#отправка в определенный обработчик, в других файлах, на основе поля category
#при добавлении новых протоколов/файлов необходимо обновлять
[transforms.category_route]
type = "route"
inputs = ["category"]
route.conn = '.category == "conn"'
route.known_hosts = '.category == "known_hosts"'
# Корпоративные протоколы
route.dce_rpc = '.category == "dce_rpc"'
route.dhcp = '.category == "dhcp"'
route.dns = '.category == "dns"'
route.ftp = '.category == "ftp"'
route.http = '.category == "http"'
route.kerberos = '.category == "kerberos"'
route.ntlm = '.category == "ntlm"'
route.ntp = '.category == "ntp"'
route.rdp = '.category == "rdp"'
route.smb_cmd = '.category == "smb_cmd"'
route.smb_mapping = '.category == "smb_mapping"'
route.smtp = '.category == "smtp"'
route.ssh = '.category == "ssh"'
route.ssl = '.category == "ssl"'
# Промышленные протоколы
route.cip = '.category == "cip_json"'
route.enip = '.category == "enip_json"'
route.modbus = '.category == "modbus_detailed"'
route.opcua = '.category == "opcua-binary"'
route.deltav = '.category == "deltav"'
# Отслеживание файлов
route.files = '.category == "files"'
route.pe = '.category == "pe"'
route.smb_files = '.category == "smb_files"'
# Данные для ML аналитики
route.dns_request = '.category == "dns_request"'
route.dns_response = '.category == "dns_response"'
# Уведомления (для EM)
route.dpi_event = 'starts_with(string!(.category), "dpi_event")'
# Уведомления для контроля тегов
route.modbus_tags = '.category == "tags_modbus"'
route.opcua_tags = '.category == "tags_opcua-binary"'
route.deltav_tags = '.category == "deltav_tags"'
