CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

so-import-evtx - tweaks

Browse Source
This commit is contained in:
Josh Brower
2021-09-14 12:01:14 -04:00
parent 7b93f355e2
commit 0b0d508585
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/common/tools/sbin/so-import-evtx
View File

@@ -46,7 +46,7 @@ function evtx2es() {
so-evtx2es02 \ so-evtx2es02 \
--host {{ MANAGERIP }} --scheme https \ --host {{ MANAGERIP }} --scheme https \
--index so-beats-$INDEX_DATE --pipeline import.wel \ --index so-beats-$INDEX_DATE --pipeline import.wel \
--login {{ES_USER}} --pwd {{ES_PW}} "/tmp/$RUNID.evtx" 2>&1 --login {{ES_USER}} --pwd {{ES_PW}} "/tmp/$RUNID.evtx" 1>/dev/null 2>/dev/null
docker run --rm \ docker run --rm \
@@ -75,7 +75,7 @@ for i in "$@"; do
fi fi
done done
# track if we have any valid or invalid pcaps # track if we have any valid or invalid evtx
INVALID_EVTXS="no" INVALID_EVTXS="no"
VALID_EVTXS="no" VALID_EVTXS="no"
@@ -108,14 +108,10 @@ for EVTX in "$@"; do
EVTX_DIR=$HASH_DIR/evtx EVTX_DIR=$HASH_DIR/evtx
mkdir -p $EVTX_DIR mkdir -p $EVTX_DIR
# generate IDS alerts and write them to standard pipeline # import evtx and write them to import ingest pipeline
echo "- importing logs with evtx2es" echo "- importing logs with evtx2es"
evtx2es "${EVTX}" $HASH evtx2es "${EVTX}" $HASH
#START=$(pcapinfo "${EVTX}" -a |grep "First packet time:" | awk '{print $4}')
#END=$(pcapinfo "${EVTX}" -e |grep "Last packet time:" | awk '{print $4}')
#echo "- saving EVTX data spanning dates $START through $END"
# compare $START to $START_OLDEST # compare $START to $START_OLDEST
START=$(cat /nsm/import/evtx-start_oldest) START=$(cat /nsm/import/evtx-start_oldest)
START_COMPARE=$(date -d $START +%s) START_COMPARE=$(date -d $START +%s)