Use the same set of log sources in all lookup tables

lookup_tables/greynoise/advanced/noise_advanced.yml

@@ -14,6 +14,11 @@ LogTypeMap:
     - LogType: AlphaSOC.Alert
       Selectors:
         - "$.event.srcIP"
+    - LogType: Amazon.EKS.Audit
+      Selectors:
+        - "$.sourceIPs"
+        - "$.spec.clusterIP"
+        - "$.requestObject.spec.clusterIP"
     - LogType: Apache.AccessCombined
       Selectors:
         - "remote_host_ip_address"
@@ -23,6 +28,9 @@ LogTypeMap:
     - LogType: Atlassian.Audit
       Selectors:
         - "$.attributes.location.ip"
+    - LogType: Asana.Audit
+      Selectors:
+        - "$.context.client_ip_address"
     - LogType: AWS.ALB
       Selectors:
         - "clientIp"
@@ -49,6 +57,9 @@ LogTypeMap:
     - LogType: AWS.WAFWebACL
       Selectors:
         - "$.httpRequest.clientIp"
+    - LogType: Box.Event
+      Selectors:
+        - "ip_address"
     - LogType: CiscoUmbrella.CloudFirewall
       Selectors:
         - "destinationIp"
@@ -57,6 +68,10 @@ LogTypeMap:
       Selectors:
         - "externalIp"
         - "internalIp"
+    - LogType: CiscoUmbrella.IP
+      Selectors:
+        - "destinationIp"
+        - "sourceIp"
     - LogType: CiscoUmbrella.Proxy
       Selectors:
         - "destinationIp"
@@ -102,24 +117,48 @@ LogTypeMap:
         - "LocalAddressIP6"
         - "RemoteAddressIP4"
         - "RemoteAddressIP6"
+    - LogType: Crowdstrike.NotManagedAssets
+      Selectors:
+        - "aip"
+        - "CurrentLocalIP"
+    - LogType: Crowdstrike.ProcessRollup2Stats
+      Selectors:
+        - "aip"
+    - LogType: Crowdstrike.SyntheticProcessRollup2
+      Selectors:
+        - "aip"
+    - LogType: Crowdstrike.Unknown
+      Selectors:
+        - "aip"
+    - LogType: Crowdstrike.UserIdentity
+      Selectors:
+        - "aip"
+    - LogType: Crowdstrike.UserLogonLogoff
+      Selectors:
+        - "aip"
     - LogType: Crowdstrike.FDREvent
       Selectors:
-        - 'p_any_ip_addresses'
+        - "p_any_ip_addresses"
+    - LogType: Dropbox.TeamEvent
+      Selectors:
+        - "$.origin.geo_location.ip_address"
     - LogType: Duo.Authentication
       Selectors:
         - "$.access_device.ip"
         - "$.auth_device.ip"
-    - LogType: Box.Event
-      Selectors:
-        - "ip_address"
     - LogType: GCP.AuditLog
       Selectors:
         - "$.protoPayload.requestMetadata.callerIP"
         - "$.httpRequest.remoteIP"
         - "$.httpRequest.serverIP"
+    - LogType: GCP.HTTPLoadBalancer
+      Selectors:
+        - "$.jsonPayload.removeIp"
+        - "$.httpRequest.remoteIp"
+        - "$.httpRequest.serverIp"
     - LogType: GitHub.Audit
       Selectors:
-        - 'actor_ip'
+        - "actor_ip"
     - LogType: GitLab.API
       Selectors:
         - "remote_ip"
@@ -136,6 +175,9 @@ LogTypeMap:
     - LogType: GSuite.Reports
       Selectors:
         - "ipAddress"
+    - LogType: Jamfpro.Login
+      Selectors:
+        - "ipAddress"
     - LogType: Juniper.Access
       Selectors:
         # use p_any_ip_addresses because we extract ip addresses but have no fields
@@ -150,6 +192,13 @@ LogTypeMap:
     - LogType: Juniper.Security
       Selectors:
         - "source_ip"
+    - LogType: Lacework.AgentManagement
+      Selectors:
+        - "IP_ADDR"
+    - LogType: Lacework.DNSQuery
+      Selectors:
+        - "DNS_SERVER_IP"
+        - "HOST_IP_ADDR"
     - LogType: Lacework.Events
       Selectors:
         # use p_any_ip_addresses because we extract ip addresses but fields are variable
@@ -171,6 +220,13 @@ LogTypeMap:
     - LogType: Microsoft365.DLP.All
       Selectors:
         - "ClientIP"
+    - LogType: MicrosoftGraph.SecurityAlert
+      Selectors:
+        # use p_any_ip_addresses because we extract ip addresses but fields are variable
+        - "p_any_ip_addresses"
+    - LogType: MongoDB.ProjectEvent
+      Selectors:
+        - "remoteAddress"
     - LogType: Nginx.Access
       Selectors:
         - "remoteAddr"
@@ -186,6 +242,11 @@ LogTypeMap:
     - LogType: OnePassword.SignInAttempt
       Selectors:
         - "$.client.ip_address"
+    - LogType: OSSEC.EventInfo
+      Selectors:
+        - "agentip"
+        - "dstip"
+        - "srcip"
     - LogType: Panther.Audit
       Selectors:
         - "sourceIP"
@@ -219,46 +280,55 @@ LogTypeMap:
       Selectors:
         - "dest_ip"
         - "src_ip"
+    - LogType: Sysdig.Audit
+      Selectors:
+        - "$.content.userOriginIP"
+    - LogType: Workday.Activity
+      Selectors:
+        - "ipAddress"
+    - LogType: Workday.SignOnAttempt
+      Selectors:
+        - "Session_IP_Address"
     - LogType: Zeek.Conn
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.DNS
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.DPD
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.HTTP
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.Notice
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.NTP
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.Ssh
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.Ssl
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.Tunnel
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zeek.Weird
       Selectors:
-        - '$.id.orig_h'
-        - '$.id.resp_h'
+        - "$.id.orig_h"
+        - "$.id.resp_h"
     - LogType: Zendesk.Audit
       Selectors:
         - "ip_address"