From 283939b18a23884f5cd3aa175a701cc99556cef4 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Tue, 2 Apr 2024 15:36:01 -0400
Subject: [PATCH] Gather metrics from elastic agent to influx

---
 salt/manager/init.sls                         | 20 +++++++++++++
 .../manager/tools/sbin/so-elasticagent-status | 10 +++++++
 salt/telegraf/scripts/agentstatus.sh          | 30 +++++++++++++++++++
 3 files changed, 60 insertions(+)
 create mode 100644 salt/manager/tools/sbin/so-elasticagent-status
 create mode 100644 salt/telegraf/scripts/agentstatus.sh

diff --git a/salt/manager/init.sls b/salt/manager/init.sls
index 0ff4fa85a..d979482ef 100644
--- a/salt/manager/init.sls
+++ b/salt/manager/init.sls
@@ -27,6 +27,15 @@ repo_log_dir:
       - user
       - group
 
+agents_log_dir:
+  file.directory:
+    - name: /opt/so/log/agents
+    - user: root
+    - group: root
+    - recurse:
+      - user
+      - group
+
 yara_log_dir:
   file.directory:
     - name: /opt/so/log/yarasync
@@ -101,6 +110,17 @@ so-repo-sync:
     - hour: '{{ MANAGERMERGED.reposync.hour }}'
     - minute: '{{ MANAGERMERGED.reposync.minute }}'
 
+so_fleetagent_status:
+  cron.present:
+    - name: /usr/sbin/so-elasticagent-status > /opt/so/log/agents/agentstatus.log 2>&1
+    - identifier: so_fleetagent_status
+    - user: root
+    - minute: '*/5'
+    - hour: '*'
+    - daymonth: '*'
+    - month: '*'
+    - dayweek: '*'
+
 socore_own_saltstack:
   file.directory:
     - name: /opt/so/saltstack
diff --git a/salt/manager/tools/sbin/so-elasticagent-status b/salt/manager/tools/sbin/so-elasticagent-status
new file mode 100644
index 000000000..dffd76660
--- /dev/null
+++ b/salt/manager/tools/sbin/so-elasticagent-status
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
+. /usr/sbin/so-common
+
+curl -s -K /opt/so/conf/elasticsearch/curl.config -L "http://localhost:5601/api/fleet/agent_status" | jq .
\ No newline at end of file
diff --git a/salt/telegraf/scripts/agentstatus.sh b/salt/telegraf/scripts/agentstatus.sh
new file mode 100644
index 000000000..1673e7bd2
--- /dev/null
+++ b/salt/telegraf/scripts/agentstatus.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
+
+
+# if this script isn't already running
+if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
+
+    LOGFILE=$(cat /opt/so/log/agents/agentstatus.log)
+    ONLINE=$(cat $LOGFILE | grep -wF online | awk '{print $2}' | tr -d ',')
+    ERROR=$(cat $LOGFILE | grep -wF error | awk '{print $2}' | tr -d ',')
+    INACTIVE=$(cat $LOGFILE | grep -wF inactive | awk '{print $2}' | tr -d ',')
+    OFFLINE=$(cat $LOGFILE | grep -wF offline | awk '{print $2}' | tr -d ',')
+    UPDATING=$(cat $LOGFILE | grep -wF updating | awk '{print $2}' | tr -d ',')
+    UNENROLLED=$(cat $LOGFILE | grep -wF unenrolled | awk '{print $2}' | tr -d ',')
+    OTHER=$(cat $LOGFILE | grep -wF other | awk '{print $2}' | tr -d ',')
+    EVENTS=$(cat $LOGFILE | grep -wF events | awk '{print $2}' | tr -d ',')
+    TOTAL=$(cat $LOGFILE | grep -wF total | awk '{print $2}' | tr -d ',')
+    ALL=$(cat $LOGFILE | grep -wF all | awk '{print $2}' | tr -d ',')
+    ACTIVE=$(cat $LOGFILE | grep -wF active | awk '{print $2}')
+
+    echo "agentstatus online=$ONLINE,error=$ERROR,inactive=$INACTIVE,offline=$OFFLINE,updating=$UPDATING,unenrolled=$UNENROLLED,other=$OTHER,events=$EVENTS,total=$TOTAL,all=$ALL,active=$ACTIVE"
+    
+fi
+
+exit 0