CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix yaml for idh,es,kib,esalert

Browse Source
This commit is contained in:
Mike Reeves
2022-09-09 15:55:51 -04:00
parent 16f2059f17
commit 037d5d1c46
4 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elastalert/init.sls
View File

@@ -4,7 +4,7 @@
{% from 'allowed_states.map.jinja' import allowed_states %} {% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %} {% if sls in allowed_states %}
{% from 'elastalert/elastalert_config.map.jinja' import elastalert_defaults as elastalert_config with context %} {% from 'elastalert/elastalert_config.map.jinja' import ELASTALERT as elastalert_config with context %}
{% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %} {% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %} {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}

18
salt/elastalert/soc_elastalert.yaml
View File

@@ -1,25 +1,25 @@
elastalert: elastalert:
config: config:
disable_rules_on_error: false disable_rules_on_error:
description: Disable rules on failure. description: Disable rules on failure.
run_every: run_every:
minutes: 3 minutes:
description: Amount of time in minutes between searches. description: Amount of time in minutes between searches.
buffer_time: buffer_time:
minutes: 10 minutes:
description: Amount of time in minutes to look through. description: Amount of time in minutes to look through.
old_query_limit: old_query_limit:
minutes: 5 minutes:
description: Amount of time in minutes between queries to start at the most recently run query. description: Amount of time in minutes between queries to start at the most recently run query.
es_conn_timeout: 55 es_conn_timeout:
description: Timeout in seconds for connecting to and reading from Elasticsearch. description: Timeout in seconds for connecting to and reading from Elasticsearch.
max_query_size: 5000 max_query_size:
description: The maximum number of documents that will be downloaded from Elasticsearch in a single query. description: The maximum number of documents that will be downloaded from Elasticsearch in a single query.
alert_time_limit: alert_time_limit:
days: 2 days:
description: The retry window for failed alerts. description: The retry window for failed alerts.
index_settings: index_settings:
shards: 1 shards:
description: The amount of shards to use for elastalert. description: The amount of shards to use for elastalert.
replicas: 0 replicas:
description: The amount of replicas for the Elastalert index. description: The amount of replicas for the Elastalert index.

10
salt/influxdb/soc_influxdb.yaml
View File

@@ -1,16 +1,16 @@
influxdb: influxdb:
retention_policies: retention_policies:
so_short_term: so_short_term:
duration: 30d duration:
description: Amount of time to keep short term data. description: Amount of time to keep short term data.
shard_duration: 1d shard_duration:
description: Time range description: Time range
so_long_term: so_long_term:
duration: 0d duration:
description: Amount of time to keep long term downsampled data. description: Amount of time to keep long term downsampled data.
shard_duration: 7d shard_duration:
description: Amount of the time range covered by the shard group. description: Amount of the time range covered by the shard group.
downsample: downsample:
so_long_term: so_long_term:
resolution: 5m resolution:
description: Amount of time to turn into a single data point. description: Amount of time to turn into a single data point.

2
salt/kibana/soc_kibana.yaml
View File

@@ -1,5 +1,5 @@
kibana: kibana:
config: config:
elasticsearch: elasticsearch:
requestTimeout: 90000 requestTimeout:
description: Request timeout length. description: Request timeout length.