diff --git a/salt/common/tools/sbin/so-cortex-restart b/salt/common/tools/sbin/so-cortex-restart
index ef0e3e4fe..841ca1bb6 100755
--- a/salt/common/tools/sbin/so-cortex-restart
+++ b/salt/common/tools/sbin/so-cortex-restart
@@ -1,5 +1,5 @@
#!/bin/bash
-
+#
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
@@ -17,4 +17,5 @@
. /usr/sbin/so-common
-/usr/sbin/so-restart cortex $1
+/usr/sbin/so-stop cortex $1
+/usr/sbin/so-start thehive $1
diff --git a/salt/common/tools/sbin/so-cortex-start b/salt/common/tools/sbin/so-cortex-start
index a08969cab..92fe88bb5 100755
--- a/salt/common/tools/sbin/so-cortex-start
+++ b/salt/common/tools/sbin/so-cortex-start
@@ -17,4 +17,4 @@
. /usr/sbin/so-common
-/usr/sbin/so-start cortex $1
+/usr/sbin/so-start thehive $1
diff --git a/salt/common/tools/sbin/so-cortex-stop b/salt/common/tools/sbin/so-cortex-stop
index a13d1e2e3..727b2c7fa 100755
--- a/salt/common/tools/sbin/so-cortex-stop
+++ b/salt/common/tools/sbin/so-cortex-stop
@@ -1,5 +1,5 @@
#!/bin/bash
-
+#
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
diff --git a/salt/common/tools/sbin/so-thehive-es-restart b/salt/common/tools/sbin/so-thehive-es-restart
new file mode 100755
index 000000000..d58caecdc
--- /dev/null
+++ b/salt/common/tools/sbin/so-thehive-es-restart
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+
+. /usr/sbin/so-common
+
+/usr/sbin/so-stop thehive-es $1
+/usr/sbin/so-start thehive $1
diff --git a/salt/common/tools/sbin/so-thehive-es-start b/salt/common/tools/sbin/so-thehive-es-start
new file mode 100755
index 000000000..92fe88bb5
--- /dev/null
+++ b/salt/common/tools/sbin/so-thehive-es-start
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+
+. /usr/sbin/so-common
+
+/usr/sbin/so-start thehive $1
diff --git a/salt/common/tools/sbin/so-thehive-es-stop b/salt/common/tools/sbin/so-thehive-es-stop
new file mode 100755
index 000000000..cf9cc2310
--- /dev/null
+++ b/salt/common/tools/sbin/so-thehive-es-stop
@@ -0,0 +1,20 @@
+#!/bin/bash
+#
+# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+
+. /usr/sbin/so-common
+
+/usr/sbin/so-stop thehive-es $1
diff --git a/salt/common/tools/sbin/so-thehive-restart b/salt/common/tools/sbin/so-thehive-restart
index 08cd8318e..4b28c0030 100755
--- a/salt/common/tools/sbin/so-thehive-restart
+++ b/salt/common/tools/sbin/so-thehive-restart
@@ -1,5 +1,5 @@
#!/bin/bash
-
+#
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
diff --git a/salt/common/tools/sbin/so-thehive-stop b/salt/common/tools/sbin/so-thehive-stop
index b326f699c..6c56e0473 100755
--- a/salt/common/tools/sbin/so-thehive-stop
+++ b/salt/common/tools/sbin/so-thehive-stop
@@ -1,5 +1,5 @@
#!/bin/bash
-
+#
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls
index 409594b2d..e5dc78d33 100644
--- a/salt/filebeat/init.sls
+++ b/salt/filebeat/init.sls
@@ -57,7 +57,7 @@ so-filebeat:
- /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
- /nsm/zeek:/nsm/zeek:ro
- /nsm/strelka/log:/nsm/strelka/log:ro
- - /opt/so/log/suricata:/suricata:ro
+ - /nsm/suricata:/suricata:ro
- /opt/so/wazuh/logs/alerts:/wazuh/alerts:ro
- /opt/so/wazuh/logs/archives:/wazuh/archives:ro
- /nsm/osquery/fleet/:/nsm/osquery/fleet:ro
diff --git a/salt/hive/thehive/scripts/hive_init b/salt/hive/thehive/scripts/hive_init
deleted file mode 100755
index 0db2c75f9..000000000
--- a/salt/hive/thehive/scripts/hive_init
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/bin/bash
-{% set MASTERIP = salt['pillar.get']('static:masterip', '') %}
-{%- set HIVEUSER = salt['pillar.get']('static:hiveuser', '') %}
-{%- set HIVEPASSWORD = salt['pillar.get']('static:hivepassword', '') %}
-{%- set HIVEKEY = salt['pillar.get']('static:hivekey', '') %}
-
-default_salt_dir=/opt/so/saltstack/default
-
-hive_init(){
- sleep 120
- HIVE_IP="{{MASTERIP}}"
- HIVE_USER="{{HIVEUSER}}"
- HIVE_PASSWORD="{{HIVEPASSWORD}}"
- HIVE_KEY="{{HIVEKEY}}"
- SOCTOPUS_CONFIG="$default_salt_dir/salt/soctopus/files/SOCtopus.conf"
-
- echo -n "Waiting for TheHive..."
