# 
#  Argus-5.0 Client Software
#  Raconvert Conversion Map Example
#  Copyright (c) 2000-2022 QoSient, LLC
#  All rights reserved.
#
#  Raconvert configuration for json data conversion
#
#  Tue 16 Jun 10:33:20 EDT 2020
#  Carter Bullard
#  QoSient, LLC
# 
#  Example  raconvert.conf
#
#  This file is provided to describe the conversion of non-argus flow data
#  output fields to argus flow data fields.  This should provide a mapping of
#  column titles, in the case of csv, or key values, in the case of json,
#  and types to argus data fields and types.
#
#  Fields that don't have a mapping are ignored, for fields where there are
#  mappings, but the data type is incorrect, the mapping is ignored. When multiple
#  fields map to a single argus data element (ie a label), a simple directive
#  can be provided to indicate what action should be taken, ignore, replace, append.
#
#
#  Variable Syntax
#  
#  Variable assignments must be of the form:
#
#    VARIABLE=
#
#  with no white space between the VARIABLE and the '=' sign.
#  Quotes are optional for string arguements, but if you want
#  to embed comments, then quotes are required.
#
#  Specify the originator of the data to convert.  Because raconvert.1 is designed
#  to accept any ascii type of input, it doesn't have to have a source, and so this
#  variable is optional.
#
#  By specifying the source, you can identify data types for downstream analytics.
#
#  Supported sources are:
#    argus
#    netflow
#    suricata
#    zeek
#    json
#    none
#
RACONVERT_SOURCE=json


# For ra() like clients, the format that is used to print
# timestamps, is based on the strftime() library call, with
# an extension to print fractions of a sec "%f".  The
# default is "%T.%f".  You can overide this default time
# format by setting this variable.  This string must conform
# to the format specified in strftime().  Malformed strings can
# generate interesting output, so be aware with this one, and
# don't forget the '.' when doing fractions of a second.
#
#RACONVERT_TIME_FORMAT="%Y/%m/%d"
#RACONVERT_TIME_FORMAT="%Y/%m/%d.%T.%f"

RACONVERT_TIME_FORMAT="%Y-%m-%dT%H:%M:%S.%fZ"

# Argus Monitor Data is uniquely identifiable based on the source
# identifier that is included in each output record.  This is to
# allow you to work with Argus Data from multiple monitors at the
# same time.  The ID can be 128 bits long, and argus suppors a
# number of formats as legitimate values. 
#
#    128-bit uuid
#    IPv4 addresses 
#    IPv6 addresses 
#    Ethernet addresses
#    unsigned ints
#    4 bytes strings
#
# The formats are discerned from the values provided.  Double-quoted
# values are treated as strings, and are truncated to 4 characters.
# Non-quoted values are tested for whether they are hostnames, and if
# not, then they are tested wheter they are numbers.
#
# The configuration allows for you to use host names, however, you
# should have some understanding as to how `hostname` will be
# resolved by the nameserver before commiting to this strategy.
#
# For convenience, argus supports the notion of "`hostname`" for
# assigning the probe's id.  This is to support management of
# large deployments, so you can have one argus.conf file that works
# for a lot of probes.
#
# For security, argus does not rely on system programs, like hostname.1.
# It implements the logic of hostname itself, so don't try to run
# arbitrary programs using this method, because it won't work.
#
# The syntax for the monitor id, srcid,  is:
#     [type:/]sid
#        where type can be:
#           int, str, ipv4, ipv6, uuid
#
#        where sid can be:
#           int, "string", ipv4, ipv6, uuid
#
# Examples include:
#   fe80::1
#   192.168.8.68
#   2345
#   ipv4:/192.168.8.68
#   D1EE0C4B-E247-4EA7-9765-4C902899B75A
#   uuid:/D1EE0C4B-E247-4EA7-9765-4C902899B75A
#
#ARGUS_MONITOR_ID="zeek"
ARGUS_MONITOR_ID=192.168.8.68
#ARGUS_MONITOR_ID=2345678
#ARGUS_MONITOR_ID=uuid:/D1EE0C4B-E247-4EA7-9765-4C902899B75A

#
# Specify the fields that are expected in this conversion stream.  This is providied if the input file doesn't have a column header.
#

RACONVERT_FIELD_SPECIFIER= srcid rank seq autoid stime ltime dur idle sstime sltime sdur ddur dstime dltime rtime offset srng erng trans flgs mean stddev min max sum snet saddr dir dnet daddr proto sport dport sco dco stos dtos sdsb ddsb sttl dttl shops dhops sipid dipid pkts spkts dpkts bytes sbytes dbytes appbytes sappbytes dappbytes load sload dload rate srate drate loss sloss dloss ploss sploss dploss retrans sretrans dretrans pretrans spretrans dpretrans sgap dgap nstroke snstroke dnstroke senc denc bssid ssid soui doui smac dmac sas das ias smpls dmpls svlan dvlan svid dvid svpri dvpri sintpkt dintpkt sintpktact dintpktact sintpktidl dintpktidl sintpktmax sintpktmin dintpktmax dintpktmin sintpktactmax sintpktactmin dintpktactmax dintpktactmin sintpktidlmax sintpktidlmin dintpktidlmax dintpktidlmin sjit djit sjitact djitact sjitidl djitidl state cause resp dldur dlstime dlltime dspkts ddpkts dlspkt dldpkt dsbytes ddbytes pdspkts pddpkts pdsbytes pddbytes spktsz smeansz smaxsz sminsz dpktsz dmeansz dmaxsz dminsz sintdist dintdist sintdistact dintdistact sintdistidl dintdistidl suser duser label icmpid tcpopt tcpext stcpmax dtcpmax swin dwin jdelay ldelay bins binnum stcpb dtcpb tcprtt synack ackdat inode smaxsz sminsz dmaxsz dminsz

# Specify the field separation character. This can be a single character or a string that contains all separators.

RACONVERT_FIELD_DELIMITER=''

# An empty/non-existing field values can have a lot of different interpretations (should be expected but not available, empty 
# because it was stripped, etc ... Here you can specify different indications, if used, for when a field is empty (zero value)
# and when it wasn't defined in the input data.
#
RACONVERT_FIELD_EMPTY=''
RACONVERT_FIELD_UNDEFINED='-'

# This will provide conversion information needed for foriegn data labels.  Need to provide the name of the data label,
# what it will be mapped to, the data type (for correctness) and what to do if there are multiple values mapped to the
# same argus field.  Generally you will ignore the redundant value (-), replace existing values with this value (), 
# or you will append (+).
# 
# Labels are constucted as traditional argus metadata labels, using the original column name as the key:
#    column=string 
# 
# Additional processing needed to generate a reasonable label, such as field substitution or quoting can be
# specified using the RA_LABEL_CONVERSION variable (to be implemented) ...

#RACONVERT_CONVERSION_MAP= 

