OGO Shield WAF

Overview

OGO Shield Web Application Firewall provides protection and performance for your web applications and APIs.

This setup guide describes how to forward security events from OGO to Sekoia.io.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Benefit from SEKOIA.IO built-in rules and upgrade OGO WAF [BETA] with the following detection capabilities out-of-the-box.

SEKOIA.IO x OGO WAF [BETA] on ATT&CK Navigator

Burp Suite Tool Detected

Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner)

Effort: intermediate

Download Files From Non-Legitimate TLDs

Detects file downloads from non-legitimate TLDs. Additional legitimates TLDs should be filtered according to the business habits.

Effort: master

Nimbo-C2 User Agent

Nimbo-C2 Uses an unusual User-Agent format in its implants.

Effort: intermediate

Potential Azure AD Phishing Page (Adversary-in-the-Middle)

Detects an HTTP request to an URL typical of the Azure AD authentication flow, but towards a domain that is not one the legitimate Microsoft domains used for Azure AD authentication.

Effort: intermediate

Potential Bazar Loader User-Agents

Detects potential Bazar loader communications through the user-agent

Effort: elementary

Potential DNS Tunnel

Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.

Effort: advanced

Potential Lemon Duck User-Agent

Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".

Effort: elementary

SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

Effort: elementary

Telegram Bot API Request

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Effort: advanced

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
`Web application firewall logs`	OGO protects web applications and APIs

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	`event`
Category	`network`
Type	`["connection", "access"]`

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

allowed.jsonbanned.jsonblocked.jsondenied-by-access-rule.jsonexception.jsongeoblocked.jsonsuspicious.json

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"100000\",\n        \"driveUid\": \"\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "kind": "event",
        "type": [
            "connection",
            "access"
        ],
        "action": "brain",
        "module": "ogo.shield.waf",
        "dataset": "ogo-shield",
        "category": [
            "network"
        ],
        "duration": 0
    },
    "url": {
        "full": "https://example.com/index.html"
    },
    "source": {
        "ip": "20.20.20.20",
        "address": "20.20.20.20"
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "observer": {
        "type": "firewall",
        "vendor": "OGO Security",
        "product": "Web Application Firewall"
    },
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "location": {
                "lat": 48.844,
                "lon": 2.408
            },
            "city_name": "Paris",
            "country_iso_code": "FR"
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "ogo": {
        "site": "example.com",
        "blocked": "false",
        "auditMode": "false",
        "geoblocked": "false",
        "credibility": "100000",
        "appliedAction": "brain",
        "whitelistedIp": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        }
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    }
}

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"-1\",\n        \"driveUid\": \"4F1AB8245012413EBC182B80AAC1FFF3\",\n        \"driveLabel\":\"Linux files\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"true\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "kind": "event",
        "type": [
            "connection",
            "access"
        ],
        "action": "brain",
        "module": "ogo.shield.waf",
        "dataset": "ogo-shield",
        "category": [
            "network"
        ],
        "duration": 0
    },
    "url": {
        "full": "https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd"
    },
    "rule": {
        "uuid": "4F1AB8245012413EBC182B80AAC1FFF3",
        "name": "Linux files"
    },
    "source": {
        "ip": "20.20.20.20",
        "address": "20.20.20.20"
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "observer": {
        "type": "firewall",
        "vendor": "OGO Security",
        "product": "Web Application Firewall"
    },
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "location": {
                "lat": 48.844,
                "lon": 2.408
            },
            "city_name": "Paris",
            "country_iso_code": "FR"
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "ogo": {
        "site": "example.com",
        "blocked": "true",
        "auditMode": "false",
        "drive": {
            "uid": "4F1AB8245012413EBC182B80AAC1FFF3",
            "label": "Linux files"
        },
        "geoblocked": "false",
        "credibility": "-1",
        "appliedAction": "brain",
        "whitelistedIp": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        }
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    }
}

