diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion index b5198f955..9b7923403 100755 --- a/salt/manager/tools/sbin/so-minion +++ b/salt/manager/tools/sbin/so-minion @@ -274,6 +274,13 @@ function add_curator_to_minion() { " " >> $PILLARFILE } +function add_telegraf_to_minion() { + printf '%s\n'\ + "telegraf:"\ + " enabled: True"\ + " " >> $PILLARFILE +} + function create_fleet_policy() { JSON_STRING=$( jq -n \ @@ -324,6 +331,7 @@ function createEVAL() { add_elastalert_to_minion add_kibana_to_minion add_curator_to_minion + add_telegraf_to_minion } function createSTANDALONE() { @@ -336,6 +344,7 @@ function createSTANDALONE() { add_kibana_to_minion add_redis_to_minion add_curator_to_minion + add_telegraf_to_minion } function createMANAGER() { @@ -346,6 +355,7 @@ function createMANAGER() { add_kibana_to_minion add_redis_to_minion add_curator_to_minion + add_telegraf_to_minion } function createMANAGERSEARCH() { @@ -356,12 +366,14 @@ function createMANAGERSEARCH() { add_kibana_to_minion add_redis_to_minion add_curator_to_minion + add_telegraf_to_minion } function createIMPORT() { add_elasticsearch_to_minion add_sensor_to_minion add_kibana_to_minion + add_telegraf_to_minion } function createFLEET() { @@ -370,10 +382,12 @@ function createFLEET() { create_fleet_policy update_fleet_host_urls update_logstash_outputs + add_telegraf_to_minion } function createIDH() { add_idh_to_minion + add_telegraf_to_minion } function createHEAVYNODE() { @@ -383,16 +397,19 @@ function createHEAVYNODE() { add_strelka_strelka_to_minion add_redis_to_minion add_curator_to_minion + add_telegraf_to_minion } function createSENSOR() { add_sensor_to_minion add_strelka_strelka_to_minion + add_telegraf_to_minion } function createSEARCHNODE() { add_elasticsearch_to_minion add_logstash_to_minion + add_telegraf_to_minion updateMine apply_ES_state } @@ -400,6 +417,7 @@ function createSEARCHNODE() { function createRECEIVER() { add_logstash_to_minion add_redis_to_minion + add_telegraf_to_minion } diff --git a/salt/strelka/map.jinja b/salt/strelka/map.jinja index 7ab3d76f5..646f7a746 100644 --- a/salt/strelka/map.jinja +++ b/salt/strelka/map.jinja @@ -1,3 +1,8 @@ +{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one + or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at + https://securityonion.net/license; you may not use this file except in compliance with the + Elastic License 2.0. #} + {% from 'vars/globals.map.jinja' import GLOBALS %} {% import_yaml 'strelka/defaults.yaml' as STRELKADEFAULTS %} {% set HOST = GLOBALS.hostname %} diff --git a/salt/telegraf/config.map.jinja b/salt/telegraf/config.map.jinja deleted file mode 100644 index 4ac4597a4..000000000 --- a/salt/telegraf/config.map.jinja +++ /dev/null @@ -1,3 +0,0 @@ -{% import_yaml 'telegraf/defaults.yaml' as TGDEFAULTS %} - -{% set TGMERGED = salt['pillar.get']('telegraf', TGDEFAULTS.telegraf, merge=True) %} diff --git a/salt/telegraf/config.sls b/salt/telegraf/config.sls new file mode 100644 index 000000000..1cc7ceed0 --- /dev/null +++ b/salt/telegraf/config.sls @@ -0,0 +1,91 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +{% from 'allowed_states.map.jinja' import allowed_states %} +{% if sls.split('.')