- COUNT=0
- HIVE_CONNECTED="no"
- while [[ "$COUNT" -le 240 ]]; do
- curl --output /dev/null --silent --head --fail -k "https://$HIVE_IP/thehive"
- if [ $? -eq 0 ]; then
- HIVE_CONNECTED="yes"
- echo "connected!"
- break
- else
- ((COUNT+=1))
- sleep 1
- echo -n "."
- fi
- done
-
- if [ "$HIVE_CONNECTED" == "yes" ]; then
-
- # Migrate DB
- curl -v -k -XPOST "https://$HIVE_IP:/thehive/api/maintenance/migrate"
-
- # Create intial TheHive user
- curl -v -k "https://$HIVE_IP/thehive/api/user" -H "Content-Type: application/json" -d "{\"login\" : \"$HIVE_USER\",\"name\" : \"$HIVE_USER\",\"roles\" : [\"read\",\"alert\",\"write\",\"admin\"],\"preferences\" : \"{}\",\"password\" : \"$HIVE_PASSWORD\", \"key\": \"$HIVE_KEY\"}"
-
- # Pre-load custom fields
- #
- # reputation
- curl -v -k "https://$HIVE_IP/thehive/api/list/custom_fields" -H "Authorization: Bearer $HIVE_KEY" -H "Content-Type: application/json" -d "{\"value\":{\"name\": \"reputation\", \"reference\": \"reputation\", \"description\": \"This field provides an overall reputation status for an address/domain.\", \"type\": \"string\", \"options\": []}}"
-
-
- touch /opt/so/state/thehive.txt
- else
- echo "We experienced an issue connecting to TheHive!"
- fi
-}
-
-if [ -f /opt/so/state/thehive.txt ]; then
- exit 0
-else
- rm -f garbage_file
- while ! wget -O garbage_file {{MASTERIP}}:9400 2>/dev/null
- do
- echo "Waiting for Elasticsearch..."
- rm -f garbage_file
- sleep 1
- done
- rm -f garbage_file
- sleep 5
- hive_init
-fi
diff --git a/salt/logstash/init.sls b/salt/logstash/init.sls
index ba0e015f4..1118b6807 100644
--- a/salt/logstash/init.sls
+++ b/salt/logstash/init.sls
@@ -198,7 +198,7 @@ so-logstash:
- /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro
{%- if grains['role'] == 'so-eval' %}
- /nsm/zeek:/nsm/zeek:ro
- - /opt/so/log/suricata:/suricata:ro
+ - /nsm/suricata:/suricata:ro
- /opt/so/wazuh/logs/alerts:/wazuh/alerts:ro
- /opt/so/wazuh/logs/archives:/wazuh/archives:ro
- /opt/so/log/fleet/:/osquery/logs:ro
diff --git a/salt/suricata/files/suricata.yaml b/salt/suricata/files/suricata.yaml
index 5a0121b63..65465806f 100644
--- a/salt/suricata/files/suricata.yaml
+++ b/salt/suricata/files/suricata.yaml
@@ -99,7 +99,7 @@ outputs:
