CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 10:42:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

enable/disable telegraf in ui

Browse Source
This commit is contained in:
m0duspwnens
2023-05-11 12:12:25 -04:00
parent c74b440922
commit 20f706f165
12 changed files with 265 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
salt/manager/tools/sbin/so-minion
View File

@@ -274,6 +274,13 @@ function add_curator_to_minion() {
" " >> $PILLARFILE
}
function add_telegraf_to_minion() {
printf '%s\n'\
"telegraf:"\
" enabled: True"\
" " >> $PILLARFILE
}
function create_fleet_policy() {
JSON_STRING=$( jq -n \
@@ -324,6 +331,7 @@ function createEVAL() {
add_elastalert_to_minion
add_kibana_to_minion
add_curator_to_minion
add_telegraf_to_minion
}
function createSTANDALONE() {
@@ -336,6 +344,7 @@ function createSTANDALONE() {
add_kibana_to_minion
add_redis_to_minion
add_curator_to_minion
add_telegraf_to_minion
}
function createMANAGER() {
@@ -346,6 +355,7 @@ function createMANAGER() {
add_kibana_to_minion
add_redis_to_minion
add_curator_to_minion
add_telegraf_to_minion
}
function createMANAGERSEARCH() {
@@ -356,12 +366,14 @@ function createMANAGERSEARCH() {
add_kibana_to_minion
add_redis_to_minion
add_curator_to_minion
add_telegraf_to_minion
}
function createIMPORT() {
add_elasticsearch_to_minion
add_sensor_to_minion
add_kibana_to_minion
add_telegraf_to_minion
}
function createFLEET() {
@@ -370,10 +382,12 @@ function createFLEET() {
create_fleet_policy
update_fleet_host_urls
update_logstash_outputs
add_telegraf_to_minion
}
function createIDH() {
add_idh_to_minion
add_telegraf_to_minion
}
function createHEAVYNODE() {
@@ -383,16 +397,19 @@ function createHEAVYNODE() {
add_strelka_strelka_to_minion
add_redis_to_minion
add_curator_to_minion
add_telegraf_to_minion
}
function createSENSOR() {
add_sensor_to_minion
add_strelka_strelka_to_minion
add_telegraf_to_minion
}
function createSEARCHNODE() {
add_elasticsearch_to_minion
add_logstash_to_minion
add_telegraf_to_minion
updateMine
apply_ES_state
}
@@ -400,6 +417,7 @@ function createSEARCHNODE() {
function createRECEIVER() {
add_logstash_to_minion
add_redis_to_minion
add_telegraf_to_minion
}

5
salt/strelka/map.jinja
View File

@@ -1,3 +1,8 @@
{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
https://securityonion.net/license; you may not use this file except in compliance with the
Elastic License 2.0. #}
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% import_yaml 'strelka/defaults.yaml' as STRELKADEFAULTS %}
{% set HOST = GLOBALS.hostname %}

3
salt/telegraf/config.map.jinja
View File

@@ -1,3 +0,0 @@
{% import_yaml 'telegraf/defaults.yaml' as TGDEFAULTS %}
{% set TGMERGED = salt['pillar.get']('telegraf', TGDEFAULTS.telegraf, merge=True) %}