[0] in allowed_states %} +{% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'telegraf/map.jinja' import TELEGRAFMERGED %} + +include: + - ssl + +# add Telegraf to monitor all the things +tgraflogdir: + file.directory: + - name: /opt/so/log/telegraf + - makedirs: True + - user: 939 + - group: 939 + - recurse: + - user + - group + +tgrafetcdir: + file.directory: + - name: /opt/so/conf/telegraf/etc + - makedirs: True + +tgrafetsdir: + file.directory: + - name: /opt/so/conf/telegraf/scripts + - makedirs: True + +tgrafsyncscripts: + file.recurse: + - name: /opt/so/conf/telegraf/scripts + - user: root + - group: 939 + - file_mode: 770 + - template: jinja + - source: salt://telegraf/scripts + {% if GLOBALS.md_engine == 'SURICATA' %} + - exclude_pat: zeekcaptureloss.sh + {% endif %} + +telegraf_sbin: + file.recurse: + - name: /usr/sbin + - source: salt://telegraf/tools/sbin + - user: 939 + - group: 939 + - file_mode: 755 + +#telegraf_sbin_jinja: +# file.recurse: +# - name: /usr/sbin +# - source: salt://telegraf/tools/sbin_jinja +# - user: 939 +# - group: 939 +# - file_mode: 755 +# - template: jinja + +tgrafconf: + file.managed: + - name: /opt/so/conf/telegraf/etc/telegraf.conf + - user: 939 + - group: 939 + - mode: 660 + - template: jinja + - source: salt://telegraf/etc/telegraf.conf + - show_changes: False + - defaults: + GLOBALS: {{ GLOBALS }} + TELEGRAFMERGED: {{ TELEGRAFMERGED }} + +# this file will be read by telegraf to send node details (management interface, monitor interface, etc) +# into influx +node_config: + file.managed: + - name: /opt/so/conf/telegraf/node_config.json + - source: salt://telegraf/node_config.json.jinja + - template: jinja + +{% else %} + +{{sls}}_state_not_allowed: + test.fail_without_changes: + - name: {{sls}}_state_not_allowed + +{% endif %} diff --git a/salt/telegraf/defaults.yaml b/salt/telegraf/defaults.yaml index a0cc8095f..63d437763 100644 --- a/salt/telegraf/defaults.yaml +++ b/salt/telegraf/defaults.yaml @@ -1,4 +1,5 @@ telegraf: + enabled: False config: interval: '30s' metric_batch_size: 1000 diff --git a/salt/telegraf/disabled.sls b/salt/telegraf/disabled.sls new file mode 100644 index 000000000..05a3c472e --- /dev/null +++ b/salt/telegraf/disabled.sls @@ -0,0 +1,27 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +{% from 'allowed_states.map.jinja' import allowed_states %} +{% if sls.split('.')[0] in allowed_states %} + +include: + -telegraf.sostatus + +so-telegraf: + docker_container.absent: + - force: True + +so-telegraf_so-status.disabled: + file.comment: + - name: /opt/so/conf/so-status/so-status.conf + - regex: ^so-telegraf$ + +{% else %} + +{{sls}}_state_not_allowed: + test.fail_without_changes: + - name: {{sls}}_state_not_allowed + +{% endif %} diff --git a/salt/telegraf/enabled.sls b/salt/telegraf/enabled.sls new file mode 100644 index 000000000..04459d7ff --- /dev/null +++ b/salt/telegraf/enabled.sls @@ -0,0 +1,76 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +{% from 'allowed_states.map.jinja' import allowed_states %} +{% if sls.split('.')