mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-26 02:43:11 +01:00
Merge remote-tracking branch 'remotes/origin/dev' into feature/fleet-setup
This commit is contained in:
Josh Brower
@@ -17,6 +17,9 @@
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
default_salt_dir=/opt/so/saltstack/default
|
||||
local_salt_dir=/opt/so/saltstack/local
|
||||
|
||||
SKIP=0
|
||||
|
||||
while getopts "abowi:" OPTION
|
||||
@@ -80,10 +83,10 @@ if [ "$SKIP" -eq 0 ]; then
|
||||
fi
|
||||
|
||||
echo "Adding $IP to the $FULLROLE role. This can take a few seconds"
|
||||
/opt/so/saltstack/pillar/firewall/addfirewall.sh $FULLROLE $IP
|
||||
$default_salt_dir/pillar/firewall/addfirewall.sh $FULLROLE $IP
|
||||
|
||||
# Check if Wazuh enabled
|
||||
if grep -q -R "wazuh: 1" /opt/so/saltstack/pillar/*; then
|
||||
if grep -q -R "wazuh: 1" $local_salt_dir/pillar/*; then
|
||||
# If analyst, add to Wazuh AR whitelist
|
||||
if [ "$FULLROLE" == "analyst" ]; then
|
||||
WAZUH_MGR_CFG="/opt/so/wazuh/etc/ossec.conf"
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
#!/bin/bash
|
||||
local_salt_dir=/opt/so/saltstack/local
|
||||
|
||||
bro_logs_enabled() {
|
||||
|
||||
echo "brologs:" > /opt/so/saltstack/pillar/brologs.sls
|
||||
echo " enabled:" >> /opt/so/saltstack/pillar/brologs.sls
|
||||
echo "brologs:" > $local_salt_dir/pillar/brologs.sls
|
||||
echo " enabled:" >> $local_salt_dir/pillar/brologs.sls
|
||||
for BLOG in ${BLOGS[@]}; do
|
||||
echo " - $BLOG" | tr -d '"' >> /opt/so/saltstack/pillar/brologs.sls
|
||||
echo " - $BLOG" | tr -d '"' >> $local_salt_dir/pillar/brologs.sls
|
||||
done
|
||||
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
@@ -17,4 +17,5 @@
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-restart cortex $1
|
||||
/usr/sbin/so-stop cortex $1
|
||||
/usr/sbin/so-start thehive $1
|
||||
|
||||
@@ -17,4 +17,4 @@
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-start cortex $1
|
||||
/usr/sbin/so-start thehive $1
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
|
||||
112
salt/common/tools/sbin/so-docker-refresh
Normal file
112
salt/common/tools/sbin/so-docker-refresh
Normal file
@@ -0,0 +1,112 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
got_root(){
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "This script must be run using sudo!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
master_check() {
|
||||
# Check to see if this is a master
|
||||
MASTERCHECK=$(cat /etc/salt/grains | grep role | awk '{print $2}')
|
||||
if [ $MASTERCHECK == 'so-eval' ] || [ $MASTERCHECK == 'so-master' ] || [ $MASTERCHECK == 'so-mastersearch' ] || [ $MASTERCHECK == 'so-standalone' ] || [ $MASTERCHECK == 'so-helix' ]; then
|
||||
echo "This is a master. We can proceed"
|
||||
else
|
||||
echo "Please run soup on the master. The master controls all updates."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
update_docker_containers() {
|
||||
|
||||
# Download the containers from the interwebs
|
||||
for i in "${TRUSTED_CONTAINERS[@]}"
|
||||
do
|
||||
# Pull down the trusted docker image
|
||||
echo "Downloading $i"
|
||||
docker pull --disable-content-trust=false docker.io/soshybridhunter/$i
|
||||
# Tag it with the new registry destination
|
||||
docker tag soshybridhunter/$i $HOSTNAME:5000/soshybridhunter/$i
|
||||
docker push $HOSTNAME:5000/soshybridhunter/$i
|
||||
done
|
||||
|
||||
}
|
||||
|
||||
version_check() {
|
||||
if [ -f /etc/soversion ]; then
|
||||
VERSION=$(cat /etc/soversion)
|
||||
else
|
||||
