CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 09:42:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

simplify wazuh agent ip logic

Browse Source
This commit is contained in:
m0duspwnens
2021-12-16 11:11:01 -05:00
parent bd7ef1cc59
commit 2e4ed8062e
3 changed files with 5 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/firewall/assigned_hostgroups.map.yaml
View File

@@ -611,7 +611,6 @@ role:
hostgroups: hostgroups:
sensor: sensor:
portgroups: portgroups:
- {{ portgroups.beats_5044 }}
- {{ portgroups.beats_5644 }} - {{ portgroups.beats_5644 }}
search_node: search_node:
portgroups: portgroups:
@@ -621,6 +620,7 @@ role:
portgroups: portgroups:
- {{ portgroups.redis }} - {{ portgroups.redis }}
- {{ portgroups.syslog}} - {{ portgroups.syslog}}
- {{ portgroups.beats_5644 }}
syslog: syslog:
portgroups: portgroups:
- {{ portgroups.syslog }} - {{ portgroups.syslog }}

2
salt/logstash/pipelines/config/so/0009_input_beats.conf
View File

@@ -8,4 +8,4 @@ filter {
mutate { mutate {
rename => {"@metadata" => "metadata"} rename => {"@metadata" => "metadata"}
} }
} }

13
salt/wazuh/files/agent/ossec.conf
View File

@@ -1,13 +1,6 @@
{%- if grains['role'] in ['so-manager', 'so-eval', 'so-managersearch', 'so-standalone'] %} {% set mainint = salt['pillar.get']('host:mainint') -%}
{%- set ip = salt['pillar.get']('global:managerip', '') %} {% set ip = salt['grains.get']('ip_interfaces').get(mainint)[0] -%}
{%- elif grains['role'] == 'so-node' or grains['role'] == 'so-heavynode' %}
{%- set ip = salt['pillar.get']('elasticsearch:mainip', '') %}
{%- elif grains['role'] == 'so-sensor' %}
{%- set ip = salt['pillar.get']('sensor:mainip', '') %}
{%- else %}
{%- set mainint = salt['pillar.get']('host:mainint') %}
{%- set ip = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %}
{%- endif %}
<!-- <!--
Wazuh - Agent Configuration Wazuh - Agent Configuration
More info at: https://documentation.wazuh.com More info at: https://documentation.wazuh.com