feat: release v3.38.0 (#2783)

ajasnosz · sbylica-splunk · mstopa-splunk · web-flow · commit cd7621d9bd16 · 2025-08-04T14:51:55.000+02:00
* Changes to cisco asa and ftd parsers (#2765) Changes to cisco asa and ftd parsers * docs: updatw missing link in getting started (#2771) * fix: update dell powerstore index (#2770) * fix: update dell powerstore index * fix: remove change from enterprise * docs: Remove experimental status from SC4S Lite (#2773) Signed-off-by: mstopa-splunk <mstopa@splunk.com> * feat: add Suricata parser (#2774) * docs: add Google Analytics tracking to documentation site (#2779) Signed-off-by: Ilya Kheifets <ikheifets@splunk.com> * fix: add powerstore index var (#2786) * fix: add SC4S_OPTION_DELL_POWERSTORE_INDEX variable * docs: rewrite documentation for powerstore --------- Signed-off-by: mstopa-splunk <mstopa@splunk.com> Signed-off-by: Ilya Kheifets <ikheifets@splunk.com> Co-authored-by: Szymon Bylica <142112966+sbylica-splunk@users.noreply.github.com> Co-authored-by: mstopa-splunk <139441697+mstopa-splunk@users.noreply.github.com> Co-authored-by: Ilya Kheifets <138466237+ikheifets-splunk@users.noreply.github.com>
diff --git a/docs/experiments.md b/docs/experiments.md
@@ -14,8 +14,6 @@ SC4S processes incoming messages from a TCP connection in a single thread. While
 
 To learn more, see the [Configuration documentation](./configuration.md#parallelize), as well as this [blog post](https://www.syslog-ng.com/community/b/blog/posts/accelerating-single-tcp-connections-in-syslog-ng-parallelize).
 
-### SC4S Lite
-In the new 3.0.0 update, we've introduced SC4S Lite. SC4S Lite is designed for those who prefer speed and custom filters over the pre-set ones that come with the standard SC4S. It's similar to our default version, without the pre-defined filters and complex app_parser topics. More information can be found at [dedicated page.](./lite.md)
 ## > 2.13.0
 * In `env_file`, SC4S sets `SC4S_USE_NAME_CACHE=yes` to enable caching of the last valid host string, replaces nill, null, or IPv4 with the last good value, and stores this information in the `hostip.sqlite` file. 
     - Benefit: More correct host name values in Splunk when source vendor fails to provide valid syslog message.
diff --git a/docs/gettingstarted/index.md b/docs/gettingstarted/index.md
@@ -17,7 +17,7 @@ or resource constraint can cause data to be lost in transmission.
 * If you reguire high availability for SC4S, implement multi-node clustering.
 * Avoid TCP except where the source is unable to contain the event to a single UDP packet.
 * Avoid TLS except where the event may cross an untrusted network.
-* Plan for [appropriately sized hardware](../performance.md)
+* Plan for [appropriately sized hardware](../architecture/performance-tests.md)
 
 
 ## Implementation
diff --git a/docs/sources/vendor/Dell/emc_powerstore.md b/docs/sources/vendor/Dell/emc_powerstore.md
@@ -21,6 +21,9 @@
 
