From 5ade0b9f40c37dffe27d42c89a4afaddcac97f9a Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Tue, 23 Mar 2021 16:30:30 -0400 Subject: [PATCH 1/4] Implement customizable overview page --- salt/soc/files/soc/changes.json | 49 --------------------------------- salt/soc/files/soc/motd.md | 17 ++++++++++++ salt/soc/init.sls | 8 +++--- 3 files changed, 21 insertions(+), 53 deletions(-) delete mode 100644 salt/soc/files/soc/changes.json create mode 100644 salt/soc/files/soc/motd.md diff --git a/salt/soc/files/soc/changes.json b/salt/soc/files/soc/changes.json deleted file mode 100644 index dbc7b4061..000000000 --- a/salt/soc/files/soc/changes.json +++ /dev/null @@ -1,49 +0,0 @@ -{ - "title": "Security Onion 2.3.40 is here!", - "changes": [ - { "summary": "FEATURE: Add option for HTTP Method Specification/POST to Hunt/Alerts Actions #2904" }, - { "summary": "FEATURE: Add option to configure proxy for various tools used during setup + persist the proxy configuration #529" }, - { "summary": "FEATURE: Alerts/Hunt - Provide method for base64-encoding pivot value #1749" }, - { "summary": "FEATURE: Allow users to customize links in SOC #1248" }, - { "summary": "FEATURE: Display user who requested PCAP in SOC #2775" }, - { "summary": "FEATURE: Make SOC browser app connection timeouts adjustable #2408" }, - { "summary": "FEATURE: Move to FleetDM #3483" }, - { "summary": "FEATURE: Reduce field cache expiration from 1d to 5m, and expose value as a salt pillar #3537" }, - { "summary": "FEATURE: Refactor docker_clean salt state to use loop w/ inspection instead of hardcoded image list #3113" }, - { "summary": "FEATURE: Run so-ssh-harden during setup #1932" }, - { "summary": "FEATURE: SOC should only display links to tools that are enabled #1643" }, - { "summary": "FEATURE: Update Sigmac Osquery Field Mappings #3137" }, - { "summary": "FEATURE: User must accept the Elastic licence during setup #3233" }, - { "summary": "FEATURE: soup should output more guidance for distributed deployments at the end #3340" }, - { "summary": "FEATURE: soup should provide some initial information and then prompt the user to continue #3486" }, - { "summary": "FIX: Add cronjob for so-suricata-eve-clean script #3515" }, - { "summary": "FIX: Change Elasticsearch heap formula #1686" }, - { "summary": "FIX: Create a post install version loop in soup #3102" }, - { "summary": "FIX: Custom Kibana settings are not being applied properly on upgrades #3254" }, - { "summary": "FIX: Hunt query issues with quotes #3320" }, - { "summary": "FIX: IP Addresses don't work with .security #3327" }, - { "summary": "FIX: Improve DHCP leases query in Hunt #3395" }, - { "summary": "FIX: Improve Setup verbiage #3422" }, - { "summary": "FIX: Improve Suricata DHCP logging and parsing #3397" }, - { "summary": "FIX: Keep RELATED,ESTABLISHED rules at the top of iptables chains #3288" }, - { "summary": "FIX: Populate http.status_message field #3408" }, - { "summary": "FIX: Remove 'types removal' deprecation messages from elastic log. #3345" }, - { "summary": "FIX: Reword + fix formatting on ES data storage prompt #3205" }, - { "summary": "FIX: SMTP shoud read SNMP on Kibana SNMP view #3413" }, - { "summary": "FIX: Sensors can temporarily show offline while processing large PCAP jobs #3279" }, - { "summary": "FIX: Soup should log to the screen as well as to a file #3467" }, - { "summary": "FIX: Strelka port 57314 not immediately relinquished upon restart #3457" }, - { "summary": "FIX: Switch SOC to pull from fieldcaps API due to field caching changes in Kibana 7.11 #3502" }, - { "summary": "FIX: Syntax error in /etc/sysctl.d/99-reserved-ports.conf #3308" }, - { "summary": "FIX: Telegraf hardcoded to use https and is not aware of elasticsearch features #2061" }, - { "summary": "FIX: Zeek Index Close and Delete Count for curator #3274" }, - { "summary": "FIX: so-cortex-user-add and so-cortex-user-enable use wrong pillar value for api key #3388" }, - { "summary": "FIX: so-rule does not completely apply change #3289" }, - { "summary": "FIX: soup should recheck disk space after it tries to clean up. #3235" }, - { "summary": "UPGRADE: Elastic 7.11.2 #3389" }, - { "summary": "UPGRADE: Suricata 6.0.2 #3217" }, - { "summary": "UPGRADE: Zeek 4 #3216" }, - { "summary": "UPGRADE: Zeek container to use Python 3 #1113" }, - { "summary": "UPGRADE: docker-ce to latest #3493" } - ] -} \ No newline at end of file diff --git a/salt/soc/files/soc/motd.md b/salt/soc/files/soc/motd.md new file mode 100644 index 000000000..54df73d1b --- /dev/null +++ b/salt/soc/files/soc/motd.md @@ -0,0 +1,17 @@ +## Getting Started + +New to Security Onion 2? Check out the [Online Help](/docs/) and [Cheatsheet](/docs/cheatsheet.pdf) to learn how to best utilize Security Onion to hunt for evil! Find them in the upper-right menu. + +If you're ready to dive-in, take a look at the [Alerts](/#/alerts) interface to see what Security Onion has detected so far. Or navigate to the [Hunt](/#/hunt) interface to hunt for evil that the alerts might have missed! + +## What's New + +The release notes have moved to the upper-right menu. Click on the [What's New](/docs/release-notes.html) menu option to find all the latest fixes and features in this version of Security Onion! + +## Customize This Space + +Make this area your own by customizing the content. The content is stored in the `motd.md` file, which uses the common Markdown (.md) format. + +To customize this content, copy `/opt/so/saltstack/default/salt/soc/files/soc/motd.md` to `/opt/so/saltstack/local/salt/soc/files/soc/motd.md` and edit it as desired. + +Visit [mardownguide.org](https://www.markdownguide.org/) to learn more about the simple Markdown format. \ No newline at end of file diff --git a/salt/soc/init.sls b/salt/soc/init.sls index d31898e72..a2d3ecf89 100644 --- a/salt/soc/init.sls +++ b/salt/soc/init.sls @@ -35,10 +35,10 @@ socconfig: - mode: 600 - template: jinja -socchanges: +socmotd: file.managed: - - name: /opt/so/conf/soc/changes.json - - source: salt://soc/files/soc/changes.json + - name: /opt/so/conf/soc/motd.md + - source: salt://soc/files/soc/motd.md - user: 939 - group: 939 - mode: 600 @@ -61,7 +61,7 @@ so-soc: - binds: - /nsm/soc/jobs:/opt/sensoroni/jobs:rw - /opt/so/conf/soc/soc.json:/opt/sensoroni/sensoroni.json:ro - - /opt/so/conf/soc/changes.json:/opt/sensoroni/html/changes.json:ro + - /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro - /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro - /opt/so/log/soc/:/opt/sensoroni/logs/:rw {%- if salt['pillar.get']('nodestab', {}) %} From 887920e7c53ae66524ab682c6d10e6ffb9284809 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Tue, 23 Mar 2021 16:44:08 -0400 Subject: [PATCH 2/4] Implement customizable overview page --- salt/soc/files/soc/motd.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/salt/soc/files/soc/motd.md b/salt/soc/files/soc/motd.md index 54df73d1b..43da6732a 100644 --- a/salt/soc/files/soc/motd.md +++ b/salt/soc/files/soc/motd.md @@ -10,8 +10,16 @@ The release notes have moved to the upper-right menu. Click on the [What's New]( ## Customize This Space -Make this area your own by customizing the content. The content is stored in the `motd.md` file, which uses the common Markdown (.md) format. +Make this area your own by customizing the content. The content is stored in the `motd.md` file, which uses the common Markdown (.md) format. Visit [mardownguide.org](https://www.markdownguide.org/) to learn more about the simple Markdown format. -To customize this content, copy `/opt/so/saltstack/default/salt/soc/files/soc/motd.md` to `/opt/so/saltstack/local/salt/soc/files/soc/motd.md` and edit it as desired. +To customize this content, login to the manager via SSH and execute the following command: -Visit [mardownguide.org](https://www.markdownguide.org/) to learn more about the simple Markdown format. \ No newline at end of file +```bash +cp -f /opt/so/saltstack/default/salt/soc/files/soc/motd.md /opt/so/saltstack/local/salt/soc/files/soc/motd.md +``` + +Now, edit the new file as desired. Finally, run this command: + +```bash +salt-call state.apply soc queue=True +``` From 79ad87f83c4819353ba16bdf82f31ee472a83a2f Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Tue, 23 Mar 2021 21:16:17 -0400 Subject: [PATCH 3/4] Remove freqserver, minio, and domainstats from image list --- salt/common/tools/sbin/so-image-common | 3 --- 1 file changed, 3 deletions(-) diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common index 402ae97f3..be5a327f0 100755 --- a/salt/common/tools/sbin/so-image-common +++ b/salt/common/tools/sbin/so-image-common @@ -47,20 +47,17 @@ container_list() { TRUSTED_CONTAINERS=( "so-acng" "so-curator" - "so-domainstats" "so-elastalert" "so-elasticsearch" "so-filebeat" "so-fleet" "so-fleet-launcher" - "so-freqserver" "so-grafana" "so-idstools" "so-influxdb" "so-kibana" "so-kratos" "so-logstash" - "so-minio" "so-mysql" "so-nginx" "so-pcaptools" From 7fc2467951c864627c0c3beff04b45259eb61f32 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 24 Mar 2021 15:00:02 -0400 Subject: [PATCH 4/4] Correct local online docs link to release notes --- salt/soc/files/soc/motd.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/files/soc/motd.md b/salt/soc/files/soc/motd.md index 43da6732a..295329f39 100644 --- a/salt/soc/files/soc/motd.md +++ b/salt/soc/files/soc/motd.md @@ -6,7 +6,7 @@ If you're ready to dive-in, take a look at the [Alerts](/#/alerts) interface to ## What's New -The release notes have moved to the upper-right menu. Click on the [What's New](/docs/release-notes.html) menu option to find all the latest fixes and features in this version of Security Onion! +The release notes have moved to the upper-right menu. Click on the [What's New](/docs/#document-release-notes) menu option to find all the latest fixes and features in this version of Security Onion! ## Customize This Space