Move In Day

salt/common/tools/sbin/so-elastic-fleet-setup

@@ -0,0 +1,81 @@
+
+#!/bin/bash
+
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use
+# this file except in compliance with the Elastic License 2.0.
+{% from 'vars/globals.map.jinja' import GLOBALS %}
+
+. /usr/sbin/so-common
+
+
+# Create ES Token 
+ESTOKEN=$(curl -K /opt/so/conf/elasticsearch/curl.config -L -X POST "localhost:5601/api/fleet/service_tokens" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' |  jq -r .value)
+printf "ESTOKEN = $ESTOKEN \n"
+
+# Add SO-Manager Fleet URL
+## This array replaces whatever URLs are currently configured
+printf "\n"
+curl -K /opt/so/conf/elasticsearch/curl.config -L -X PUT "localhost:5601/api/fleet/settings" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d  '{"fleet_server_hosts":["https://{{ GLOBALS.manager_ip }}:8220"]}'
+printf "\n\n"
+
+# Create Logstash Output payload
+cp /etc/ssl/certs/intca.crt /opt/so/conf/filebeat/etc/pki/
+LOGSTASHCRT=$(openssl x509 -in /opt/so/conf/filebeat/etc/pki/filebeat.crt)
+LOGSTASHKEY=$(openssl rsa -in  /opt/so/conf/filebeat/etc/pki/filebeat.key)
+LOGSTASHCA=$(openssl x509 -in  /opt/so/conf/filebeat/etc/pki/intca.crt)
+JSON_STRING=$( jq -n \
+                  --arg LOGSTASHCRT "$LOGSTASHCRT" \
+                  --arg LOGSTASHKEY "$LOGSTASHKEY" \
+                  --arg LOGSTASHCA "$LOGSTASHCA" \
+                  '{"name":"so-manager_logstash","id":"so-manager_logstash","type":"logstash","hosts":["{{ GLOBALS.manager_ip }}:5055"],"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl":{"certificate": $LOGSTASHCRT,"key": $LOGSTASHKEY,"certificate_authorities":[ $LOGSTASHCA ]}}'                
+                  )
+
+# Add SO-Manager Logstash Ouput
+curl -K /opt/so/conf/elasticsearch/curl.config -L -X POST "localhost:5601/api/fleet/outputs" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d "$JSON_STRING"
+printf "\n\n"
+
+# Add Elastic Fleet Integrations
+
+# Add Elastic Fleet Server Agent Policy
+#curl -vv -K /opt/so/conf/elasticsearch/curl.config -L \
+#-X POST "localhost:5601/api/fleet/agent_policies" \
+#-H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
+#-d  '{"name":"SO-Manager","id":"so-manager","description":"SO Manager Fleet Server Policy","namespace":"default","monitoring_enabled":["logs"],"has_fleet_server":true}'
+
+# Add Agent Policy - SOS Grid Nodes
+#curl -vv -K /opt/so/conf/elasticsearch/curl.config -L \
+#-X POST "localhost:5601/api/fleet/agent_policies" \
+#-H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
+#-d  '{"name":"SO-Grid","id":"so-grid","description":"SO Grid Endpoint Policy","namespace":"default","monitoring_enabled":["logs"]}'
+
+# Add Agent Policy - Default endpoints
+#curl -vv -K /opt/so/conf/elasticsearch/curl.config -L \
+#-X POST "localhost:5601/api/fleet/agent_policies" \
+#-H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
+#-d  '{"name":"Endpoints-Initalization","id":"endpoints","description":"Initial Endpoint Policy","namespace":"default","monitoring_enabled":["logs"]}'
+
+# Store needed data in minion pillar
+pillar_file=/opt/so/saltstack/local/pillar/minions/{{ GLOBALS.minion_id }}.sls
+printf '%s\n'\
+    "elasticfleet:"\
+    "  server:"\
+    "    es_token: '$ESTOKEN'"\
+    "    url: '{{ GLOBALS.manager_ip }}'"\
+    "" >> "$pillar_file"
+
+
+# Call Elastic-Fleet Salt State
+salt-call state.apply elastic-fleet
+
+# Temp
+wget -P /opt/so/saltstack/default/salt/elastic-fleet/files/elastic-agent/  https://github.com/Security-Onion-Solutions/securityonion-docker-rpm/releases/download/so_elastic-agent-8.4.1/so-elastic-agent-8.4.1-darwin-x86_64.tar.gz
+wget -P /opt/so/saltstack/default/salt/elastic-fleet/files/elastic-agent/ https://github.com/Security-Onion-Solutions/securityonion-docker-rpm/releases/download/so_elastic-agent-8.4.1/so-elastic-agent-8.4.1-linux-x86_64.tar.gz
+wget -P /opt/so/saltstack/default/salt/elastic-fleet/files/elastic-agent/ https://github.com/Security-Onion-Solutions/securityonion-docker-rpm/releases/download/so_elastic-agent-8.4.1/so-elastic-agent-8.4.1-windows-x86_64.tar.gz
+
+git clone -b 2.4-so-elastic-agent https://github.com/Security-Onion-Solutions/securityonion-image.git
+cd securityonion-image/so-elastic-agent-builder
+docker build -t so-elastic-agent-builder .
+
+so-elastic-agent-gen-installers
+/opt/so/conf/elastic-fleet/so_agent-installers/so-elastic-agent_linux