CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

osquery templates

Browse Source
This commit is contained in:
reyesj2
2025-03-05 13:57:47 -06:00
parent 11dc004811
commit 0f16b00563
2 changed files with 45 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
salt/elasticsearch/defaults.yaml
View File

@@ -2659,7 +2659,25 @@ elasticsearch:
set_priority: set_priority:
priority: 50 priority: 50
min_age: 30d min_age: 30d
so-logs-osquery_manager_x_action_x_responses: so-logs-osquery-manager-action_x_responses:
index_sorting: false
index_template:
_meta:
managed: true
managed_by: security_onion
package:
name: elastic_agent
composed_of:
- logs-osquery_manager.action.responses
ignore_missing_component_templates: []
index_patterns:
- .logs-osquery_manager.action.responses*
priority: 501
template:
settings:
index:
number_of_replicas: 0
so-logs-osquery-manager_x_action_x_responses:
index_sorting: false index_sorting: false
index_template: index_template:
_meta: _meta:
@@ -2683,9 +2701,9 @@ elasticsearch:
priority: 501 priority: 501
template: template:
settings: settings:
lifecycle:
so-logs-osquery-manager.action.responses-logs
index: index:
lifecycle:
name: so-logs-osquery_manager.action.responses-logs
number_of_replicas: 0 number_of_replicas: 0
policy: policy:
phases: phases:
@@ -2711,7 +2729,25 @@ elasticsearch:
set_priority: set_priority:
priority: 50 priority: 50
min_age: 30d min_age: 30d
so-logs-osquery_manager_x_result: so-logs-osquery-manager-actions:
index_sorting: false
index_template:
_meta:
managed: true
managed_by: security_onion
package:
name: elastic_agent
composed_of:
- logs-osquery_manager.actions
ignore_missing_component_templates: []
index_patterns:
- .logs-osquery_manager.actions*
priority: 501
template:
settings:
index:
number_of_replicas: 0
so-logs-osquery-manager_x_result:
index_sorting: false index_sorting: false
index_template: index_template:
_meta: _meta:
@@ -2737,7 +2773,7 @@ elasticsearch:
settings: settings:
index: index:
lifecycle: lifecycle:
name: so-logs-osquery_manager.result-logs name: so-logs-osquery-manager.result-logs
number_of_replicas: 0 number_of_replicas: 0
policy: policy:
phases: phases:

6
salt/elasticsearch/soc_elasticsearch.yaml
View File

@@ -368,8 +368,10 @@ elasticsearch:
so-logs-detections_x_alerts: *indexSettings so-logs-detections_x_alerts: *indexSettings
so-logs-http_endpoint_x_generic: *indexSettings so-logs-http_endpoint_x_generic: *indexSettings
so-logs-httpjson_x_generic: *indexSettings so-logs-httpjson_x_generic: *indexSettings
so-logs-osquery_manager_x_action_x_responses: *indexSettings so-logs-osquery-manager-actions: *indexSettings
so-logs-osquery_manager_x_result: *indexSettings so-logs-osquery-manager-action_x_responses: *indexSettings
so-logs-osquery-manager_x_action_x_responses: *indexSettings
so-logs-osquery-manager_x_result: *indexSettings
so-logs-elastic_agent_x_apm_server: *indexSettings so-logs-elastic_agent_x_apm_server: *indexSettings
so-logs-elastic_agent_x_auditbeat: *indexSettings so-logs-elastic_agent_x_auditbeat: *indexSettings
so-logs-elastic_agent_x_cloudbeat: *indexSettings so-logs-elastic_agent_x_cloudbeat: *indexSettings