echo "Unable to detect version. I will now terminate."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
got_root
|
||||
master_check
|
||||
version_check
|
||||
|
||||
# Use the hostname
|
||||
HOSTNAME=$(hostname)
|
||||
BUILD=HH
|
||||
# List all the containers
|
||||
if [ $MASTERCHECK != 'so-helix' ]; then
|
||||
TRUSTED_CONTAINERS=( \
|
||||
"so-acng:$BUILD$VERSION" \
|
||||
"so-thehive-cortex:$BUILD$VERSION" \
|
||||
"so-curator:$BUILD$VERSION" \
|
||||
"so-domainstats:$BUILD$VERSION" \
|
||||
"so-elastalert:$BUILD$VERSION" \
|
||||
"so-elasticsearch:$BUILD$VERSION" \
|
||||
"so-filebeat:$BUILD$VERSION" \
|
||||
"so-fleet:$BUILD$VERSION" \
|
||||
"so-fleet-launcher:$BUILD$VERSION" \
|
||||
"so-freqserver:$BUILD$VERSION" \
|
||||
"so-grafana:$BUILD$VERSION" \
|
||||
"so-idstools:$BUILD$VERSION" \
|
||||
"so-influxdb:$BUILD$VERSION" \
|
||||
"so-kibana:$BUILD$VERSION" \
|
||||
"so-kratos:$BUILD$VERSION" \
|
||||
"so-logstash:$BUILD$VERSION" \
|
||||
"so-mysql:$BUILD$VERSION" \
|
||||
"so-navigator:$BUILD$VERSION" \
|
||||
"so-nginx:$BUILD$VERSION" \
|
||||
"so-playbook:$BUILD$VERSION" \
|
||||
"so-redis:$BUILD$VERSION" \
|
||||
"so-soc:$BUILD$VERSION" \
|
||||
"so-soctopus:$BUILD$VERSION" \
|
||||
"so-steno:$BUILD$VERSION" \
|
||||
"so-strelka:$BUILD$VERSION" \
|
||||
"so-suricata:$BUILD$VERSION" \
|
||||
"so-telegraf:$BUILD$VERSION" \
|
||||
"so-thehive:$BUILD$VERSION" \
|
||||
"so-thehive-es:$BUILD$VERSION" \
|
||||
"so-wazuh:$BUILD$VERSION" \
|
||||
"so-zeek:$BUILD$VERSION" )
|
||||
else
|
||||
TRUSTED_CONTAINERS=( \
|
||||
"so-filebeat:$BUILD$VERSION" \
|
||||
"so-idstools:$BUILD$VERSION" \
|
||||
"so-logstash:$BUILD$VERSION" \
|
||||
"so-nginx:$BUILD$VERSION" \
|
||||
"so-redis:$BUILD$VERSION" \
|
||||
"so-steno:$BUILD$VERSION" \
|
||||
"so-suricata:$BUILD$VERSION" \
|
||||
"so-telegraf:$BUILD$VERSION" \
|
||||
"so-zeek:$BUILD$VERSION" )
|
||||
fi
|
||||
|
||||
update_docker_containers
|
||||
@@ -15,12 +15,13 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
default_salt_dir=/opt/so/saltstack/default
|
||||
ELASTICSEARCH_HOST="{{ MASTERIP}}"
|
||||
ELASTICSEARCH_PORT=9200
|
||||
#ELASTICSEARCH_AUTH=""
|
||||
|
||||
# Define a default directory to load pipelines from
|
||||
ELASTICSEARCH_TEMPLATES="/opt/so/saltstack/salt/logstash/pipelines/templates/so/"
|
||||
ELASTICSEARCH_TEMPLATES="$default_salt_dir/salt/logstash/pipelines/templates/so/"
|
||||
|
||||
# Wait for ElasticSearch to initialize
|
||||
echo -n "Waiting for ElasticSearch..."
|
||||
|
||||
@@ -15,10 +15,11 @@
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
local_salt_dir=/opt/so/saltstack/local
|
||||
|
||||
VERSION=$(grep soversion /opt/so/saltstack/pillar/static.sls | cut -d':' -f2|sed 's/ //g')
|
||||
VERSION=$(grep soversion $local_salt_dir/pillar/static.sls | cut -d':' -f2|sed 's/ //g')
|
||||
# Modify static.sls to enable Features
|
||||
sed -i 's/features: False/features: True/' /opt/so/saltstack/pillar/static.sls
|
||||
sed -i 's/features: False/features: True/' $local_salt_dir/pillar/static.sls
|
||||
SUFFIX="-features"
|
||||
TRUSTED_CONTAINERS=( \
|
||||
"so-elasticsearch:$VERSION$SUFFIX" \
|
||||
|
||||
@@ -1,4 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
local_salt_dir=/opt/so/saltstack/local
|
||||
|
||||
got_root() {
|
||||
|
||||
# Make sure you are root
|
||||
@@ -10,13 +13,13 @@ got_root() {
|
||||
}
|
||||
|
||||
got_root
|
||||
if [ ! -f /opt/so/saltstack/pillar/fireeye/init.sls ]; then
|
||||
if [ ! -f $local_salt_dir/pillar/fireeye/init.sls ]; then
|
||||
echo "This is nto configured for Helix Mode. Please re-install."