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
- filename: eve.json
+ filename: /nsm/eve.json
rotate-interval: day
community-id: true
community-id-seed: 0
@@ -918,7 +918,7 @@ host-mode: auto
# If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules
# apply. In that case try something like 60000 or more. This is because the CUDA
# pattern matcher buffers and scans as many packets as possible in parallel.
-#max-pending-packets: 1024
+max-pending-packets: 5000
# Runmode the engine should use. Please check --list-runmodes to get the available
# runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
diff --git a/salt/suricata/init.sls b/salt/suricata/init.sls
index cc6c6f8a3..a5e575af1 100644
--- a/salt/suricata/init.sls
+++ b/salt/suricata/init.sls
@@ -59,6 +59,12 @@ ruleslink:
file.symlink:
- name: /opt/so/saltstack/local/salt/suricata/rules
- target: /opt/so/rules/nids
+
+suridatadir:
+ file.directory:
+ - name: /nsm/suricata
+ - user: 940
+ - group: 939
surirulesync:
file.recurse:
@@ -124,6 +130,7 @@ so-suricata:
- /opt/so/conf/suricata/threshold.conf:/etc/suricata/threshold.conf:ro
- /opt/so/conf/suricata/rules:/etc/suricata/rules:ro
- /opt/so/log/suricata/:/var/log/suricata/:rw
+ - /nsm/suricata/:/nsm/:rw
- /opt/so/conf/suricata/bpf:/etc/suricata/bpf:ro
- network_mode: host
- watch:
diff --git a/salt/hive/thehive/etc/application.conf b/salt/thehive/etc/application.conf
similarity index 99%
rename from salt/hive/thehive/etc/application.conf
rename to salt/thehive/etc/application.conf
index 230d87d67..8630cb386 100644
--- a/salt/hive/thehive/etc/application.conf
+++ b/salt/thehive/etc/application.conf
@@ -12,7 +12,7 @@ search {
# Name of the index
index = the_hive
# Name of the Elasticsearch cluster
- cluster = hive
+ cluster = thehive
# Address of the Elasticsearch instance
host = ["{{ MASTERIP }}:9500"]
#search.uri = "http://{{ MASTERIP }}:9500"
diff --git a/salt/hive/thehive/etc/cortex-application.conf b/salt/thehive/etc/cortex-application.conf
similarity index 99%
rename from salt/hive/thehive/etc/cortex-application.conf
rename to salt/thehive/etc/cortex-application.conf
index 356bfd7b3..1a887cdb3 100644
--- a/salt/hive/thehive/etc/cortex-application.conf
+++ b/salt/thehive/etc/cortex-application.conf
@@ -12,7 +12,7 @@ search {
# Name of the index
index = cortex
# Name of the Elasticsearch cluster
- cluster = hive
+ cluster = thehive
# Address of the Elasticsearch instance
host = ["{{ MASTERIP }}:9500"]
# Scroll keepalive
diff --git a/salt/hive/thehive/etc/es/elasticsearch.yml b/salt/thehive/etc/es/elasticsearch.yml
similarity index 95%
rename from salt/hive/thehive/etc/es/elasticsearch.yml
rename to salt/thehive/etc/es/elasticsearch.yml
index d00c01d5d..7f268a671 100644
--- a/salt/hive/thehive/etc/es/elasticsearch.yml
+++ b/salt/thehive/etc/es/elasticsearch.yml
@@ -1,4 +1,4 @@
-cluster.name: "hive"
+cluster.name: "thehive"