 ### Index Configuration
 
-| key                | sourcetype            | index    | notes |
-|--------------------|-----------------------|----------|-------|
-| dellemc_powerstore | `dell:emc:powerstore` | `netops` | none  |
+| key                | sourcetype            | index      | notes                                     |
+|--------------------|-----------------------|------------|-------------------------------------------|
+| dellemc_powerstore | `dell:emc:powerstore` | `infraops` | Default index changed in version `3.38.0` |
+
+In SC4S `v3.37.0` the data was sent to `netops` index by default. If you want to change the target index, 
+you can set the `SC4S_OPTION_DELL_POWERSTORE_INDEX` environment variable to specify a different index name.
diff --git a/docs/sources/vendor/Suricata/Suricata.md b/docs/sources/vendor/Suricata/Suricata.md
@@ -0,0 +1,37 @@
+# Suricata
+
+## Key facts
+* Message format: Based on the default `eve-log.identity` value in `suricata.yaml`, which is "suricata"
+* Legacy BSD Format default port 514
+
+## Links
+
+| Ref            | Link                                                                                                    |
+|----------------|---------------------------------------------------------------------------------------------------------|
+| Splunk Add-on  |                                                                                                         |
+| Product Manual | [Suricata Documentation](https://docs.suricata.io/)   |
+
+
+## Sourcetypes
+
+| sourcetype             | notes                                                                                                   |
+|------------------------|---------------------------------------------------------------------------------------------------------|
+| suricata:flow          | None                                                                                                    |
+| suricata:dns           | None                                                                                                    |
+| suricata:fileinfo      | None                                                                                                    |
+| suricata:http          | None                                                                                                    |
+| suricata:tls           | None                                                                                                    |
+| suricata:stats         | None                                                                                                    |
+| suricata:<event_type\>  | unlisted or new event_type (parsed but not guaranteed tested)                                           |
+
+## Sourcetype and Index Configuration
+
+| key                    | sourcetype            | index          | notes          |
+|------------------------|-----------------------|----------------|----------------|
+| suricata_suricata      | suricata:<event_type\> | netids         | none           |
+
+## Options
+
+| variable       | default        | description    |
+|----------------|----------------|----------------|
+| SC4S_SURICATA_SIMPLE_SOURCETYPE | false   | Set to 'yes' to assign a simple sourcetype 'suricata' to all events. Keep the default to assign compound sourcetypes such as 'suricata:flow', 'suricata:dns', etc. |
diff --git a/mkdocs.yml b/mkdocs.yml
@@ -5,6 +5,9 @@ plugins:
 extra:
   version:
     provider: mike
+  analytics:
+    provider: google
+    property: G-ZQQ3Q8N2WQ
 
