NOR THE THIRD-PARTY CLOUD PROVIDERS SHALL BE RESPONSIBLE AND SHALL HAVE NO LIABILITY FOR AVAILABILITY OR LACK OF AVAILABILITY OF THE SERVICE. NEITHER EMPOW NOR ITS ANY THIRD-PARTY CLOUD PROVIDER WILL BE LIABLE FOR ANY DAMAGES RELATED TO ANY DOWNTIME, OUTAGES, LOSS OF DATA, OR UNAUTHORIZED ACCESS TO YOUR DATA.

 

  1. Rights, Title, and Interest to the Service.Except as otherwise set forth expressly herein, empow and its licensors remain the owner of all right, title, and interest in and to the Service and all associated intellectual property pertaining thereto and any derivatives thereof (excluding derivatives to the Agent). Nothing contained herein shall be deemed to convey to you any title, right, or interest in and to such Service or any trademarks, service marks, or intellectual property rights of empow or its licensors. The Service is protected by copyright laws and other intellectual property rights in the United States and other countries as well as by international treaties.

 

  1. Restrictions.  Except in connection with the Agent provided under the Apache 2.0 license, You shall not, and shall not permit anyone else within your control, to: (i) use or possess the Service except as expressly allowed under the Usage Rights section; (ii) copy or reproduce in whole or in part the Service or the Documentation without the advance express written permission of empow; (iii) remove any proprietary notices or labels on or otherwise incorporated into the Service; (iv) try to access the content and file system of a Server or an Agent where the Software is running; (v) modify or adapt the Service (including without limitation the underlying Software) or incorporate or merge it or any component thereof into another program; (vi) reverse engineer, disassemble, decompile or make any attempt to discover the source code of the Service (including without limitation the underlying Software); (vii) place the Software onto a server so that it is accessible via a public network such as the Internet, (viii) sublicense, rent, lease or lend any portion of the Service or Software, or (ix) permit others to use the Software in addition to those authorized under these Terms (x) allow any breach of law or infringement of any third party’s rights in connection with the use of the Service (xi) knowingly allow any unauthorized access to or use of the Service (xii) create multiple account using automated means (like bots) or use automated means to access the system including for the purpose of scraping of any kind (but not limited to this purpose).

 

  1. No Warranties.  THE SERVICE, ANY PARTS THERE OF ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, AND THE ENTIRE RISK AS TO SATISFACTORY QUALITY, ACCURACY, AND EFFORT IS WITH YOU.  ALL WARRANTIES OR CONDITIONS, EXPRESS OR IMPLIED, REGARDING THE SERVICE, INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, AVAILABILITY, NON-INTERFERENCE WITH YOUR QUIET ENJOYMENT, THAT THE SERVICE WILL MEET YOUR REQUIREMENTS, IS ABLE TO OPERATE ON AN UNINTERRUPTED BASIS, SECURE AND NON-INFRINGEMENT OF THIRD-PARTY RIGHTS, ARE HEREBY EXPRESSLY DISCLAIMED. WITHOUT LIMITING THE FOREGOING, EMPOW DOES NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION OF THE SERVICE. FURTHER, YOU ACKNOWLEDGE THAT EMPOW SHALL NOT BE RESPONSIBLE FOR AND DOES NOT CONTROL THE CLOUD PROVIDER SERVERS. YOU UNDERSTAND AND ACKNOWLEDGE THAT NEITHER EMPOW NOR THE ANY THIRD-PARTY PROVIDER SHALL BE RESPONSIBLE FOR ANY DATA, INFORMATION OR OTHER MATERIAL PLACED ON SUCH SERVERS. NEITHER EMPOW NOR THE THIRD-PARTY PROVIDERS ARE RESPONSIBLE FOR ANY LOSS OF DATA OR HARM DONE TO YOUR COMPUTER, SYSTEMS OR OTHER EQUIPMENT ARISING OUT OF OR RELATING TO YOUR USE OF THE SERVICE. YOU UNDERSTAND AND AGREE THAT USE OF THE SERVICE IS AT YOUR OWN RISK AND DISCRETION AND WE CAN SUSPEND OR CEASE THE SERVICE WITH NO WARRANTY AND WITH NO LIABILITY.

 

  1. Limitations of Liability; No Duty to Support, Maintain or Update.  TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALLE EMPOW’S TOTAL CUMULATIVE LIABILITY IN CONNECTION WITH THESE TERMS AND THE SERVICE, WHETHER IN CONTRACT OR TORT OR OTHERWISE, EXCEED ONE DOLLAR ($1).

 

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EMPOW, ITS AFFILIATES, THIRD PARTY LICENSORS OR SUPPLIERS BE LIABLE TO YOU FOR ANY DAMAGES, INCLUDING ANY LOST PROFITS, LOST SAVINGS, OR INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES ARISING FROM THE USE OR THE INABILITY TO USE THE SERVICE (EVEN IF ADVISED OF THE POSSIBILITY OF THESE DAMAGES), OR FOR ANY CLAIM BY ANY OTHER PARTY.

 

You acknowledge that empow would not enter into these Terms without these limitations on its liability.

You also acknowledge that empow has no duty to update, supplement, support, maintain or otherwise modify the Service at any time and that the Service may not operate correctly and may provide wrong results.

 

  1. Term and Termination.  These Terms take effect upon your use of any portion of the Service and remain effective until terminated. These Terms may be terminated by you or Empow at any time with or without cause by either Party. You may provide notice of such termination or discontinue your use in the System with no notice. Empow shall endeavor to notify on termination of Service but shall not be obligated to do so (subject to applicable laws). These Terms shall automatically terminate upon your breach hereof.  Upon termination of these Terms all Usage Rights and other rights or licenses granted in these Terms will immediately and automatically cease to exist. You agree on termination of these Terms to destroy all Documentation in your possession.

