CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-20 16:03:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Enable PCAP pivots from imports

Browse Source
This commit is contained in:
Jason Ertel
2020-07-09 16:11:33 -04:00
parent 7b91704894
commit 33179141a1
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/common/tools/sbin/so-import-pcap
View File

@@ -206,13 +206,16 @@ if [ "$INVALID_PCAPS" = "yes" ]; then
echo "Please note! One or more pcaps was invalid! You can scroll up to see which ones were invalid." echo "Please note! One or more pcaps was invalid! You can scroll up to see which ones were invalid."
fi fi
START_OLDEST_SLASH=$(echo $START_OLDEST | sed -e 's/-/%2F/g')
END_NEWEST_SLASH=$(echo $END_NEWEST | sed -e 's/-/%2F/g')
if [ "$VALID_PCAPS" = "yes" ]; then if [ "$VALID_PCAPS" = "yes" ]; then
cat << EOF cat << EOF
Import complete! Import complete!
You can use the following hyperlink to view data in the time range of your import. You can triple-click to quickly highlight the entire hyperlink and you can then copy it into your browser: You can use the following hyperlink to view data in the time range of your import. You can triple-click to quickly highlight the entire hyperlink and you can then copy it into your browser:
https://{{ MASTERIP }}/kibana/app/kibana#/dashboard/a8411b30-6d03-11ea-b301-3d6c35840645?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:'${START_OLDEST}T00:00:00.000Z',mode:absolute,to:'${END_NEWEST}T00:00:00.000Z')) https://{{ MASTERIP }}/#/hunt?q=%2a%20%7C%20groupby%20event.module%20event.dataset&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20PM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20PM
or you can manually set your Time Range to be: or you can manually set your Time Range to be:
From: $START_OLDEST To: $END_NEWEST From: $START_OLDEST To: $END_NEWEST

1
salt/pcap/files/sensoroni.json
View File

@@ -8,6 +8,7 @@
"serverUrl": "https://{{ MASTER }}/sensoroniagents", "serverUrl": "https://{{ MASTER }}/sensoroniagents",
"verifyCert": false, "verifyCert": false,
"modules": { "modules": {
"importer": {},
"statickeyauth": { "statickeyauth": {
"apiKey": "{{ SENSORONIKEY }}" "apiKey": "{{ SENSORONIKEY }}"
}, },