CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

so-import-evtx - tweaks

Browse Source
This commit is contained in:
Josh Brower
2021-09-14 12:01:14 -04:00
parent 7b93f355e2
commit 0b0d508585
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/common/tools/sbin/so-import-evtx
View File

@@ -46,7 +46,7 @@ function evtx2es() {
so-evtx2es02 \
--host {{ MANAGERIP }} --scheme https \
--index so-beats-$INDEX_DATE --pipeline import.wel \
--login {{ES_USER}} --pwd {{ES_PW}} "/tmp/$RUNID.evtx" 2>&1
--login {{ES_USER}} --pwd {{ES_PW}} "/tmp/$RUNID.evtx" 1>/dev/null 2>/dev/null
docker run --rm \
@@ -75,7 +75,7 @@ for i in "$@"; do
fi
done
# track if we have any valid or invalid pcaps
# track if we have any valid or invalid evtx
INVALID_EVTXS="no"
VALID_EVTXS="no"
@@ -108,14 +108,10 @@ for EVTX in "$@"; do
EVTX_DIR=$HASH_DIR/evtx
mkdir -p $EVTX_DIR
# generate IDS alerts and write them to standard pipeline
# import evtx and write them to import ingest pipeline
echo "- importing logs with evtx2es"
evtx2es "${EVTX}" $HASH
#START=$(pcapinfo "${EVTX}" -a |grep "First packet time:" | awk '{print $4}')
#END=$(pcapinfo "${EVTX}" -e |grep "Last packet time:" | awk '{print $4}')
#echo "- saving EVTX data spanning dates $START through $END"
# compare $START to $START_OLDEST
START=$(cat /nsm/import/evtx-start_oldest)
START_COMPARE=$(date -d $START +%s)