CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update Integration JSON

Browse Source
This commit is contained in:
Josh Brower
2023-07-12 08:49:36 -04:00
parent 87eec4ae88
commit 40294e2762
1 changed files with 29 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
salt/elasticfleet/files/integrations/endpoints-initial/system-endpoints.json
View File

@@ -13,9 +13,14 @@
"system.auth": { "system.auth": {
"enabled": true, "enabled": true,
"vars": { "vars": {
"ignore_older": "72h",
"paths": [ "paths": [
"/var/log/auth.log*", "/var/log/auth.log*",
"/var/log/secure*" "/var/log/secure*"
],
"preserve_original_event": false,
"tags": [
"system-auth"
] ]
} }
}, },
@@ -24,27 +29,42 @@
"vars": { "vars": {
"paths": [ "paths": [
"/var/log/messages*", "/var/log/messages*",
"/var/log/syslog*" "/var/log/syslog*",
] "/var/log/system*"
],
"tags": [],
"ignore_older": "72h"
} }
} }
} }
}, },
"system-winlog": { "system-winlog": {
"enabled": true, "enabled": true,
"vars": {
"preserve_original_event": false
},
"streams": { "streams": {
"system.application": { "system.application": {
"enabled": true, "enabled": true,
"vars": { "vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": [] "tags": []
} }
}, },
"system.security": { "system.security": {
"enabled": true, "enabled": true,
"vars": { "vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
}
},
"system.system": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": [] "tags": []
} }
} }