91
salt/telegraf/config.sls Normal file
View File

@@ -0,0 +1,91 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from 'telegraf/map.jinja' import TELEGRAFMERGED %}
include:
- ssl
# add Telegraf to monitor all the things
tgraflogdir:
file.directory:
- name: /opt/so/log/telegraf
- makedirs: True
- user: 939
- group: 939
- recurse:
- user
- group
tgrafetcdir:
file.directory:
- name: /opt/so/conf/telegraf/etc
- makedirs: True
tgrafetsdir:
file.directory:
- name: /opt/so/conf/telegraf/scripts
- makedirs: True
tgrafsyncscripts:
file.recurse:
- name: /opt/so/conf/telegraf/scripts
- user: root
- group: 939
- file_mode: 770
- template: jinja
- source: salt://telegraf/scripts
{% if GLOBALS.md_engine == 'SURICATA' %}
- exclude_pat: zeekcaptureloss.sh
{% endif %}
telegraf_sbin:
file.recurse:
- name: /usr/sbin
- source: salt://telegraf/tools/sbin
- user: 939
- group: 939
- file_mode: 755
#telegraf_sbin_jinja:
# file.recurse:
# - name: /usr/sbin
# - source: salt://telegraf/tools/sbin_jinja
# - user: 939
# - group: 939
# - file_mode: 755
# - template: jinja
tgrafconf:
file.managed:
- name: /opt/so/conf/telegraf/etc/telegraf.conf
- user: 939
- group: 939
- mode: 660
- template: jinja
- source: salt://telegraf/etc/telegraf.conf
- show_changes: False
- defaults:
GLOBALS: {{ GLOBALS }}
TELEGRAFMERGED: {{ TELEGRAFMERGED }}
# this file will be read by telegraf to send node details (management interface, monitor interface, etc)
# into influx
node_config:
file.managed:
- name: /opt/so/conf/telegraf/node_config.json
- source: salt://telegraf/node_config.json.jinja
- template: jinja
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

1
salt/telegraf/defaults.yaml
View File

@@ -1,4 +1,5 @@
telegraf:
enabled: False
config:
interval: '30s'
metric_batch_size: 1000

27
salt/telegraf/disabled.sls Normal file
View File

@@ -0,0 +1,27 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
include:
-telegraf.sostatus
so-telegraf:
docker_container.absent:
- force: True
so-telegraf_so-status.disabled:
file.comment:
- name: /opt/so/conf/so-status/so-status.conf
- regex: ^so-telegraf$
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

76
salt/telegraf/enabled.sls Normal file
View File

@@ -0,0 +1,76 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
include:
- telegraf.config
- telegraf.sostatus
so-telegraf:
docker_container.running:
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-telegraf:{{ GLOBALS.so_version }}
- user: 939
- group_add: 939,920
- environment:
- HOST_PROC=/host/proc
- HOST_ETC=/host/etc
- HOST_SYS=/host/sys
- HOST_MOUNT_PREFIX=/host
- GODEBUG=x509ignoreCN=0
- network_mode: host
- init: True
- binds:
- /opt/so/log/telegraf:/var/log/telegraf:rw
- /opt/so/conf/telegraf/etc/telegraf.conf:/etc/telegraf/telegraf.conf:ro
- /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro
- /var/run/utmp:/var/run/utmp:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- /:/host/root:ro
- /sys:/host/sys:ro
- /proc:/host/proc:ro
- /nsm:/host/nsm:ro
- /etc:/host/etc:ro
{% if GLOBALS.role in ['so-manager', 'so-eval', 'so-managersearch' ] %}
- /etc/pki/ca.crt:/etc/telegraf/ca.crt:ro
{% else %}
- /etc/ssl/certs/intca.crt:/etc/telegraf/ca.crt:ro
{% endif %}
- /etc/pki/influxdb.crt:/etc/telegraf/telegraf.crt:ro
- /etc/pki/influxdb.key:/etc/telegraf/telegraf.key:ro
- /opt/so/conf/telegraf/scripts:/scripts:ro
- /opt/so/log/stenographer:/var/log/stenographer:ro
- /opt/so/log/suricata:/var/log/suricata:ro
- /opt/so/log/raid:/var/log/raid:ro
- /opt/so/log/sostatus:/var/log/sostatus:ro
- watch:
- file: tgrafconf
- file: tgrafsyncscripts
- file: node_config
- require:
- file: tgrafconf
- file: node_config
{% if GLOBALS.role in ['so-manager', 'so-eval', 'so-managersearch' ] %}
- x509: pki_public_ca_crt
{% else %}
- x509: trusttheca
{% endif %}
- x509: influxdb_crt
- x509: influxdb_key
delete_so-telegraf_so-status.disabled:
file.uncomment:
- name: /opt/so/conf/so-status/so-status.conf
- regex: ^so-telegraf$
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

