CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-17 14:33:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Move Elastic Fleet logging exclusions to the Fleet pillar

Browse Source
This commit is contained in:
Wes
2023-05-31 13:38:58 +00:00
parent 36791665f3
commit 2bb77251b0
4 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/elasticfleet/files/integrations-dynamic/grid-nodes/import-zeek-logs.json
View File

@@ -1,4 +1,4 @@
{% from 'zeek/config.map.jinja' import ZEEKMERGED %}
{% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %}
{%- raw -%}
{
"package": {
@@ -22,7 +22,7 @@
"data_stream.dataset": "import",
"tags": [],
"processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/zeek/logs/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"import.file\").slice(0,-4);\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n imported: true\n- add_tags:\n tags: \"ics\"\n when:\n regexp:\n import.file: \"^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*\"",
"custom": "exclude_files: [\"{%- endraw -%}{{ ZEEKMERGED.logging.excluded | join('|') }}{%- raw -%}.log$\"]\n"
"custom": "exclude_files: [\"{%- endraw -%}{{ ELASTICFLEETMERGED.logging.zeek.excluded | join('|') }}{%- raw -%}.log$\"]\n"
}
}
}

4
salt/elasticfleet/files/integrations-dynamic/grid-nodes/zeek-logs.json
View File

@@ -1,4 +1,4 @@
{% from 'zeek/config.map.jinja' import ZEEKMERGED %}
{% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %}
{%- raw -%}
{
"package": {
@@ -23,7 +23,7 @@
"data_stream.dataset": "zeek",
"tags": [],
"processors": "- dissect:\n tokenizer: \"/nsm/zeek/logs/current/%{pipeline}.log\"\n field: \"log.file.path\"\n trim_chars: \".log\"\n target_prefix: \"\"\n- script:\n lang: javascript\n source: >\n function process(event) {\n var pl = event.Get(\"pipeline\");\n event.Put(\"@metadata.pipeline\", \"zeek.\" + pl);\n }\n- add_fields:\n target: event\n fields:\n category: network\n module: zeek\n- add_tags:\n tags: \"ics\"\n when:\n regexp:\n pipeline: \"^bacnet*|^bsap*|^cip*|^cotp*|^dnp3*|^ecat*|^enip*|^modbus*|^opcua*|^profinet*|^s7comm*\"",
"custom": "exclude_files: [\"{%- endraw -%}{{ ZEEKMERGED.logging.excluded | join('|') }}{%- raw -%}.log$\"]\n"
"custom": "exclude_files: [\"{%- endraw -%}{{ ELASTICFLEETMERGED.logging.zeek.excluded | join('|') }}{%- raw -%}.log$\"]\n"
}
}
}

6
salt/elasticfleet/soc_elasticfleet.yaml
View File

@@ -3,6 +3,12 @@ elasticfleet:
description: You can enable or disable Elastic Fleet.
advanced: True
helpLink: elastic-fleet.html
logging:
zeek:
excluded:
description: This is a list of Zeek logs that are excluded from being shipped through the data processing pipeline. If you remove a log from this list, Elastic Agent will attempt to process it. If an ingest node pipeline is not available to process the logs, you may experience errors.
forcedType: "[]string"
helpLink: zeek.html
config:
server:
endpoints_enrollment:

5
salt/zeek/soc_zeek.yaml
View File

@@ -2,11 +2,6 @@ zeek:
enabled:
description: You can enable or disable ZEEK on all sensors or a single sensor.
helpLink: zeek.html
logging:
excluded:
description: This is a list of Zeek logs that are excluded from being shipped through the data processing pipeline. If you remove a log from this list, Elastic Agent will attempt to process it. If an ingest node pipeline is not available to process the logs, you may experience errors.
forcedType: "[]string"
helpLink: zeek.html
config:
local:
load: