Fix Tailscale.Network selectors to be able to reach attribute of the …

…object in array
panther-labs · Dec 6, 2023 · 0e89675 · 0e89675
1 parent 3c56446
commit 0e89675
Show file tree

Hide file tree

Showing 11 changed files with 88 additions and 88 deletions.
diff --git a/lookup_tables/greynoise/advanced/noise_advanced.yml b/lookup_tables/greynoise/advanced/noise_advanced.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/advanced/riot_advanced.yml b/lookup_tables/greynoise/advanced/riot_advanced.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/basic/noise_basic.yml b/lookup_tables/greynoise/basic/noise_basic.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/basic/riot_basic.yml b/lookup_tables/greynoise/basic/riot_basic.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_asn.yml b/lookup_tables/ipinfo/ipinfo_asn.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_asn_datalake.yml b/lookup_tables/ipinfo/ipinfo_asn_datalake.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_location.yml b/lookup_tables/ipinfo/ipinfo_location.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_location_datalake.yml b/lookup_tables/ipinfo/ipinfo_location_datalake.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_privacy.yml b/lookup_tables/ipinfo/ipinfo_privacy.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_privacy_datalake.yml b/lookup_tables/ipinfo/ipinfo_privacy_datalake.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/tor/tor_exit_nodes.yml b/lookup_tables/tor/tor_exit_nodes.yml
@@ -424,14 +424,14 @@ LogTypeMap:
         - "$.content.userOriginIP"
     - LogType: Tailscale.Network
       Selectors:
-        - "$.event.virtualTraffic.srcIp"
-        - "$.event.virtualTraffic.dstIp"
-        - "$.event.subnetTraffic.srcIp"
-        - "$.event.subnetTraffic.dstIp"
-        - "$.event.exitTraffic.srcIp"
-        - "$.event.exitTraffic.dstIp"
-        - "$.event.physicalTraffic.srcIp"
-        - "$.event.physicalTraffic.dstIp"
+        - "$.event.virtualTraffic[].srcIp"
+        - "$.event.virtualTraffic[].dstIp"
+        - "$.event.subnetTraffic[].srcIp"
+        - "$.event.subnetTraffic[].dstIp"
+        - "$.event.exitTraffic[].srcIp"
+        - "$.event.exitTraffic[].dstIp"
+        - "$.event.physicalTraffic[].srcIp"
+        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"