 markdown_extensions:
   - toc:
@@ -68,7 +71,7 @@ nav:
       - Read First: "sources/index.md"
       - Basic Onboarding: "sources/base"
       - Known Vendors: "sources/vendor"
-  - SC4S Lite (Experimental):
+  - SC4S Lite:
       - Intro: "lite.md"
       - Pluggable modules: "pluggable_modules.md"
   - Edge Processor: "edge_processor.md"
diff --git a/package/enterprise/etc/conf.d/conflib/cisco-syslog/app-cisco-cisco_asa.conf b/package/enterprise/etc/conf.d/conflib/cisco-syslog/app-cisco-cisco_asa.conf
@@ -17,7 +17,7 @@ application app-cisco-cisco_asa[cisco_syslog] {
         message('%ASA-' type(string) flags(prefix))
         or (
             message('%FTD-' type(string) flags(prefix))
-            and not "${.values.mnemonic}" eq "430003"
+            and not match("^43000.$" value(".values.mnemonic"))
         );
     };	
     parser { app-cisco-cisco_asa(); };
diff --git a/package/enterprise/etc/conf.d/conflib/cisco-syslog/app-cisco-cisco_ftd.conf b/package/enterprise/etc/conf.d/conflib/cisco-syslog/app-cisco-cisco_ftd.conf
@@ -14,7 +14,7 @@ block parser app-cisco-cisco_ftd() {
 application app-cisco-cisco_ftd[cisco_syslog] {
 	filter {
         message('%FTD-' type(string) flags(prefix))
-        and "${.values.mnemonic}" eq "430003"
+        and match("^43000.$" value(".values.mnemonic"))
         ;
     };	
     parser { app-cisco-cisco_ftd(); };
diff --git a/package/enterprise/etc/conf.d/conflib/syslog/app-syslog-dell_powerstore.conf b/package/enterprise/etc/conf.d/conflib/syslog/app-syslog-dell_powerstore.conf
@@ -2,7 +2,7 @@ block parser app-syslog-dell_powerstore() {
  channel {
         rewrite {
             r_set_splunk_dest_default(
-                index('netops')
+                index('`SC4S_OPTION_DELL_POWERSTORE_INDEX`')
                 sourcetype('dell:emc:powerstore')
                 vendor('dellemc')
                 product('powerstore')
diff --git a/package/etc/conf.d/conflib/syslog/app-syslog-dell_powerstore.conf b/package/etc/conf.d/conflib/syslog/app-syslog-dell_powerstore.conf
@@ -2,7 +2,7 @@ block parser app-syslog-dell_powerstore() {
  channel {
         rewrite {
             r_set_splunk_dest_default(
-                index('netops')
+                index('`SC4S_OPTION_DELL_POWERSTORE_INDEX`')
                 sourcetype('dell:emc:powerstore')
                 vendor('dellemc')
                 product('powerstore')
diff --git a/package/etc/conf.d/conflib/syslog/app-syslog-suricata.conf b/package/etc/conf.d/conflib/syslog/app-syslog-suricata.conf
@@ -0,0 +1,59 @@
+block parser app-syslog-suricata() {
+ channel {
+    rewrite {
+        r_set_splunk_dest_default(
+            index('netids')
+            sourcetype('suricata')
+            vendor("suricata")
+            product("suricata")
+            template('t_json_values')
+        );
+    };
+
+    parser {
+        json-parser(
+            prefix('.values.')
+        );
+    };
+
+    if {
+        filter {
+            # Simple Suricata sourcetype: "suricata"
+            # Complex Suricata sourcetype: "suricata:flow", "suricata:dns", etc.
+            not "`SC4S_SURICATA_SIMPLE_SOURCETYPE`" eq "yes"
+            and "${.values.event_type}" ne "";
+        };	
+
+        rewrite {
+            r_set_splunk_dest_update_v2(
+                sourcetype('suricata:${.values.event_type}')
+            );
+        };
+    };
+
+    if {
+        filter {
+            "${.values.timestamp}" ne "";
+        };	
+
+        # 2025-07-04T10:20:33.093102+0000
+        parser {
+            date-parser(
+                format('%Y-%m-%dT%H:%M:%S.%f%z')
+                template("${.values.timestamp}")
+            );
+        };
+
+        rewrite { 
+            set-tag("json-timestamp-parsed");
+         };
+    };
+   };
+};
+
+application app-syslog-suricata[sc4s-syslog-pgm] {
+    filter {
+        program('suricata' type(string));
+    };	
+    parser { app-syslog-suricata(); };
+};
diff --git a/package/lite/etc/addons/cisco/app-cisco-cisco_asa.conf b/package/lite/etc/addons/cisco/app-cisco-cisco_asa.conf
@@ -17,7 +17,7 @@ application app-cisco-cisco_asa[cisco_syslog] {
         message('%ASA-' type(string) flags(prefix))
         or (
             message('%FTD-' type(string) flags(prefix))
-            and not "${.values.mnemonic}" eq "430003"
+            and not match("^43000.$" value(".values.mnemonic"))
         );
     };	
     parser { app-cisco-cisco_asa(); };
diff --git a/package/lite/etc/addons/cisco/app-cisco-cisco_ftd.conf b/package/lite/etc/addons/cisco/app-cisco-cisco_ftd.conf
@@ -14,7 +14,7 @@ block parser app-cisco-cisco_ftd() {
 application app-cisco-cisco_ftd[cisco_syslog] {
 	filter {
         message('%FTD-' type(string) flags(prefix))
-        and "${.values.mnemonic}" eq "430003"
+        and match("^43000.$" value(".values.mnemonic"))
         ;
     };	
     parser { app-cisco-cisco_ftd(); };
diff --git a/package/lite/etc/addons/dell/app-syslog-dell_powerstore.conf b/package/lite/etc/addons/dell/app-syslog-dell_powerstore.conf
@@ -2,7 +2,7 @@ block parser app-syslog-dell_powerstore() {
  channel {
         rewrite {
             r_set_splunk_dest_default(
-                index('netops')
+                index('`SC4S_OPTION_DELL_POWERSTORE_INDEX`')
                 sourcetype('dell:emc:powerstore')
                 vendor('dellemc')
                 product('powerstore')
diff --git a/package/lite/etc/addons/suricata/addon_metadata.yaml b/package/lite/etc/addons/suricata/addon_metadata.yaml
@@ -0,0 +1,2 @@
+---
+name: "suricata"
diff --git a/package/lite/etc/addons/suricata/app-syslog-suricata.conf b/package/lite/etc/addons/suricata/app-syslog-suricata.conf
@@ -0,0 +1,59 @@
+block parser app-syslog-suricata() {
+ channel {
+    rewrite {
+        r_set_splunk_dest_default(
+            index('netids')
+            sourcetype('suricata')
+            vendor("suricata")
+            product("suricata")
+            template('t_json_values')
+        );
+    };
+
+    parser {
+        json-parser(
+            prefix('.values.')
+        );
+    };
+
+    if {
+        filter {
+            # Simple Suricata sourcetype: "suricata"
+            # Complex Suricata sourcetype: "suricata:flow", "suricata:dns", etc.
+            not "`SC4S_SURICATA_SIMPLE_SOURCETYPE`" eq "yes"
+            and "${.values.event_type}" ne "";
+        };	
+
+        rewrite {
+            r_set_splunk_dest_update_v2(
+                sourcetype('suricata:${.values.event_type}')
+            );
+        };
+    };
+
+    if {
+        filter {
+            "${.values.timestamp}" ne "";
+        };	
+
+        # 2025-07-04T10:20:33.093102+0000
+        parser {
+            date-parser(
+                format('%Y-%m-%dT%H:%M:%S.%f%z')
+                template("${.values.timestamp}")
+            );
+        };
+
+        rewrite { 
+            set-tag("json-timestamp-parsed");
+         };
+    };
+   };
+};
+
+application app-syslog-suricata[sc4s-syslog-pgm] {
+    filter {
+        program('suricata' type(string));
+    };	
+    parser { app-syslog-suricata(); };
+};
diff --git a/package/lite/etc/config.yaml b/package/lite/etc/config.yaml
@@ -86,3 +86,4 @@ addons:
   - netwrix
   - aviatrix
   - veeam
+  - suricata
diff --git a/package/sbin/entrypoint.sh b/package/sbin/entrypoint.sh
@@ -23,7 +23,7 @@ export SC4S_LISTEN_CHECKPOINT_SPLUNK_NOISE_CONTROL_SECONDS=${SC4S_LISTEN_CHECKPO
 export SC4S_DEST_SPLUNK_INDEXED_FIELDS=${SC4S_DEST_SPLUNK_INDEXED_FIELDS:=r_unixtime,facility,container,loghost,destport,fromhostip,proto,severity}
 
