# 
#  Argus-5.0 Client Software
#  Raconvert Conversion Map Example
#  Copyright (c) 2000-2022 QoSient, LLC
#  All rights reserved.
#
#  Raconvert configuration for zeek conversion
#
#  Tue 16 Jun 10:33:20 EDT 2020
#  Carter Bullard
#  QoSient, LLC
# 
#  Example  raconvert.conf
#
#  This file is provided to describe the conversion of non-argus flow data
#  output fields to argus flow data fields.  This should provide a mapping of
#  column titles and types to argus data fields and types.
#
#  Fields that don't have a mapping are ignored, for fields where there are
#  mappings, but the data type is incorrect, the mapping is ignored. When multiple
#  fields map to a single argus data element (ie a label), a simple directive
#  can be provided to indicate what action should be taken, ignore, replace, append.
#
#
#  Variable Syntax
#  
#  Variable assignments must be of the form:
#
#    VARIABLE=
#
#  with no white space between the VARIABLE and the '=' sign.
#  Quotes are optional for string arguements, but if you want
#  to embed comments, then quotes are required.
#
#  Specify the originator of the data to convert.  Because raconvert.1 is designed
#  to accept any ascii type of input, it doesn't have to have a source, and so this
#  variable is optional.
#
#  By specifying the source, you can identify data types for downstream analytics.
#
#  Supported sources are:
#    argus
#    netflow
#    suricata
#    zeek
#    none
#
RACONVERT_SOURCE=zeek


# For ra() like clients, the format that is used to print
# timestamps, is based on the strftime() library call, with
# an extension to print fractions of a sec "%f".  The
# default is "%T.%f".  You can overide this default time
# format by setting this variable.  This string must conform
# to the format specified in strftime().  Malformed strings can
# generate interesting output, so be aware with this one, and
# don't forget the '.' when doing fractions of a second.
#
#RACONVERT_TIME_FORMAT="%Y/%m/%d"
#RACONVERT_TIME_FORMAT="%Y/%m/%d.%T.%f"

RACONVERT_TIME_FORMAT="%Y-%m-%dT%H:%M:%S.%fZ"

# Argus Monitor Data is uniquely identifiable based on the source
# identifier that is included in each output record.  This is to
# allow you to work with Argus Data from multiple monitors at the
# same time.  The ID can be 128 bits long, and argus suppors a
# number of formats as legitimate values. 
#
#    128-bit uuid
#    IPv4 addresses 
#    IPv6 addresses 
#    Ethernet addresses
#    unsigned ints
#    4 bytes strings
#
# The formats are discerned from the values provided.  Double-quoted
# values are treated as strings, and are truncated to 4 characters.
# Non-quoted values are tested for whether they are hostnames, and if
# not, then they are tested wheter they are numbers.
#
# The configuration allows for you to use host names, however, you
# should have some understanding as to how `hostname` will be
# resolved by the nameserver before commiting to this strategy.
#
# For convenience, argus supports the notion of "`hostname`" for
# assigning the probe's id.  This is to support management of
# large deployments, so you can have one argus.conf file that works
# for a lot of probes.
#
# For security, argus does not rely on system programs, like hostname.1.
# It implements the logic of hostname itself, so don't try to run
# arbitrary programs using this method, because it won't work.
#
# The syntax for the monitor id, srcid,  is:
#     [type:/]sid
#        where type can be:
#           int, str, ipv4, ipv6, uuid
#
#        where sid can be:
#           int, "string", ipv4, ipv6, uuid
#
# Examples include:
#   fe80::1
#   192.168.8.68
#   2345
#   ipv4:/192.168.8.68
#   D1EE0C4B-E247-4EA7-9765-4C902899B75A
#   uuid:/D1EE0C4B-E247-4EA7-9765-4C902899B75A
#
#ARGUS_MONITOR_ID="zeek"
ARGUS_MONITOR_ID=192.168.8.68
#ARGUS_MONITOR_ID=2345678
#ARGUS_MONITOR_ID=uuid:/D1EE0C4B-E247-4EA7-9765-4C902899B75A

#
# Specify the fields that are expected in this conversion stream.  This is providied if the input file doesn't have a column header.
#

#RACONVERT_FIELD_SPECIFIER=ts,uid,id.orig_h,id.orig_p,id.resp_h,id.resp_p,proto,service,duration,orig_bytes,resp_bytes,conn_state,local_orig,local_resp,missed_bytes,history,orig_pkts,orig_ip_bytes,resp_pkts,resp_ip_bytes,tunnel_parents,orig_l2_addr,resp_l2_addr
#
RACONVERT_FIELD_SPECIFIER=ts,uid,id.orig_h,id.orig_p,id.resp_h,id.resp_p,proto,service,duration,orig_bytes,resp_bytes,conn_state,local_orig,local_resp,missed_bytes,history,orig_pkts,orig_ip_bytes,resp_pkts,resp_ip_bytes,orig_cc,resp_cc,tunnel_parents,id.orig_h_name.vals,id.orig_h_name.src,id.resp_h_name.vals,id.resp_h_name.src,suri_ids

# Specify the field separation character. This can be a single character or a string that contains all separators.

RACONVERT_FIELD_DELIMITER='\t'

# An empty/non-existing field values can have a lot of different interpretations (should be expected but not available, empty 
# because it was stripped, etc ... Here you can specify different indications, if used, for when a field is empty (zero value)
# and when it wasn't defined in the input data.
#
RACONVERT_FIELD_EMPTY=''
RACONVERT_FIELD_UNDEFINED='-'

# This will provide conversion information needed for foriegn data labels.  Need to provide the name of the data label,
# what it will be mapped to, the data type (for correctness) and what to do if there are multiple values mapped to the
# same argus field.  Generally you will ignore the redundant value (-), replace existing values with this value (), 
# or you will append (+).
# 
# Labels are constucted as traditional argus metadata labels, using the original column name as the key:
#    column=string 
# 
# Additional processing needed to generate a reasonable label, such as field substitution or quoting can be
# specified using the RA_LABEL_CONVERSION variable (to be implemented) ...

RACONVERT_CONVERSION_MAP= 
   ts=StartTime, time
   uid=Label, string+
   id.orig_h=SrcAddr, addr
   id.orig_p=Sport, port
   id.resp_h=DstAddr, addr
   id.resp_p=Dport, port
   proto=Proto, proto
   service=Label, string+
   duration=Dur, interval
   orig_bytes=SrcAppBytes, count
   resp_bytes=DstAppBytes, count
   conn_state=State, string
   local_orig=Label, bool+
   local_resp=Label, bool+
   missed_bytes=Loss, count
   history=State, string+
   orig_pkts=SrcPkts, count
   orig_ip_bytes=SrcBytes, count
   resp_pkts=DstPkts, count
   resp_ip_bytes=DstBytes, count
   orig_cc=sCo, string
   resp_cc=dCo, string
   tunnel_parents=Label, string+
   orig_l2_addr=SrcMac, string
   resp_l2_addr=DstMac, string
   vlan=sVlan, int
   id.orig_h_name.vals=Label, string+
   id.orig_h_name.src=Label, string+
   id.resp_h_name.vals=Label, string+
   id.resp_h_name.src=Label, string+
   suri_ids=Label, string+


