# Input to Output Definitions
# Version 1.46 - add qradar as log destination for 28/2921
# and remove QRoC as log destination for CPLOG2 events.

# TCP Inputs
input(name="tcp514" type="imptcp" port="514")

# UDP Inputs
input(name="udp514" type="imudp" port="514")
input(name="udp515" type="imudp" port="515")
input(name="udp516" type="imudp" port="516")
input(name="udp517" type="imudp" port="517")
input(name="udp518" type="imudp" port="518")
input(name="udp519" type="imudp" port="519")
input(name="udp520" type="imudp" port="520")
input(name="udp521" type="imudp" port="521")
input(name="udp522" type="imudp" port="522")
input(name="udp1517" type="imudp" port="1517")

## Input-to-Output Flows
#
# Process incoming events from UDP 514
if (re_match($inputname, "udp514"))
  then {
    call syslog.qradar
    call qradar.local
    stop
}

# Process Zscaler messages on TCP 514
if ( $inputname == "tcp514" and $msg contains "ConnectorZEN")
  then {
    call zpa.omsagent
    call omsagent.local
    stop
}

# Process incoming events from TCP 514, everything except Zscaler ZPA
# May be needed for Zscaler ZIA
if ( $inputname == "tcp514")
  then {
    call syslog.qradar
    call qradar.local
    stop
}

# Process incoming events from UDP 515
if (re_match($inputname, "udp515"))
  then {
    call syslog.omsagent
    call omsagent.local
    stop
}

# Process incoming events from UDP 516
if (re_match($inputname, "udp516"))
  then {
    call syslog.omsagent
    call omsagent.local
    stop
}

# Process incoming events from UDP 517
if (re_match($inputname, "udp517"))
  then {
    call syslog.omsagent
    call syslog.qradar
    call omsagent.local
    call qradar.local
    stop
}

# Process incoming events from UDP 1517 for Cisco ASA only
if (re_match($inputname, "udp1517") and ($rawmsg contains "ASA-"))
  then {
    call syslog.omsagent
    call syslog.qradar
    call syslog.kiwi2
    call omsagent.local
    call qradar.local
    call kiwi.local
    stop
}

# Process incoming events from UDP 1517 for anything other than Cisco ASA
if (re_match($inputname, "udp1517"))
  then {
    call syslog.omsagent
    call syslog.qradar
    call syslog.kiwi2
    call omsagent.local
    call qradar.local
    call kiwi.local
    stop
}

# Process incoming events from UDP 518
if (re_match($inputname, "udp518"))
  then {
    call syslog.qradar
    call qradar.local
    stop
}

# Process incoming events from UDP 519
if (re_match($inputname, "udp519"))
  then {
    call syslog.omsagent
    call omsagent.local
    stop
}

# Process incoming events from UDP 520 AND dow-mid-us-cplog2
if (re_match($inputname, "udp520") and ($fromhost-ip == "XXX.XXX.XXX.XXX"))
  then {
    call syslog.omsagent
    call omsagent.local
    stop
}

# Process incoming events from UDP 520 but not from dow-mid-us-cplog2
if (re_match($inputname, "udp520"))
  then {
    call syslog.qradar
    call qradar.local
    stop
}


# syslog catch all - Process Syslog messages not filtered by any of the
# conditions above
if (re_match($inputname, "udp[0-9]+"))
  then {
    call unfiltered.local
    stop
}
