CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add time shift

Browse Source
This commit is contained in:
weslambert
2023-08-03 08:51:23 -04:00
committed by GitHub
parent 3368789b43
commit 3847863b3d
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
salt/common/tools/sbin_jinja/so-import-evtx
View File

@@ -44,6 +44,10 @@ while [[ $# -gt 0 ]]; do
--quiet) --quiet)
quiet=1 quiet=1
;; ;;
--shift)
SHIFTDATE=$1
shift
;;
-*) -*)
echo "Encountered unexpected parameter: $param" echo "Encountered unexpected parameter: $param"
usage usage
@@ -68,8 +72,10 @@ function status {
function evtx2es() { function evtx2es() {
EVTX=$1 EVTX=$1
HASH=$2 HASH=$2
SHIFTDATE=$3
docker run --rm \ docker run --rm \
-e "SHIFTTS=$SHIFTDATE" \
-v "$EVTX:/tmp/data.evtx" \ -v "$EVTX:/tmp/data.evtx" \
-v "/nsm/import/$HASH/evtx/:/tmp/evtx/" \ -v "/nsm/import/$HASH/evtx/:/tmp/evtx/" \
-v "/nsm/import/evtx-end_newest:/tmp/newest" \ -v "/nsm/import/evtx-end_newest:/tmp/newest" \
@@ -113,7 +119,9 @@ echo $END_NEWEST > /nsm/import/evtx-end_newest
for EVTX in $INPUT_FILES; do for EVTX in $INPUT_FILES; do
EVTX=$(/usr/bin/realpath "$EVTX") EVTX=$(/usr/bin/realpath "$EVTX")
status "Processing Import: ${EVTX}" status "Processing Import: ${EVTX}"
if ! [ -z "$SHIFTDATE" ]; then
status "- timeshifting logs to end date of $SHIFTDATE"
fi
# generate a unique hash to assist with dedupe checks # generate a unique hash to assist with dedupe checks
HASH=$(md5sum "${EVTX}" | awk '{ print $1 }') HASH=$(md5sum "${EVTX}" | awk '{ print $1 }')
HASH_DIR=/nsm/import/${HASH} HASH_DIR=/nsm/import/${HASH}
@@ -136,7 +144,7 @@ for EVTX in $INPUT_FILES; do
# import evtx and write them to import ingest pipeline # import evtx and write them to import ingest pipeline
status "- importing logs to Elasticsearch..." status "- importing logs to Elasticsearch..."
evtx2es "${EVTX}" $HASH evtx2es "${EVTX}" $HASH "$SHIFTDATE"
if [[ $? -ne 0 ]]; then if [[ $? -ne 0 ]]; then
INVALID_EVTXS_COUNT=$((INVALID_EVTXS_COUNT + 1)) INVALID_EVTXS_COUNT=$((INVALID_EVTXS_COUNT + 1))
status "- WARNING: This evtx file may not have fully imported successfully" status "- WARNING: This evtx file may not have fully imported successfully"