network.host: 0.0.0.0
discovery.zen.minimum_master_nodes: 1
# This is a test -- if this is here, then the volume is mounted correctly.
diff --git a/salt/hive/thehive/etc/es/log4j2.properties b/salt/thehive/etc/es/log4j2.properties
similarity index 100%
rename from salt/hive/thehive/etc/es/log4j2.properties
rename to salt/thehive/etc/es/log4j2.properties
diff --git a/salt/hive/init.sls b/salt/thehive/init.sls
similarity index 70%
rename from salt/hive/init.sls
rename to salt/thehive/init.sls
index 2be2f7480..732fe4a77 100644
--- a/salt/hive/init.sls
+++ b/salt/thehive/init.sls
@@ -1,24 +1,24 @@
{% set MASTERIP = salt['pillar.get']('master:mainip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.2.2') %}
{% set MASTER = salt['grains.get']('master') %}
-hiveconfdir:
+thehiveconfdir:
file.directory:
- - name: /opt/so/conf/hive/etc
+ - name: /opt/so/conf/thehive/etc
- makedirs: True
- user: 939
- group: 939
-hivelogdir:
+thehivelogdir:
file.directory:
- - name: /opt/so/log/hive
+ - name: /opt/so/log/thehive
- makedirs: True
- user: 939
- group: 939
-hiveconf:
+thehiveconf:
file.recurse:
- - name: /opt/so/conf/hive/etc
- - source: salt://hive/thehive/etc
+ - name: /opt/so/conf/thehive/etc
+ - source: salt://thehive/etc
- user: 939
- group: 939
- template: jinja
@@ -40,7 +40,7 @@ cortexlogdir:
cortexconf:
file.recurse:
- name: /opt/so/conf/cortex
- - source: salt://hive/thehive/etc
+ - source: salt://thehive/etc
- user: 939
- group: 939
- template: jinja
@@ -48,9 +48,9 @@ cortexconf:
# Install Elasticsearch
# Made directory for ES data to live in
-hiveesdata:
+thehiveesdata:
file.directory:
- - name: /nsm/hive/esdata
+ - name: /nsm/thehive/esdata
- makedirs: True
- user: 939
- group: 939
@@ -64,16 +64,16 @@ so-thehive-es:
- interactive: True
- tty: True
- binds:
- - /nsm/hive/esdata:/usr/share/elasticsearch/data:rw
- - /opt/so/conf/hive/etc/es/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
- - /opt/so/conf/hive/etc/es/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro
- - /opt/so/log/hive:/var/log/elasticsearch:rw
+ - /nsm/thehive/esdata:/usr/share/elasticsearch/data:rw
+ - /opt/so/conf/thehive/etc/es/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
+ - /opt/so/conf/thehive/etc/es/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro
+ - /opt/so/log/thehive:/var/log/elasticsearch:rw
- environment:
- http.host=0.0.0.0
- http.port=9400
- transport.tcp.port=9500
- transport.host=0.0.0.0
- - cluster.name=hive
+ - cluster.name=thehive
- thread_pool.index.queue_size=100000
- thread_pool.search.queue_size=100000
- thread_pool.bulk.queue_size=100000
@@ -90,13 +90,13 @@ so-cortex:
- name: so-cortex
- user: 939
- binds:
- - /opt/so/conf/hive/etc/cortex-application.conf:/opt/cortex/conf/application.conf:ro
+ - /opt/so/conf/thehive/etc/cortex-application.conf:/opt/cortex/conf/application.conf:ro
- port_bindings:
- 0.0.0.0:9001:9001
cortexscript:
cmd.script:
- - source: salt://hive/thehive/scripts/cortex_init
+ - source: salt://thehive/scripts/cortex_init
- cwd: /opt/so
- template: jinja
@@ -109,12 +109,12 @@ so-thehive:
- name: so-thehive
- user: 939
- binds:
- - /opt/so/conf/hive/etc/application.conf:/opt/thehive/conf/application.conf:ro
+ - /opt/so/conf/thehive/etc/application.conf:/opt/thehive/conf/application.conf:ro
- port_bindings:
- 0.0.0.0:9000:9000
-hivescript:
+thehivescript:
cmd.script:
- - source: salt://hive/thehive/scripts/hive_init
+ - source: salt://thehive/scripts/hive_init
- cwd: /opt/so
- template: jinja
diff --git a/salt/hive/thehive/scripts/cortex_init b/salt/thehive/scripts/cortex_init
similarity index 100%
rename from salt/hive/thehive/scripts/cortex_init
rename to salt/thehive/scripts/cortex_init
diff --git a/salt/thehive/scripts/hive_init b/salt/thehive/scripts/hive_init
new file mode 100755
index 000000000..296004e77
--- /dev/null
+++ b/salt/thehive/scripts/hive_init
@@ -0,0 +1,64 @@
+#!/bin/bash
+{% set MASTERIP = salt['pillar.get']('static:masterip', '') %}
+{%- set THEHIVEUSER = salt['pillar.get']('static:hiveuser', '') %}
+{%- set THEHIVEPASSWORD = salt['pillar.get']('static:hivepassword', '') %}
+{%- set THEHIVEKEY = salt['pillar.get']('static:hivekey', '') %}
+
+thehive_init(){
+ sleep 120
+ THEHIVE_IP="{{MASTERIP}}"
+ THEHIVE_USER="{{THEHIVEUSER}}"
+ THEHIVE_PASSWORD="{{THEHIVEPASSWORD}}"
+ THEHIVE_KEY="{{THEHIVEKEY}}"
+ SOCTOPUS_CONFIG="/opt/so/saltstack/salt/soctopus/files/SOCtopus.conf"
+
+ echo -n "Waiting for TheHive..."
