CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-17 14:33:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add so-user-disable script which deletes the SOC user and disables the users in Fleet, TheHive, and Cortex

Browse Source
This commit is contained in:
Jason Ertel
2020-09-02 13:54:44 -04:00
parent 9d85b3223f
commit 0142f43493
8 changed files with 182 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
salt/common/tools/sbin/so-user
View File

@@ -179,9 +179,9 @@ case "${operation}" in
validateEmail "$email"
createUser "$email"
echo "Successfully added new user to SOC"
check_container thehive && echo $password | so-thehive-user-add "$email"
check_container cortex && echo $password | so-cortex-user-add "$email"
check_container fleet && echo $password | so-fleet-user-add "$email"
check_container thehive && (echo $password | so-thehive-user-add "$email" || so-thehive-user-enable "$email" true)
check_container cortex && (echo $password | so-cortex-user-add "$email" || so-cortex-user-enable "$email" true)
check_container fleet && (echo $password | so-fleet-user-add "$email" || so-fleet-user-enable "$email" true)
;;
"list")
@@ -202,7 +202,10 @@ case "${operation}" in
[[ "$email" == "" ]] && fail "Email address must be provided"
deleteUser "$email"
echo "Successfully deleted user"
echo "Successfully deleted user"
check_container thehive && so-thehive-user-enable "$email" false
check_container cortex && so-cortex-user-enable "$email" false
check_container fleet && so-fleet-user-enable "$email" false
;;
"validate")