CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-06-15 06:38:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Change Firewall Pillar Structure

Browse Source
This commit is contained in:
Mike Reeves
2022-09-20 13:20:16 -04:00
parent 678d5c5c9c
commit 27a9edbef7
16 changed files with 619 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/firewall/portgroups/analyst
View File
salt/firewall/portgroups/analyst_workstations
View File
salt/firewall/portgroups/eval
View File
salt/firewall/portgroups/heavynodes
View File
salt/firewall/portgroups/idh
View File
salt/firewall/portgroups/manager
View File
salt/firewall/portgroups/portgroups.yaml
+611
View File
@@ -0,0 +1,611 @@
firewall:
portgroups:
role:
eval:
ports:
- playbook
- mysql
- kibana
- redis
- influxdb
- elasticsearch_rest
- elasticsearch_node
- docker_registry
- influxdb
- sensoroni
- beats_5044
- beats_5644
- redis
- syslog
- strelka_frontend
- nginx
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
minion:
portgroups:
- salt_manager
manager:
chain:
DOCKER-USER:
hostgroups:
manager:
portgroups:
- wazuh_agent
- wazuh_api
- wazuh_authd
- playbook
- mysql
- kibana
- redis
- minio
- influxdb
- fleet_api
- cortex
- elasticsearch_rest
- elasticsearch_node
- cortex_es_rest
- cortex_es_node
minion:
portgroups:
- acng
- docker_registry
- osquery_8080
- influxdb
- wazuh_api
- fleet_api
- sensoroni
- yum
sensor:
portgroups:
- beats_5044
- beats_5644
search_node:
portgroups:
- redis
- minio
- elasticsearch_node
- beats_5644
heavy_node:
portgroups:
- redis
- minio
- elasticsearch_node
- beats_5644
self:
portgroups:
- syslog}}
syslog:
portgroups:
- syslog
beats_endpoint:
portgroups:
- beats_5044
beats_endpoint_ssl:
portgroups:
- beats_5644
elasticsearch_rest:
portgroups:
- elasticsearch_rest
endgame:
portgroups:
- endgame
osquery_endpoint:
portgroups:
- fleet_api
wazuh_agent:
portgroups:
- wazuh_agent
wazuh_api:
portgroups:
- wazuh_api
wazuh_authd:
portgroups:
- wazuh_authd
analyst:
portgroups:
- nginx
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
minion:
portgroups:
- salt_manager
managersearch:
chain:
DOCKER-USER:
hostgroups:
manager:
portgroups:
- wazuh_agent
- wazuh_api
- wazuh_authd
- playbook
- mysql
- kibana
- redis
- minio
- influxdb
- fleet_api
- cortex
- elasticsearch_rest
- elasticsearch_node
- cortex_es_rest
- cortex_es_node
minion:
portgroups:
- acng
- docker_registry
- osquery_8080
- influxdb
- wazuh_api
- fleet_api
- sensoroni
- yum
sensor:
portgroups:
- beats_5044
- beats_5644
search_node:
portgroups:
- redis
- minio
- elasticsearch_node
heavy_node:
portgroups:
- redis
- minio
- elasticsearch_node
self:
portgroups:
- syslog}}
beats_endpoint:
portgroups:
- beats_5044
beats_endpoint_ssl:
portgroups:
- beats_5644
elasticsearch_rest:
portgroups:
- elasticsearch_rest
endgame:
portgroups:
- endgame
osquery_endpoint:
portgroups:
- fleet_api
syslog:
portgroups:
- syslog
wazuh_agent:
portgroups:
- wazuh_agent
wazuh_api:
portgroups:
- wazuh_api
wazuh_authd:
portgroups:
- wazuh_authd
analyst:
portgroups:
- nginx
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
minion:
portgroups:
- salt_manager
standalone:
chain:
DOCKER-USER:
hostgroups:
manager:
portgroups:
- wazuh_agent
- wazuh_api
- wazuh_authd
- playbook
- mysql
- kibana
- redis
- minio
- influxdb
- fleet_api
- cortex
- elasticsearch_rest
- elasticsearch_node
- cortex_es_rest
- cortex_es_node
minion:
portgroups:
- acng
- docker_registry
- osquery_8080
- influxdb
- wazuh_api
- fleet_api
- sensoroni
- yum
sensor:
portgroups:
- beats_5044
- beats_5644
search_node:
portgroups:
- redis
- minio
- elasticsearch_node
heavy_node:
portgroups:
- redis
- minio
- elasticsearch_node
self:
portgroups:
- syslog}}
beats_endpoint:
portgroups:
- beats_5044
beats_endpoint_ssl:
portgroups:
- beats_5644
elasticsearch_rest:
portgroups:
- elasticsearch_rest
endgame:
portgroups:
- endgame
osquery_endpoint:
portgroups:
- fleet_api
strelka_frontend:
portgroups:
- strelka_frontend
syslog:
portgroups:
- syslog
wazuh_agent:
portgroups:
- wazuh_agent
wazuh_api:
portgroups:
- wazuh_api
wazuh_authd:
portgroups:
- wazuh_authd
analyst:
portgroups:
- nginx
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
minion:
portgroups:
- salt_manager
helixsensor:
chain:
DOCKER-USER:
hostgroups:
manager:
portgroups:
- wazuh_agent
- playbook
- mysql
- kibana
- redis
- influxdb
- fleet_api
- cortex
- elasticsearch_rest
- elasticsearch_node
- cortex_es_rest
- cortex_es_node
minion:
portgroups:
- acng
- docker_registry
- osquery_8080
- influxdb
- wazuh_api
- sensoroni
sensor:
portgroups:
- beats_5044
- beats_5644
search_node:
portgroups:
- redis
- elasticsearch_node
self:
portgroups:
- syslog}}
beats_endpoint:
portgroups:
- beats_5044
osquery_endpoint:
portgroups:
- fleet_api
wazuh_agent:
portgroups:
- wazuh_agent
analyst:
portgroups:
- nginx
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
minion:
portgroups:
- salt_manager
searchnode:
chain:
DOCKER-USER:
hostgroups:
manager:
portgroups:
- elasticsearch_node
- elasticsearch_rest
dockernet:
portgroups:
- elasticsearch_node
- elasticsearch_rest
elasticsearch_rest:
portgroups:
- elasticsearch_rest
search_node:
portgroups:
- elasticsearch_node
self:
portgroups:
- syslog}}
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
sensor:
chain:
DOCKER-USER:
hostgroups:
self:
portgroups:
- syslog
strelka_frontend:
portgroups:
- strelka_frontend
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
heavynode:
chain:
DOCKER-USER:
hostgroups:
manager:
portgroups:
- elasticsearch_node
- elasticsearch_rest
dockernet:
portgroups:
- elasticsearch_node
- elasticsearch_rest
elasticsearch_rest:
portgroups:
- elasticsearch_rest
self:
portgroups:
- syslog}}
strelka_frontend:
portgroups:
- strelka_frontend
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
fleet:
chain:
DOCKER-USER:
hostgroups:
self:
portgroups:
- redis
- mysql
- osquery_8080
localhost:
portgroups:
- mysql
- osquery_8080
analyst:
portgroups:
- fleet_webui
minion:
portgroups:
- fleet_api
osquery_endpoint:
portgroups:
- fleet_api}}
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
import:
chain:
DOCKER-USER:
hostgroups:
manager:
portgroups:
- kibana
- redis
- influxdb
- elasticsearch_rest
- elasticsearch_node
minion:
portgroups:
- docker_registry
- sensoroni
sensor:
portgroups:
- beats_5044
- beats_5644
search_node:
portgroups:
- redis
- elasticsearch_node
beats_endpoint:
portgroups:
- beats_5044
beats_endpoint_ssl:
portgroups:
- beats_5644
elasticsearch_rest:
portgroups:
- elasticsearch_rest
analyst:
portgroups:
- nginx
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
minion:
portgroups:
- salt_manager
receiver:
chain:
DOCKER-USER:
hostgroups:
sensor:
portgroups:
- beats_5644
search_node:
portgroups:
- redis
- beats_5644
self:
portgroups:
- redis
- syslog}}
- beats_5644
syslog:
portgroups:
- syslog
beats_endpoint:
portgroups:
- beats_5044
beats_endpoint_ssl:
portgroups:
- beats_5644
endgame:
portgroups:
- endgame
wazuh_agent:
portgroups:
- wazuh_agent
wazuh_api:
portgroups:
- wazuh_api
wazuh_authd:
portgroups:
- wazuh_authd
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
idh:
chain:
INPUT:
hostgroups:
anywhere:
portgroups:
- idh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
manager:
portgroups:
- ssh
salt/firewall/portgroups/receivers
View File
salt/firewall/portgroups/searchnodes
View File
salt/firewall/portgroups/sensors
View File
salt/firewall/portgroups/standalone
-19
View File
@@ -1,19 +0,0 @@
playbook
mysql
kibana
redis
influxdb
elasticsearch_rest
elasticsearch_node
docker_registry
yum
sensoroni
beats_5044
beats_5644
elastic_agent_control
elastic_agent_data
elasticsearch_rest
endgame
strelka_frontend
syslog
nginx