14
salt/telegraf/etc/telegraf.conf
View File

@@ -14,7 +14,7 @@
# Configuration for telegraf agent
[agent]
## Default data collection interval for all inputs
interval = "{{ TGMERGED.config.interval }}"
interval = "{{ TELEGRAFMERGED.config.interval }}"
## Rounds collection interval to 'interval'
## ie, if interval="10s" then always collect on :00, :10, :20, etc.
round_interval = true
@@ -22,27 +22,27 @@
## Telegraf will send metrics to outputs in batches of at most
## metric_batch_size metrics.
## This controls the size of writes that Telegraf sends to output plugins.
metric_batch_size = {{ TGMERGED.config.metric_batch_size }}
metric_batch_size = {{ TELEGRAFMERGED.config.metric_batch_size }}
## For failed writes, telegraf will cache metric_buffer_limit metrics for each
## output, and will flush this buffer on a successful write. Oldest metrics
## are dropped first when this buffer fills.
## This buffer only fills when writes fail to output plugin(s).
metric_buffer_limit = {{ TGMERGED.config.metric_buffer_limit }}
metric_buffer_limit = {{ TELEGRAFMERGED.config.metric_buffer_limit }}
## Collection jitter is used to jitter the collection by a random amount.
## Each plugin will sleep for a random time within jitter before collecting.
## This can be used to avoid many plugins querying things like sysfs at the
## same time, which can have a measurable effect on the system.
collection_jitter = "{{ TGMERGED.config.collection_jitter }}"
collection_jitter = "{{ TELEGRAFMERGED.config.collection_jitter }}"
## Default flushing interval for all outputs. Maximum flush_interval will be
## flush_interval + flush_jitter
flush_interval = "{{ TGMERGED.config.flush_interval }}"
flush_interval = "{{ TELEGRAFMERGED.config.flush_interval }}"
## Jitter the flush interval by a random amount. This is primarily to avoid
## large write spikes for users running a large number of telegraf instances.
## ie, a jitter of 5s and interval 10s means flushes will happen every 10-15s
flush_jitter = "{{ TGMERGED.config.flush_jitter }}"
flush_jitter = "{{ TELEGRAFMERGED.config.flush_jitter }}"
## By default or when set to "0s", precision will be set to the same
## timestamp order as the collection interval, with the maximum being 1s.
@@ -55,7 +55,7 @@
## Logging configuration:
## Run telegraf with debug log messages.
debug = {{ TGMERGED.config.debug }}
debug = {{ TELEGRAFMERGED.config.debug }}
## Run telegraf in quiet mode (error log messages only).
quiet = false
## Specify the log file name. The empty string means to log to stderr.

