diff --git a/salt/backup/config_backup.sls b/salt/backup/config_backup.sls index 20616f780..a09c67b1b 100644 --- a/salt/backup/config_backup.sls +++ b/salt/backup/config_backup.sls @@ -25,6 +25,7 @@ config_backup_script: so_config_backup: cron.present: - name: /usr/sbin/so-config-backup > /dev/null 2>&1 + - identifier: so_config_backup - user: root - minute: '1' - hour: '0' diff --git a/salt/common/init.sls b/salt/common/init.sls index 2248c80bc..387d4e82a 100644 --- a/salt/common/init.sls +++ b/salt/common/init.sls @@ -133,8 +133,10 @@ so-status_script: {% if GLOBALS.role in GLOBALS.sensor_roles %} # Add sensor cleanup -/usr/sbin/so-sensor-clean: +so-sensor-clean: cron.present: + - name: /usr/sbin/so-sensor-clean + - identifier: so-sensor-clean - user: root - minute: '*' - hour: '*' @@ -154,8 +156,10 @@ sensorrotateconf: - source: salt://common/files/sensor-rotate.conf - mode: 644 -/usr/local/bin/sensor-rotate: +sensor-rotate: cron.present: + - name: /usr/local/bin/sensor-rotate + - identifier: sensor-rotate - user: root - minute: '1' - hour: '0' @@ -178,8 +182,10 @@ commonlogrotateconf: - template: jinja - mode: 644 -/usr/local/bin/common-rotate: +common-rotate: cron.present: + - name: /usr/local/bin/common-rotate + - identifier: common-rotate - user: root - minute: '1' - hour: '0' @@ -201,10 +207,10 @@ sostatus_log: - mode: 644 # Install sostatus check cron. This is used to populate Grid. -sostatus_check_cron: +so-status_check_cron: cron.present: - name: 'USER=root /usr/sbin/so-status -j > /opt/so/log/sostatus/status.log 2>&1' - - identifier: sostatus_check_cron + - identifier: so-status_check_cron - user: root - minute: '*/1' - hour: '*' @@ -214,7 +220,7 @@ sostatus_check_cron: remove_post_setup_cron: cron.absent: - - name: 'salt-call state.highstate' + - name: 'PATH=$PATH:/usr/sbin salt-call state.highstate' - identifier: post_setup_cron {% if GLOBALS.role not in ['eval', 'manager', 'managersearch', 'standalone'] %} @@ -240,9 +246,10 @@ raidpkgs: {% endif %} # Install raid check cron -so_raid_status: +so-raid-status: cron.present: - name: '/usr/sbin/so-raid-status > /dev/null 2>&1' + - identifier: so-raid-status - user: root - minute: '*/15' - hour: '*' diff --git a/salt/curator/init.sls b/salt/curator/init.sls index 36f1261fe..d1e4276e1 100644 --- a/salt/curator/init.sls +++ b/salt/curator/init.sls @@ -126,9 +126,10 @@ delete_so-curator_so-status.disabled: - regex: ^so-curator$ {% endif %} -so-curatorclusterclose: +so-curator-cluster-close: cron.present: - name: /usr/sbin/so-curator-cluster-close > /opt/so/log/curator/cron-close.log 2>&1 + - identifier: so-curator-cluster-close - user: root - minute: '2' - hour: '*/1' @@ -136,9 +137,10 @@ so-curatorclusterclose: - month: '*' - dayweek: '*' -so-curatorclusterdeletecron: +so-curator-cluster-delete: cron.present: - name: /usr/sbin/so-curator-cluster-delete > /opt/so/log/curator/cron-cluster-delete.log 2>&1 + - identifier: so-curator-cluster-delete - user: root - minute: '*/5' - hour: '*' diff --git a/salt/idstools/init.sls b/salt/idstools/init.sls index 78f6c2735..5ec9464cc 100644 --- a/salt/idstools/init.sls +++ b/salt/idstools/init.sls @@ -20,9 +20,10 @@ idstoolslogdir: - group: 939 - makedirs: True -so-ruleupdatecron: +so-rule-update: cron.present: - name: /usr/sbin/so-rule-update > /opt/so/log/idstools/download.log 2>&1 + - identifier: so-rule-update - user: root - minute: '1' - hour: '7' diff --git a/salt/influxdb/init.sls b/salt/influxdb/init.sls index b6190fdfd..b4824825b 100644 --- a/salt/influxdb/init.sls +++ b/salt/influxdb/init.sls @@ -127,6 +127,7 @@ metrics_link_file: get_influxdb_size: cron.present: - name: 'du -s -k /nsm/influxdb | cut -f1 > /opt/so/log/telegraf/influxdb_size.log 2>&1' + - identifier: get_influxdb_size - user: root - minute: '*/1' - hour: '*' diff --git a/salt/manager/init.sls b/salt/manager/init.sls index 4db979266..9973dcb41 100644 --- a/salt/manager/init.sls +++ b/salt/manager/init.sls @@ -51,7 +51,7 @@ repo_sync_script: - group: root - mode: 755 -reposync_cron: +so-repo-sync: {% if MANAGERMERGED.reposync.enabled %} cron.present: {% else %} @@ -59,6 +59,7 @@ reposync_cron: {% endif %} - user: socore - name: '/usr/sbin/so-repo-sync >> /opt/so/log/reposync/reposync.log 2>&1' + - identifier: so-repo-sync - hour: '{{ MANAGERMERGED.reposync.hour }}' - minute: '{{ MANAGERMERGED.reposync.minute }}' @@ -83,10 +84,11 @@ yara_update_script: ISAIRGAP: {{ GLOBALS.airgap }} EXCLUDEDRULES: {{ STRELKAMERGED.rules.excluded }} -strelka_yara_update: +strelka-yara-update: cron.present: - user: root - name: '/usr/sbin/so-yara-update >> /nsm/strelka/log/yara-update.log 2>&1' + - identifier: strelka-yara-update - hour: '7' - minute: '1' diff --git a/salt/manager/sync_es_users.sls b/salt/manager/sync_es_users.sls index 4546fc52f..79ab14669 100644 --- a/salt/manager/sync_es_users.sls +++ b/salt/manager/sync_es_users.sls @@ -24,8 +24,9 @@ sync_es_users: # we dont want this added too early in setup, so we add the onlyif to verify 'startup_states: highstate' # is in the minion config. That line is added before the final highstate during setup -sosyncusers: +so-user_sync: cron.present: - user: root - name: 'PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log' + - identifier: so-user_sync - onlyif: "grep 'startup_states: highstate' /etc/salt/minion" diff --git a/salt/playbook/init.sls b/salt/playbook/init.sls index fd31aeba8..f76292333 100644 --- a/salt/playbook/init.sls +++ b/salt/playbook/init.sls @@ -113,15 +113,17 @@ append_so-playbook_so-status.conf: {% endif %} -so-playbooksynccron: +so-playbook-sync_cron: cron.present: - name: /usr/sbin/so-playbook-sync > /opt/so/log/playbook/sync.log 2>&1 + - identifier: so-playbook-sync_cron - user: root - minute: '*/5' -so-playbookruleupdatecron: +so-playbook-ruleupdate_cron: cron.present: - name: /usr/sbin/so-playbook-ruleupdate > /opt/so/log/playbook/update.log 2>&1 + - identifier: so-playbook-ruleupdate_cron - user: root - minute: '1' - hour: '6' diff --git a/salt/salt/minion-check.sls b/salt/salt/minion-check.sls index 66ab732e2..22f87ca8a 100644 --- a/salt/salt/minion-check.sls +++ b/salt/salt/minion-check.sls @@ -12,8 +12,9 @@ state-apply-test: start: 0 end: 180 -/usr/sbin/so-salt-minion-check -q: +so-salt-minion-check_cron: cron.present: - - identifier: so-salt-minion-check + - name: /usr/sbin/so-salt-minion-check -q + - identifier: so-salt-minion-check_cron - user: root - minute: '*/5' diff --git a/salt/setup/highstate_cron.sls b/salt/setup/highstate_cron.sls index c14f4e1f4..862968d97 100644 --- a/salt/setup/highstate_cron.sls +++ b/salt/setup/highstate_cron.sls @@ -1,6 +1,7 @@ post_setup_cron: cron.present: - name: 'PATH=$PATH:/usr/sbin salt-call state.highstate' + - identifier: post_setup_cron - user: root - minute: '*/1' - identifier: post_setup_cron diff --git a/salt/soc/init.sls b/salt/soc/init.sls index e2ec511ed..9460eeac2 100644 --- a/salt/soc/init.sls +++ b/salt/soc/init.sls @@ -91,6 +91,7 @@ socusersroles: salt-relay: cron.present: - name: 'ps -ef | grep salt-relay.sh | grep -v grep > /dev/null 2>&1 || /opt/so/saltstack/default/salt/soc/files/bin/salt-relay.sh >> /opt/so/log/soc/salt-relay.log 2>&1 &' + - identifier: salt-relay so-soc: docker_container.running: diff --git a/salt/strelka/init.sls b/salt/strelka/init.sls index bbb2bcaf6..081f2ebd1 100644 --- a/salt/strelka/init.sls +++ b/salt/strelka/init.sls @@ -205,11 +205,13 @@ filecheck_restart: filecheck_run: cron.present: - name: 'ps -ef | grep filecheck | grep -v grep > /dev/null 2>&1 || python3 /opt/so/conf/strelka/filecheck >> /opt/so/log/strelka/filecheck_stdout.log 2>&1 &' + - identifier: filecheck_run - user: {{ filecheck_runas }} filcheck_history_clean: cron.present: - name: '/usr/bin/find /nsm/strelka/history/ -type f -mtime +2 -exec rm {} + > /dev/null 2>&1' + - identifier: filecheck_history_clean - minute: '33' # End Filecheck Section diff --git a/salt/suricata/init.sls b/salt/suricata/init.sls index 07350d8e1..159e59f4f 100644 --- a/salt/suricata/init.sls +++ b/salt/suricata/init.sls @@ -79,8 +79,10 @@ surilogscript: - source: salt://suricata/cron/surilogcompress - mode: 755 -/usr/local/bin/surilogcompress: +surilogcompress: cron.present: + - name: /usr/local/bin/surilogcompress + - identifier: surilogcompress - user: suricata - minute: '17' - hour: '*' @@ -181,16 +183,6 @@ delete_so-suricata_so-status.disabled: - regex: ^so-suricata$ {% endif %} -surirotate: - cron.absent: - - name: /usr/local/bin/surirotate - - user: root - - minute: '11' - - hour: '*' - - daymonth: '*' - - month: '*' - - dayweek: '*' - so-suricata-eve-clean: file.managed: - name: /usr/sbin/so-suricata-eve-clean @@ -204,6 +196,7 @@ so-suricata-eve-clean: clean_suricata_eve_files: cron.present: - name: /usr/sbin/so-suricata-eve-clean > /dev/null 2>&1 + - identifier: clean_suricata_eve_files - user: root - minute: '*/5' - hour: '*'