[0] in allowed_states %} +{% from 'vars/globals.map.jinja' import GLOBALS %} + +include: + - telegraf.config + - telegraf.sostatus + +so-telegraf: + docker_container.running: + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-telegraf:{{ GLOBALS.so_version }} + - user: 939 + - group_add: 939,920 + - environment: + - HOST_PROC=/host/proc + - HOST_ETC=/host/etc + - HOST_SYS=/host/sys + - HOST_MOUNT_PREFIX=/host + - GODEBUG=x509ignoreCN=0 + - network_mode: host + - init: True + - binds: + - /opt/so/log/telegraf:/var/log/telegraf:rw + - /opt/so/conf/telegraf/etc/telegraf.conf:/etc/telegraf/telegraf.conf:ro + - /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro + - /var/run/utmp:/var/run/utmp:ro + - /var/run/docker.sock:/var/run/docker.sock:ro + - /:/host/root:ro + - /sys:/host/sys:ro + - /proc:/host/proc:ro + - /nsm:/host/nsm:ro + - /etc:/host/etc:ro + {% if GLOBALS.role in ['so-manager', 'so-eval', 'so-managersearch' ] %} + - /etc/pki/ca.crt:/etc/telegraf/ca.crt:ro + {% else %} + - /etc/ssl/certs/intca.crt:/etc/telegraf/ca.crt:ro + {% endif %} + - /etc/pki/influxdb.crt:/etc/telegraf/telegraf.crt:ro + - /etc/pki/influxdb.key:/etc/telegraf/telegraf.key:ro + - /opt/so/conf/telegraf/scripts:/scripts:ro + - /opt/so/log/stenographer:/var/log/stenographer:ro + - /opt/so/log/suricata:/var/log/suricata:ro + - /opt/so/log/raid:/var/log/raid:ro + - /opt/so/log/sostatus:/var/log/sostatus:ro + - watch: + - file: tgrafconf + - file: tgrafsyncscripts + - file: node_config + - require: + - file: tgrafconf + - file: node_config + {% if GLOBALS.role in ['so-manager', 'so-eval', 'so-managersearch' ] %} + - x509: pki_public_ca_crt + {% else %} + - x509: trusttheca + {% endif %} + - x509: influxdb_crt + - x509: influxdb_key + +delete_so-telegraf_so-status.disabled: + file.uncomment: + - name: /opt/so/conf/so-status/so-status.conf + - regex: ^so-telegraf$ + +{% else %} + +{{sls}}_state_not_allowed: + test.fail_without_changes: + - name: {{sls}}_state_not_allowed + +{% endif %} diff --git a/salt/telegraf/etc/telegraf.conf b/salt/telegraf/etc/telegraf.conf index f2a89baf4..596f40b88 100644 --- a/salt/telegraf/etc/telegraf.conf +++ b/salt/telegraf/etc/telegraf.conf @@ -14,7 +14,7 @@ # Configuration for telegraf agent [agent] ## Default data collection interval for all inputs - interval = "{{ TGMERGED.config.interval }}" + interval = "{{ TELEGRAFMERGED.config.interval }}" ## Rounds collection interval to 'interval' ## ie, if interval="10s" then always collect on :00, :10, :20, etc. round_interval = true @@ -22,27 +22,27 @@ ## Telegraf will send metrics to outputs in batches of at most ## metric_batch_size metrics. ## This controls the size of writes that Telegraf sends to output plugins. - metric_batch_size = {{ TGMERGED.config.metric_batch_size }} + metric_batch_size = {{ TELEGRAFMERGED.config.metric_batch_size }} ## For failed writes, telegraf will cache metric_buffer_limit metrics for each ## output, and will flush this buffer on a successful write. Oldest metrics ## are dropped first when this buffer fills. ## This buffer only fills when writes fail to output plugin(s). - metric_buffer_limit = {{ TGMERGED.config.metric_buffer_limit }} + metric_buffer_limit = {{ TELEGRAFMERGED.config.metric_buffer_limit }} ## Collection jitter is used to jitter the collection by a random amount. ## Each plugin will sleep for a random time within jitter before collecting. ## This can be used to avoid many plugins querying things like sysfs at the ## same time, which can have a measurable effect on the system. - collection_jitter = "{{ TGMERGED.config.collection_jitter }}" + collection_jitter = "{{ TELEGRAFMERGED.config.collection_jitter }}" ## Default flushing interval for all outputs. Maximum flush_interval will be ## flush_interval + flush_jitter - flush_interval = "{{ TGMERGED.config.flush_interval }}" + flush_interval = "{{ TELEGRAFMERGED.config.flush_interval }}" ## Jitter the flush interval by a random amount. This is primarily to avoid ## large write spikes for users running a large number of telegraf instances. ## ie, a jitter of 5s and interval 10s means flushes will happen every 10-15s - flush_jitter = "{{ TGMERGED.config.flush_jitter }}" + flush_jitter = "{{ TELEGRAFMERGED.config.flush_jitter }}" ## By default or when set to "0s", precision will be set to the same ## timestamp order as the collection interval, with the maximum being 1s. @@ -55,7 +55,7 @@ ## Logging configuration: ## Run telegraf with debug log messages. - debug = {{ TGMERGED.config.debug }} + debug = {{ TELEGRAFMERGED.config.debug }} ## Run telegraf in quiet mode (error log messages only). quiet = false ## Specify the log file name. The empty string means to log to stderr. diff --git a/salt/telegraf/init.sls b/salt/telegraf/init.sls index f14ef14e4..ef5a600ab 100644 --- a/salt/telegraf/init.sls +++ b/salt/telegraf/init.sls @@ -1,141 +1,13 @@ -{% from 'allowed_states.map.jinja' import allowed_states %} -{% if sls in allowed_states %} -{% from 'vars/globals.map.jinja' import GLOBALS %} -{% from 'telegraf/config.map.jinja' import TGMERGED %} +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +{% from 'telegraf/map.jinja' import TELEGRAFMERGED %} include: - - ssl - -# add Telegraf to monitor all the things -tgraflogdir: - file.directory: - - name: /opt/so/log/telegraf - - makedirs: True - - user: 939 - - group: 939 - - recurse: - - user - - group - -tgrafetcdir: - file.directory: - - name: /opt/so/conf/telegraf/etc - - makedirs: True - -tgrafetsdir: - file.directory: - - name: /opt/so/conf/telegraf/scripts - - makedirs: True - -tgrafsyncscripts: - file.recurse: - - name: /opt/so/conf/telegraf/scripts - - user: root - - group: 939 - - file_mode: 770 - - template: jinja - - source: salt://telegraf/scripts -{% if GLOBALS.md_engine == 'SURICATA' %} - - exclude_pat: zeekcaptureloss.sh -{% endif %} - -telegraf_sbin: - file.recurse: - - name: /usr/sbin - - source: salt://telegraf/tools/sbin - - user: 939 - - group: 939 - - file_mode: 755 - -#telegraf_sbin_jinja: -# file.recurse: -# - name: /usr/sbin -# - source: salt://telegraf/tools/sbin_jinja -# - user: 939 -# - group: 939 -# - file_mode: 755 -# - template: jinja - -tgrafconf: - file.managed: - - name: /opt/so/conf/telegraf/etc/telegraf.conf - - user: 939 - - group: 939 - - mode: 660 - - template: jinja - - source: salt://telegraf/etc/telegraf.conf - - show_changes: False - - defaults: - GLOBALS: {{ GLOBALS }} - TGMERGED: {{ TGMERGED }} - -# this file will be read by telegraf to send node details (management interface, monitor interface, etc) -# into influx -node_config: - file.managed: - - name: /opt/so/conf/telegraf/node_config.json - - source: salt://telegraf/node_config.json.jinja - - template: jinja - -so-telegraf: - docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-telegraf:{{ GLOBALS.so_version }} - - user: 939 - - group_add: 939,920 - - environment: - - HOST_PROC=/host/proc - - HOST_ETC=/host/etc - - HOST_SYS=/host/sys - - HOST_MOUNT_PREFIX=/host - - GODEBUG=x509ignoreCN=0 - - network_mode: host - - init: True - - binds: - - /opt/so/log/telegraf:/var/log/telegraf:rw - - /opt/so/conf/telegraf/etc/telegraf.conf:/etc/telegraf/telegraf.conf:ro - - /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro - - /var/run/utmp:/var/run/utmp:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - - /:/host/root:ro - - /sys:/host/sys:ro - - /proc:/host/proc:ro - - /nsm:/host/nsm:ro - - /etc:/host/etc:ro - {% if grains['role'] == 'so-manager' or grains['role'] == 'so-eval' or grains['role'] == 'so-managersearch' %} - - /etc/pki/ca.crt:/etc/telegraf/ca.crt:ro - {% else %} - - /etc/ssl/certs/intca.crt:/etc/telegraf/ca.crt:ro - {% endif %} - - /etc/pki/influxdb.crt:/etc/telegraf/telegraf.crt:ro - - /etc/pki/influxdb.key:/etc/telegraf/telegraf.key:ro - - /opt/so/conf/telegraf/scripts:/scripts:ro - - /opt/so/log/stenographer:/var/log/stenographer:ro - - /opt/so/log/suricata:/var/log/suricata:ro - - /opt/so/log/raid:/var/log/raid:ro - - /opt/so/log/sostatus:/var/log/sostatus:ro - - watch: - - file: tgrafconf - - file: tgrafsyncscripts - - file: node_config - - require: - - file: tgrafconf - - file: node_config - {% if grains['role'] == 'so-manager' or grains['role'] == 'so-eval' or grains['role'] == 'so-managersearch' %} - - x509: pki_public_ca_crt - {% else %} - - x509: trusttheca - {% endif %} - - x509: influxdb_crt - - x509: influxdb_key -append_so-telegraf_so-status.conf: - file.append: - - name: /opt/so/conf/so-status/so-status.conf - - text: so-telegraf - +{% if TELEGRAFMERGED.enabled %} + - telegraf.enabled {% else %} - -{{sls}}_state_not_allowed: - test.fail_without_changes: - - name: {{sls}}_state_not_allowed - + - telegraf.disabled {% endif %} diff --git a/salt/telegraf/map.jinja b/salt/telegraf/map.jinja new file mode 100644 index 000000000..f1412d3ac --- /dev/null +++ b/salt/telegraf/map.jinja @@ -0,0 +1,7 @@ +{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one + or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at + https://securityonion.net/license; you may not use this file except in compliance with the + Elastic License 2.0. #} + +{% import_yaml 'telegraf/defaults.yaml' as TELEGRAFDEFAULTS %} +{% set TELEGRAFMERGED = salt['pillar.get']('telegraf', TELEGRAFDEFAULTS.telegraf, merge=True) %} diff --git a/salt/telegraf/soc_telegraf.yaml b/salt/telegraf/soc_telegraf.yaml index f64811632..a688ea2a3 100644 --- a/salt/telegraf/soc_telegraf.yaml +++ b/salt/telegraf/soc_telegraf.yaml @@ -1,4 +1,7 @@ telegraf: + enabled: + description: You can enable or disable Telegraf. + helpLink: telegraf.html config: interval: description: Data collection interval. diff --git a/salt/telegraf/sostatus.sls b/salt/telegraf/sostatus.sls new file mode 100644 index 000000000..2eb69cf5e --- /dev/null +++ b/salt/telegraf/sostatus.sls @@ -0,0 +1,21 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +{% from 'allowed_states.map.jinja' import allowed_states %} +{% if sls.split('.')[0] in allowed_states %} + +append_so-telegraf_so-status.conf: + file.append: + - name: /opt/so/conf/so-status/so-status.conf + - text: so-telegraf + - unless: grep -q so-telegraf /opt/so/conf/so-status/so-status.conf + +{% else %} + +{{sls}}_state_not_allowed: + test.fail_without_changes: + - name: {{sls}}_state_not_allowed + +{% endif %}