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"19000\",\n        \"driveUid\": \"4F1AB8245012413EBC182B80AAC1FFF3\",\n        \"driveLabel\":\"Linux files\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "kind": "event",
        "type": [
            "connection",
            "access"
        ],
        "action": "brain",
        "module": "ogo.shield.waf",
        "dataset": "ogo-shield",
        "category": [
            "network"
        ],
        "duration": 0
    },
    "url": {
        "full": "https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd"
    },
    "rule": {
        "uuid": "4F1AB8245012413EBC182B80AAC1FFF3",
        "name": "Linux files"
    },
    "source": {
        "ip": "20.20.20.20",
        "address": "20.20.20.20"
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "observer": {
        "type": "firewall",
        "vendor": "OGO Security",
        "product": "Web Application Firewall"
    },
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "location": {
                "lat": 48.844,
                "lon": 2.408
            },
            "city_name": "Paris",
            "country_iso_code": "FR"
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "ogo": {
        "site": "example.com",
        "blocked": "false",
        "auditMode": "false",
        "drive": {
            "uid": "4F1AB8245012413EBC182B80AAC1FFF3",
            "label": "Linux files"
        },
        "geoblocked": "false",
        "credibility": "19000",
        "appliedAction": "brain",
        "whitelistedIp": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        }
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    }
}

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/\",\n    \"ogo\": {\n        \"appliedAction\": \"denied\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"true\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "kind": "event",
        "type": [
            "connection",
            "access"
        ],
        "action": "denied",
        "module": "ogo.shield.waf",
        "dataset": "ogo-shield",
        "category": [
            "network"
        ],
        "duration": 0
    },
    "url": {
        "full": "https://example.com/"
    },
    "source": {
        "ip": "20.20.20.20",
        "address": "20.20.20.20"
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "observer": {
        "type": "firewall",
        "vendor": "OGO Security",
        "product": "Web Application Firewall"
    },
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "location": {
                "lat": 48.844,
                "lon": 2.408
            },
            "city_name": "Paris",
            "country_iso_code": "FR"
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "ogo": {
        "site": "example.com",
        "blocked": "true",
        "auditMode": "false",
        "geoblocked": "false",
        "appliedAction": "denied",
        "whitelistedIp": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        }
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    }
}

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"bypass\",\n        \"driveUid\": \"\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "kind": "event",
        "type": [
            "connection",
            "access"
        ],
        "action": "bypass",
        "module": "ogo.shield.waf",
        "dataset": "ogo-shield",
        "category": [
            "network"
        ],
        "duration": 0
    },
    "url": {
        "full": "https://example.com/index.html"
    },
    "source": {
        "ip": "20.20.20.20",
        "address": "20.20.20.20"
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "observer": {
        "type": "firewall",
        "vendor": "OGO Security",
        "product": "Web Application Firewall"
    },
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "location": {
                "lat": 48.844,
                "lon": 2.408
            },
            "city_name": "Paris",
            "country_iso_code": "FR"
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "ogo": {
        "site": "example.com",
        "blocked": "false",
        "auditMode": "false",
        "geoblocked": "false",
        "appliedAction": "bypass",
        "whitelistedIp": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        }
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    }
}

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"driveUid\": \"\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"true\",\n        \"blocked\": \"true\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "kind": "event",
        "type": [
            "connection",
            "access"
        ],
        "action": "brain",
        "module": "ogo.shield.waf",
        "dataset": "ogo-shield",
        "category": [
            "network"
        ],
        "duration": 0
    },
    "url": {
        "full": "https://example.com/index.html"
    },
    "source": {
        "ip": "20.20.20.20",
        "address": "20.20.20.20"
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "observer": {
        "type": "firewall",
        "vendor": "OGO Security",
        "product": "Web Application Firewall"
    },
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "location": {
                "lat": 48.844,
                "lon": 2.408
            },
            "city_name": "Paris",
            "country_iso_code": "FR"
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "ogo": {
        "site": "example.com",
        "blocked": "true",
        "auditMode": "false",
        "geoblocked": "true",
        "appliedAction": "brain",
        "whitelistedIp": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        }
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    }
}

