New Kit: synology

[kris-watts-gravwell]

New kit request from discord user.

Here is the log format:

if [type] == "Synology" {
                        grok {
                            match => { "message" => [
                              "^<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:host_title} WinFileService Event: %{WORD:action}, Path: %{GREEDYDATA:path}, File/Folder: %{WORD:path_type}, Size: %{BASE10NUM:file_size} %{WORD:file_size_unit}, User: %{USERNAME:username}, IP: %{IP:src_ip}",
                              "^<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:host_title} Connection: User [%{USERNAME:username}] from [%{HOSTNAME:Equipment}(%{IP:src_ip})] via [%{DATA:Protocol}] %{GREEDYDATA:Message} [%{DATA:shared_folder}]",
                              "^<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:host_title} Connection: User [(%{USERNAME:username})?] from [%{IP:src_ip}] %{GREEDYDATA:Message}",
                              "^<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:hosttitle} <span class="tr" id="tr_0" data-source="" data-orig="Connection">Connection</span>[%{INT:Id_proc}]: SYSTEM: %{GREEDYDATA:Message}",
                              "^<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:host_title} System %{USERNAME:username}: %{GREEDYDATA:Message}"