CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix logscan pipeline on eval

Browse Source 
* Rename logscan pipeline to logscan.alert
* Add module to indices array in filebeat.yml
This commit is contained in:
William Wernert
2021-07-30 14:41:15 -04:00
parent b9980c9d30
commit 33bd6aed20
3 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
salt/elasticsearch/files/ingest/logscan → salt/elasticsearch/files/ingest/logscan.alert
View File

3
salt/filebeat/etc/filebeat.yml
View File

@@ -307,6 +307,9 @@ output.elasticsearch:
- index: "so-strelka" - index: "so-strelka"
when.contains: when.contains:
module: "strelka" module: "strelka"
- index: "so-logscan"
when.contains:
module: "logscan"
setup.template.enabled: false setup.template.enabled: false
{%- else %} {%- else %}

2
salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
View File

@@ -10,7 +10,7 @@ output {
if [module] =~ "logscan" { if [module] =~ "logscan" {
elasticsearch { elasticsearch {
id => "logscan_pipeline" id => "logscan_pipeline"
pipeline => "logscan" pipeline => "logscan.alert"
hosts => "{{ ES }}" hosts => "{{ ES }}"
{% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %} {% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
user => "{{ ES_USER }}" user => "{{ ES_USER }}"