CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Tighten & Document Pipelines

Browse Source
This commit is contained in:
Josh Brower
2023-07-10 14:17:42 -04:00
parent 7805ca8beb
commit 31edf2e8ea
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
salt/logstash/defaults.yaml
View File

@@ -21,21 +21,21 @@ logstash:
- fleet
defined_pipelines:
fleet:
- so/0012_input_elastic_agent.conf
- so/9806_output_lumberjack_fleet.conf.jinja
- so/0012_input_elastic_agent.conf # Logs from agents
- so/9806_output_lumberjack_fleet.conf.jinja # Logstash to Logstash Output
manager:
- so/0011_input_endgame.conf
- so/0012_input_elastic_agent.conf
- so/0013_input_lumberjack_fleet.conf
- so/0012_input_elastic_agent.conf # Logs from agents
- so/0013_input_lumberjack_fleet.conf # Logstash to Logstash Input
- so/9999_output_redis.conf.jinja
receiver:
- so/0011_input_endgame.conf
- so/0012_input_elastic_agent.conf
- so/0013_input_lumberjack_fleet.conf
- so/0012_input_elastic_agent.conf # Logs from agents
- so/0013_input_lumberjack_fleet.conf # Logstash to Logstash Input
- so/9999_output_redis.conf.jinja
search:
- so/0900_input_redis.conf.jinja
- so/9805_output_elastic_agent.conf.jinja
- so/9805_output_elastic_agent.conf.jinja # Elastic Agent data Output to ES (Final)
- so/9900_output_endgame.conf.jinja
custom0: []
custom1: []

6
salt/logstash/pipelines/config/so/0013_input_lumberjack_fleet.conf
View File

@@ -1,7 +1,7 @@
input {
elastic_agent {
port => 5056
tags => [ "elastic-agent" ]
tags => [ "elastic-agent", "fleet-lumberjack-input" ]
ssl => true
ssl_certificate => "/usr/share/logstash/elasticfleet-lumberjack.crt"
ssl_key => "/usr/share/logstash/elasticfleet-lumberjack.key"
@@ -10,9 +10,13 @@ input {
codec => "json"
}
}
filter {
if "fleet-lumberjack-input" in [tags] {
mutate {
rename => {"@metadata" => "metadata"}
}
}
}