Repository navigation
TaggerFormat
Simple tagger files are just one like type element per line
Example list of ips
10.0.0.1 10.0.0.2 10.0.0.3
Tagger files can also set other moloch fields by appending a semicolon, the field name, and value.
Example same list of ips, but now we optionally set an extra tag and the dns.host name.
10.0.0.1;tags=extratag 10.0.0.2;tags=extratag;dns.host=bad.example.com 10.0.0.3
It is also possible to create NEW fields inside the tagger file. These new fields are comments and must start with #field:. To save typing and bytes, it is possible to create shortcuts that are valid just for that file.
Example same list of ips, but now we create 2 new fields: whatever.str and whatever.int, plus create a shortcut for the tags field.
#field:whatever.str;kind:lotermfield;count:true;friendly:A String;db:whatever.str-term;help:Help for String;shortcut:0 #field:whatever.int;kind:integer;count:true;friendly:A Integer;db:whatever.dbint;help:Help for integer;shortcut:1 #field:tags;shortcut:2 10.0.0.1;0=string;1=1;2=atag 10.0.0.2;tags=canstillusefullname 10.0.0.3
Field definition
| Setting | Default | Description |
| field | REQUIRED | The field expression |
| kind | REQUIRED |
|
| count | false | Track number of items with a .cnt field auto created |
| friendly | fieldname | A SHORT description, used in SPI View |
| db | REQUIRED | The DB field name, must end with -term for term fields which is what you want for most strings. |
| group | Before first dot in field or general | Category for SPI view |
| help | fieldname | Help to display in about box |
| shortcut | NONE | Used when loading file |
When the tagger format is used with the WISE plugin it is also possible to specify the view to use by using a leading #view:. The view section is written in the jade templating language which is very sensitive to spaces.
Same example as above, but now have a view for the whatever fields.
#field:whatever.str;kind:lotermfield;count:true;friendly:A String;db:whatever.str-term;help:Help for String;shortcut:0 #field:whatever.int;kind:integer;count:true;friendly:A Integer;db:whatever.dbint;help:Help for integer;shortcut:1 #field:tags;shortcut:2 #view:if (session.whatever) #view: div.sessionDetailMeta.bold Whatever #view: dl.sessionDetailMeta #view: +arrayList(session.wise, 'str-term', 'Str', 'whatever.str') #view: +arrayList(session.wise, 'dbint', 'Ints', 'whatever.int') 10.0.0.1;0=string;1=1;2=atag 10.0.0.2;tags=canstillusefullname 10.0.0.3