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"99782\",\n        \"driveUid\": \"41150EF72BD544529AA67E9B1C0310DC\",\n        \"driveLabel\":\"Smart Rate Limiting\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "kind": "event",
        "type": [
            "connection",
            "access"
        ],
        "action": "brain",
        "module": "ogo.shield.waf",
        "dataset": "ogo-shield",
        "category": [
            "network"
        ],
        "duration": 0
    },
    "url": {
        "full": "https://example.com/index.html"
    },
    "rule": {
        "uuid": "41150EF72BD544529AA67E9B1C0310DC",
        "name": "Smart Rate Limiting"
    },
    "source": {
        "ip": "20.20.20.20",
        "address": "20.20.20.20"
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "observer": {
        "type": "firewall",
        "vendor": "OGO Security",
        "product": "Web Application Firewall"
    },
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "location": {
                "lat": 48.844,
                "lon": 2.408
            },
            "city_name": "Paris",
            "country_iso_code": "FR"
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "ogo": {
        "site": "example.com",
        "blocked": "false",
        "auditMode": "false",
        "drive": {
            "uid": "41150EF72BD544529AA67E9B1C0310DC",
            "label": "Smart Rate Limiting"
        },
        "geoblocked": "false",
        "credibility": "99782",
        "appliedAction": "brain",
        "whitelistedIp": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        }
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
`@timestamp`	`date`	Date/time when the event originated.
`client.address`	`keyword`	Client network address.
`client.geo.city_name`	`keyword`	City name.
`client.geo.country_iso_code`	`keyword`	Country ISO code.
`client.geo.location`	`geo_point`	Longitude and latitude.
`destination.domain`	`keyword`	The domain name of the destination.
`event.action`	`keyword`	The action captured by the event.
`event.category`	`keyword`	Event category. The second categorization field in the hierarchy.
`event.dataset`	`keyword`	Name of the dataset.
`event.duration`	`long`	Duration of the event in nanoseconds.
`event.kind`	`keyword`	The kind of the event. The highest categorization field in the hierarchy.
`event.module`	`keyword`	Name of the module this data is coming from.
`event.type`	`keyword`	Event type. The third categorization field in the hierarchy.
`http.request.body.bytes`	`long`	Size in bytes of the request body.
`http.request.method`	`keyword`	HTTP request method.
`http.request.referrer`	`keyword`	Referrer for this HTTP request.
`http.response.body.bytes`	`long`	Size in bytes of the response body.
`http.response.status_code`	`long`	HTTP response status code.
`observer.product`	`keyword`	The product name of the observer.
`observer.type`	`keyword`	The type of the observer the data is coming from.
`observer.vendor`	`keyword`	Vendor name of the observer.
`ogo.appliedAction`	`keyword`	Brain (analyzed)
`ogo.auditMode`	`keyword`	Is site in audit mode
`ogo.blocked`	`keyword`	Is request blocked
`ogo.credibility`	`keyword`	Credibility rating of the request. Once dropped below the acceptability threshold of the cluster (or of the site if overloaded by Expert mode), the IP is temporarily banned.
`ogo.drive.label`	`keyword`	Brain drive label
`ogo.drive.uid`	`keyword`	Brain drive UID
`ogo.geoblocked`	`keyword`	Is request geoblocked
`ogo.request.headers`	`keyword`	All request headers
`ogo.request.x_forwarded_for`	`keyword`	X-Forwarded-For header
`ogo.response.headers`	`keyword`	All response headers
`ogo.site`	`keyword`	Normalized FQDN
`ogo.whitelistedIp`	`keyword`	Is IP whitelisted
`rule.name`	`keyword`	Rule name
`rule.uuid`	`keyword`	Rule UUID
`server.address`	`keyword`	Server network address.
`server.ip`	`ip`	IP address of the server.
`source.ip`	`ip`	IP address of the source.
`tls.cipher`	`keyword`	String indicating the cipher used during the current connection.
`tls.version`	`keyword`	Numeric part of the version parsed from the original string.
`url.full`	`wildcard`	Full unparsed URL.
`url.path`	`wildcard`	Path of the request, such as "/search".
`url.query`	`keyword`	Query string of the request.
`user_agent.name`	`keyword`	Name of the user agent.
`user_agent.original`	`keyword`	Unparsed user_agent string.

Configure

Create the intake in Sekoia.io

Go to the intake page and create a new intake from the format OGO WAF. Copy the intake key.

Configure log export

Set up the export type

In the OGO interface, go to My Profile > Log Export. Select Sekoia as the export type and paste the intake key in the form.

Activate export for sites

In the general configuration tab of desired sites, in the Owner section, activate the Log export.

Activate export for clusters

For OGO Shield Satellite owners, go to Admin Cluster > Maintenance and activate the Log export.