|
||||
exit
|
||||
else
|
||||
echo "Enter your Helix API Key: "
|
||||
read APIKEY
|
||||
sed -i "s/^ api_key.*/ api_key: $APIKEY/g" /opt/so/saltstack/pillar/fireeye/init.sls
|
||||
sed -i "s/^ api_key.*/ api_key: $APIKEY/g" $local_salt_dir/pillar/fireeye/init.sls
|
||||
docker stop so-logstash
|
||||
docker rm so-logstash
|
||||
echo "Restarting Logstash for updated key"
|
||||
|
||||
57
salt/common/tools/sbin/so-saltstack-update
Normal file
57
salt/common/tools/sbin/so-saltstack-update
Normal file
@@ -0,0 +1,57 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
default_salt_dir=/opt/so/saltstack/default
|
||||
clone_to_tmp() {
|
||||
|
||||
# TODO Need to add a air gap option
|
||||
# Make a temp location for the files
|
||||
mkdir /tmp/sogh
|
||||
cd /tmp/sogh
|
||||
#git clone -b dev https://github.com/Security-Onion-Solutions/securityonion-saltstack.git
|
||||
git clone https://github.com/Security-Onion-Solutions/securityonion-saltstack.git
|
||||
cd /tmp
|
||||
|
||||
}
|
||||
|
||||
copy_new_files() {
|
||||
|
||||
# Copy new files over to the salt dir
|
||||
cd /tmp/sogh/securityonion-saltstack
|
||||
git checkout $BRANCH
|
||||
rsync -a --exclude-from 'exclude-list.txt' salt $default_salt_dir/
|
||||
rsync -a --exclude-from 'exclude-list.txt' pillar $default_salt_dir/
|
||||
chown -R socore:socore $default_salt_dir/salt
|
||||
chown -R socore:socore $default_salt_dir/pillar
|
||||
chmod 755 $default_salt_dir/pillar/firewall/addfirewall.sh
|
||||
rm -rf /tmp/sogh
|
||||
}
|
||||
|
||||
got_root(){
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "This script must be run using sudo!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
got_root
|
||||
if [ $# -ne 1 ] ; then
|
||||
BRANCH=master
|
||||
else
|
||||
BRANCH=$1
|
||||
fi
|
||||
clone_to_tmp
|
||||
copy_new_files
|
||||
@@ -32,5 +32,5 @@ fi
|
||||
case $1 in
|
||||
"all") salt-call state.highstate queue=True;;
|
||||
"steno") if docker ps | grep -q so-$1; then printf "\n$1 is already running!\n\n"; else docker rm so-$1 >/dev/null 2>&1 ; salt-call state.apply pcap queue=True; fi ;;
|
||||
*) if docker ps | grep -q so-$1; then printf "\n$1 is already running\n\n"; else docker rm so-$1 >/dev/null 2>&1 ; salt-call state.apply $1 queue=True; fi ;;
|
||||
*) if docker ps | grep -E -q '^so-$1$'; then printf "\n$1 is already running\n\n"; else docker rm so-$1 >/dev/null 2>&1 ; salt-call state.apply $1 queue=True; fi ;;
|
||||
esac
|
||||
|
||||
21
salt/common/tools/sbin/so-thehive-es-restart
Executable file
21
salt/common/tools/sbin/so-thehive-es-restart
Executable file
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-stop thehive-es $1
|
||||
/usr/sbin/so-start thehive $1
|
||||
20
salt/common/tools/sbin/so-thehive-es-start
Executable file
20
salt/common/tools/sbin/so-thehive-es-start
Executable file
@@ -0,0 +1,20 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-start thehive $1
|
||||
20
salt/common/tools/sbin/so-thehive-es-stop
Executable file
20
salt/common/tools/sbin/so-thehive-es-stop
Executable file
@@ -0,0 +1,20 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-stop thehive-es $1
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
#
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
|
||||
39
salt/common/tools/sbin/so-zeek-stats
Normal file
39
salt/common/tools/sbin/so-zeek-stats
Normal file
@@ -0,0 +1,39 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# Show Zeek stats (capstats, netstats)
|
||||
|
||||
show_stats() {
|
||||
echo '##############'
|
||||
echo '# Zeek Stats #'
|
||||
echo '##############'
|
||||
echo
|
||||
echo "Average throughput:"
|
||||
echo
|
||||
docker exec -it so-zeek /opt/zeek/bin/zeekctl capstats
|
||||
echo
|
||||
echo "Average packet loss:"
|
||||
echo
|
||||
docker exec -it so-zeek /opt/zeek/bin/zeekctl netstats
|
||||
echo
|
||||
}
|
||||
|
||||
if docker ps | grep -q zeek; then
|
||||
show_stats
|
||||
else
|
||||
echo "Zeek is not running! Try starting it with 'so-zeek-start'." && exit 1;
|
||||
fi
|
||||
Reference in New Issue
Block a user