146
salt/telegraf/init.sls
View File

@@ -1,141 +1,13 @@
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from 'telegraf/config.map.jinja' import TGMERGED %}
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'telegraf/map.jinja' import TELEGRAFMERGED %}
include:
- ssl
# add Telegraf to monitor all the things
tgraflogdir:
file.directory:
- name: /opt/so/log/telegraf
- makedirs: True
- user: 939
- group: 939
- recurse:
- user
- group
tgrafetcdir:
file.directory:
- name: /opt/so/conf/telegraf/etc
- makedirs: True
tgrafetsdir:
file.directory:
- name: /opt/so/conf/telegraf/scripts
- makedirs: True
tgrafsyncscripts:
file.recurse:
- name: /opt/so/conf/telegraf/scripts
- user: root
- group: 939
- file_mode: 770
- template: jinja
- source: salt://telegraf/scripts
{% if GLOBALS.md_engine == 'SURICATA' %}
- exclude_pat: zeekcaptureloss.sh
{% endif %}
telegraf_sbin:
file.recurse:
- name: /usr/sbin
- source: salt://telegraf/tools/sbin
- user: 939
- group: 939
- file_mode: 755
#telegraf_sbin_jinja:
# file.recurse:
# - name: /usr/sbin
# - source: salt://telegraf/tools/sbin_jinja
# - user: 939
# - group: 939
# - file_mode: 755
# - template: jinja
tgrafconf:
file.managed:
- name: /opt/so/conf/telegraf/etc/telegraf.conf
- user: 939
- group: 939
- mode: 660
- template: jinja
- source: salt://telegraf/etc/telegraf.conf
- show_changes: False
- defaults:
GLOBALS: {{ GLOBALS }}
TGMERGED: {{ TGMERGED }}
# this file will be read by telegraf to send node details (management interface, monitor interface, etc)
# into influx
node_config:
file.managed:
- name: /opt/so/conf/telegraf/node_config.json
- source: salt://telegraf/node_config.json.jinja
- template: jinja
so-telegraf:
docker_container.running:
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-telegraf:{{ GLOBALS.so_version }}
- user: 939
- group_add: 939,920
- environment:
- HOST_PROC=/host/proc
- HOST_ETC=/host/etc
- HOST_SYS=/host/sys
- HOST_MOUNT_PREFIX=/host
- GODEBUG=x509ignoreCN=0
- network_mode: host
- init: True
- binds:
- /opt/so/log/telegraf:/var/log/telegraf:rw
- /opt/so/conf/telegraf/etc/telegraf.conf:/etc/telegraf/telegraf.conf:ro
- /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro
- /var/run/utmp:/var/run/utmp:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- /:/host/root:ro
- /sys:/host/sys:ro
- /proc:/host/proc:ro
- /nsm:/host/nsm:ro
- /etc:/host/etc:ro
{% if grains['role'] == 'so-manager' or grains['role'] == 'so-eval' or grains['role'] == 'so-managersearch' %}
- /etc/pki/ca.crt:/etc/telegraf/ca.crt:ro
{% else %}
- /etc/ssl/certs/intca.crt:/etc/telegraf/ca.crt:ro
{% endif %}
- /etc/pki/influxdb.crt:/etc/telegraf/telegraf.crt:ro
- /etc/pki/influxdb.key:/etc/telegraf/telegraf.key:ro
- /opt/so/conf/telegraf/scripts:/scripts:ro
- /opt/so/log/stenographer:/var/log/stenographer:ro
- /opt/so/log/suricata:/var/log/suricata:ro
- /opt/so/log/raid:/var/log/raid:ro
- /opt/so/log/sostatus:/var/log/sostatus:ro
- watch:
- file: tgrafconf
- file: tgrafsyncscripts
- file: node_config
- require:
- file: tgrafconf
- file: node_config
{% if grains['role'] == 'so-manager' or grains['role'] == 'so-eval' or grains['role'] == 'so-managersearch' %}
- x509: pki_public_ca_crt
{% else %}
- x509: trusttheca
{% endif %}
- x509: influxdb_crt
- x509: influxdb_key
append_so-telegraf_so-status.conf:
file.append:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-telegraf
{% if TELEGRAFMERGED.enabled %}
- telegraf.enabled
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
- telegraf.disabled
{% endif %}

7
salt/telegraf/map.jinja Normal file
View File

@@ -0,0 +1,7 @@
{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
https://securityonion.net/license; you may not use this file except in compliance with the
Elastic License 2.0. #}
{% import_yaml 'telegraf/defaults.yaml' as TELEGRAFDEFAULTS %}
{% set TELEGRAFMERGED = salt['pillar.get']('telegraf', TELEGRAFDEFAULTS.telegraf, merge=True) %}

3
salt/telegraf/soc_telegraf.yaml
View File

@@ -1,4 +1,7 @@
telegraf:
enabled:
description: You can enable or disable Telegraf.
helpLink: telegraf.html
config:
interval:
description: Data collection interval.

21
salt/telegraf/sostatus.sls Normal file
View File

@@ -0,0 +1,21 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
append_so-telegraf_so-status.conf:
file.append:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-telegraf
- unless: grep -q so-telegraf /opt/so/conf/so-status/so-status.conf
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}