 

  1. Confidentiality.The Service contains trade secrets and proprietary know-how that belong exclusively to empow and it is being made available to you in strict confidence. ANY USE OR DISCLOSURE OF THE SERVICE OR OF ITS ALGORITHMS, SOURCE CODE, PROTOCOLS OR INTERFACES, OTHER THAN IN STRICT ACCORDANCE WITH THESE TERMS, MAY BE ACTIONABLE AS A VIOLATION OF EMPOW’S TRADE SECRET RIGHTS. empow shall not reveal any known confidential information (i.e. information you marked as “confidential”) to third parties that have no “need to know” to provide the Service and are under confidentiality obligations.

 

  1. Export and Compliance with Laws.  You agree that the Service will not be used in any manner prohibited by the United States Export Administration Act or any other applicable export laws, restrictions or regulations of any applicable jurisdiction. You will defend, indemnify, and hold harmless Empow from and against any violation of such laws or regulations by you or any of its agents, officers, directors, or employees. In carrying out its respective obligations under these Terms, each Party shall comply with all applicable laws and regulations of the local country and of any other applicable country.

 

  1. Privacy Policy and Consent for Direct Marketing. No Personal or Sensitive Information (As defined in in any applicable laws) is intended to transfer under this Agreement (other than user names and passwords if considered Personal Information under applicable laws). Should any Personal Information be transferred to Empow, it shall be processed in accordance with Empow Privacy Policy available at: https://www.empowcybersecurity.com.

Subject to applicable laws, by accepting these terms, you agree that Empow will send you offers that may interest you. Empow will only use the details you provide to communicate with you and to serve you with content that you subscribed for. Empow shall process your details as a controller of data, as described in the Privacy Policy posted on its website. You can always redraw your consent or delete or change your details from our mailing list by approaching us as described in the privacy policy or as detailed in the e-mails we send. If you want to use the services described hereunder but don’t want Empow to retain your data or use it, please email us.

 

  1. Choice of Law; Exclusive Venue and Jurisdiction.  These Terms shall be interpreted, enforced and governed by the laws of Israel, excluding its choice of law provisions. Any disputes arising under or relating to this Terms shall be heard in the competent courts of Tel-Aviv-Jaffa, Israel. Each Party hereby consents to the jurisdiction of said courts and waives any objections that it has or may have at any time to the exclusive jurisdiction of such courts, the laying of venue in such courts or the convenience of the forum. Nothing contained in this section shall prevent however Empow from obtaining injunctive or equitable relief from a court of competent jurisdiction.

 

  1. Severability.  If, at any time, any clause or provision in these Terms is or becomes unenforceable or invalid in any respect under the law of any jurisdiction, neither legality, validity or enforceability of the remaining provisions hereof nor the legality, validity or enforceability of such provision under the law of any other jurisdiction shall in any way be affected or impaired thereby.

 

  1. Hold Harmless.  You agree to indemnify, defend and hold harmless empow and its affiliates, licensors and providers (and their officers, directors, agents, and employees) from and against any and all claims, costs, damages, losses, liabilities and expenses (including reasonable attorneys’ fees and costs) arising out of or in connection with Your use of the Service.

 

  1. No Third-Party Beneficiaries.  Except as specifically provided herein, nothing in these Terms, express or implied, is intended or shall confer upon any person or entity other than the Parties any right, benefit or remedy of any nature whatsoever under or by reason of these Terms, except that any affiliate of Empow may enforce these Terms and any of its clauses or provisions either directly for such affiliates’ benefit or the benefit of empow.

 

  1. Entire Terms.  These Terms, including any exhibits and appendices hereto and thereto, constitute the entire understanding between the Parties with respect to the subject matter thereof. There are no promises, terms, conditions, or obligations other than those contained herein and therein. Empow may modify these Terms and the Service at any time without notice to You.

 

  1. Assignment. empow may assign its rights and obligations under this Agreement at its sole discretion. You may not assign you access to the Service under this Agreement without empow’s prior written approval.

 

  1. Remedies; No Waiver.You acknowledge that the Service contains valuable trade secrets and proprietary information of empow, that any actual or threatened breach of these Terms will constitute immediate, irreparable harm to empow for which monetary damages would be an inadequate remedy, and that injunctive relief is an appropriate remedy for such breach, in addition to all other remedies that may be available, in law, at equity or otherwise without the need to prove damages. No failure to exercise, nor any delay in exercising, on the part of either Party, any right or remedy hereunder shall operate as a waiver thereof, nor shall any single or partial exercise of any right or remedy prevent any further or other exercise thereof or the exercise of any other right or remedy.

 

  1. Independent Contractors.  In performing under these Terms, each Party shall at all times and for all purposes, constitute an independent contractor and not an employee or agent of the other Party any of its affiliates.

 

  1. Survival and Changes. Any provision of these Terms that, in order to give proper effect to its intent, should survive termination, shall survive the termination of these Terms. These term may change from time to time. empow shall endeavor to notify on any change but is not obligated to do so (subject to applicable law). You are responsible to periodically check the terms and date of change thereof. Last Updated on December 19, 2018

 

Contact Information:
empow Cyber Security : 129 Newbury Street, 2nd floor, Boston, MA, US / info@empow.co                       © empow Cyber Security Inc. 2018. All rights reserved.