Update 11-pf.conf

11-pf.conf

@@ -28,13 +28,13 @@ filter {
     }
     if [prog] =~ /^suricata/ {
       mutate {
-                add_tag => [ "Suricata" ]
+        add_tag => [ "SuricataIDPS" ]
       }
       grok {
           patterns_dir => ["/etc/logstash/conf.d/patterns"]
           match => [ "message", "%{SURICATA}"]
       }
-                if ![geoip] and [ids_src_ip] !~ /^(10\.|192\.168\.)/ {
+        if ![geoip] and [ids_src_ip] !~ /^(10\.|172\.22\.|192\.168\.)/ {
           geoip {
             add_tag => [ "GeoIP" ]
             source => "ids_src_ip"
@@ -103,7 +103,15 @@ filter {
       mutate {
           lowercase => [ 'proto' ]
       }
-                if ![geoip] and [src_ip] !~ /^(10\.|192\.168\.)/ {
+      if ![geoip] and [src_ip] {
+        # Check if source IP address is private.
+        cidr {
+               address => [ "%{[src_ip]}" ]
+               network => [ "0.0.0.0/32", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fc00::/7", "127.0.0.0/8", "::1/128", "169.254.0.0/16", "fe80::/10", "224.0.0.0/4", "ff00::/8", "255.255.255.255/32", "::" ]
+               add_field => { "[@metadata][src_locality]" => "private" }
+        }
+        # Check to see if src_locality exists. If it doesn't the src_addr didn't match a private address space and locality must be public.
+        if ![@metadata][src_locality] {
           geoip {
             add_tag => [ "GeoIP" ]
             source => "src_ip"
@@ -113,3 +121,4 @@ filter {
       }
     }
   }
+}