+ COUNT=0
+ THEHIVE_CONNECTED="no"
+ while [[ "$COUNT" -le 240 ]]; do
+ curl --output /dev/null --silent --head --fail -k "https://$THEHIVE_IP/thehive"
+ if [ $? -eq 0 ]; then
+ THEHIVE_CONNECTED="yes"
+ echo "connected!"
+ break
+ else
+ ((COUNT+=1))
+ sleep 1
+ echo -n "."
+ fi
+ done
+
+ if [ "$THEHIVE_CONNECTED" == "yes" ]; then
+
+ # Migrate DB
+ curl -v -k -XPOST "https://$THEHIVE_IP:/thehive/api/maintenance/migrate"
+
+ # Create intial TheHive user
+ curl -v -k "https://$THEHIVE_IP/thehive/api/user" -H "Content-Type: application/json" -d "{\"login\" : \"$THEHIVE_USER\",\"name\" : \"$THEHIVE_USER\",\"roles\" : [\"read\",\"alert\",\"write\",\"admin\"],\"preferences\" : \"{}\",\"password\" : \"$THEHIVE_PASSWORD\", \"key\": \"$THEHIVE_KEY\"}"
+
+ # Pre-load custom fields
+ #
+ # reputation
+ curl -v -k "https://$THEHIVE_IP/thehive/api/list/custom_fields" -H "Authorization: Bearer $THEHIVE_KEY" -H "Content-Type: application/json" -d "{\"value\":{\"name\": \"reputation\", \"reference\": \"reputation\", \"description\": \"This field provides an overall reputation status for an address/domain.\", \"type\": \"string\", \"options\": []}}"
+
+
+ touch /opt/so/state/thehive.txt
+ else
+ echo "We experienced an issue connecting to TheHive!"
+ fi
+}
+
+if [ -f /opt/so/state/thehive.txt ]; then
+ exit 0
+else
+ rm -f garbage_file
+ while ! wget -O garbage_file {{MASTERIP}}:9400 2>/dev/null
+ do
+ echo "Waiting for Elasticsearch..."
+ rm -f garbage_file
+ sleep 1
+ done
+ rm -f garbage_file
+ sleep 5
+ thehive_init
+fi
diff --git a/setup/automation/pm_standalone_defaults b/setup/automation/pm_standalone_defaults
index b5a6258ff..166d4a5d7 100644
--- a/setup/automation/pm_standalone_defaults
+++ b/setup/automation/pm_standalone_defaults
@@ -34,6 +34,7 @@ HNMASTER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
HNSENSOR=inherit
HOSTNAME=standalone
install_type=STANDALONE
+IP=192.168.0.0/16
# LSINPUTBATCHCOUNT=
# LSINPUTTHREADS=
# LSPIPELINEBATCH=
diff --git a/setup/so-functions b/setup/so-functions
index 0923fb137..53abe311e 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -1012,6 +1012,9 @@ parse_options() {
export {https,ftp,rsync,all}_proxy="$http_proxy"
;;
+ "--allow-analyst"|"--allow=a")
+ allow='a'
+ ;;
*)
if [[ $1 = --* ]]; then
echo "Invalid option"
diff --git a/setup/so-setup b/setup/so-setup
index 919283237..d059376b9 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -541,6 +541,7 @@ fi
success=$(tail -10 $setup_log | grep Failed | awk '{ print $2}')
if [[ "$success" = 0 ]]; then
whiptail_setup_complete
+ if [[ -n $allow ]]; then so-allow -$allow; fi
if [[ $THEHIVE == 1 ]]; then
check_hive_init_then_reboot
else