 export SC4S_OPTION_FORTINET_SOURCETYPE_PREFIX=${SC4S_OPTION_FORTINET_SOURCETYPE_PREFIX:=fgt}
-
+export SC4S_OPTION_DELL_POWERSTORE_INDEX=${SC4S_OPTION_DELL_POWERSTORE_INDEX:=infraops}
 # Variables with path to sc4s directories
 # These path variables allow for a single entrypoint script to be utilized for both Container and BYOE runtimes
 export SC4S_ETC=${SC4S_ETC:=/etc/syslog-ng}
diff --git a/tests/test_dell_powerstore.py b/tests/test_dell_powerstore.py
@@ -52,7 +52,7 @@ def test_dell_powerstore(
     sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
 
     st = env.from_string(
-        'search index=netops _time={{ epoch }} sourcetype="dell:emc:powerstore" (host="{{ host }}" OR "{{ host }}")'
+        'search index=infraops _time={{ epoch }} sourcetype="dell:emc:powerstore" (host="{{ host }}" OR "{{ host }}")'
     )
     search = st.render(epoch=epoch, host=host)
 
diff --git a/tests/test_suricata.py b/tests/test_suricata.py

Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ block parser app-cisco-cisco_ftd() {`
`14`	`14`	`application app-cisco-cisco_ftd[cisco_syslog] {`
`15`	`15`	`filter {`
`16`	`16`	`message('%FTD-' type(string) flags(prefix))`
`17`		`- and "${.values.mnemonic}" eq "430003"`
	`17`	`+ and match("^43000.$" value(".values.mnemonic"))`
`18`	`18`	`;`
`19`	`19`	`};`
`20`	`20`	`parser { app-cisco-cisco_ftd(); };`