From 48d1d0c16801667b661f76fe65116df23cc1f4d7 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 11 Sep 2020 18:24:56 -0400 Subject: [PATCH 1/8] Strelkas Rules Update --- salt/common/tools/sbin/so-yara-update | 63 ++++++++++++++++++++++++++- salt/manager/init.sls | 8 ++++ salt/soctopus/init.sls | 8 +++- salt/strelka/init.sls | 13 ++---- setup/so-functions | 8 ++++ setup/so-setup | 8 ++-- 6 files changed, 92 insertions(+), 16 deletions(-) diff --git a/salt/common/tools/sbin/so-yara-update b/salt/common/tools/sbin/so-yara-update index 884c13728..918d6a9aa 100755 --- a/salt/common/tools/sbin/so-yara-update +++ b/salt/common/tools/sbin/so-yara-update @@ -14,8 +14,8 @@ # # You should have received a copy of the GNU General Public License # along with this program. If not, see . +{%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') -%} -clone_dir="/tmp" output_dir="/opt/so/saltstack/default/salt/strelka/rules" #mkdir -p $output_dir repos="$output_dir/repos.txt" @@ -27,6 +27,66 @@ updatecounter=0 gh_status=$(curl -s -o /dev/null -w "%{http_code}" http://github.com) +{%- if ISAIRGAP is sameas true -%} +clone_dir="/nsm/repo/rules/strelka" +repo_name="signature-base" +mkdir -p $output_dir/$repo_name +[ -f $clone_dir/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name + +# Copy over rules +for i in $(find $clone_dir -name "*.yar*"); do + rule_name=$(echo $i | awk -F '/' '{print $NF}') + repo_sum=$(sha256sum $i | awk '{print $1}') + + # Check rules against those in ignore list -- don't copy if ignored. + if ! grep -iq $rule_name $ignorefile; then + existing_rules=$(find $output_dir/$repo_name/ -name $rule_name | wc -l) + + # For existing rules, check to see if they need to be updated, by comparing checksums + if [ $existing_rules -gt 0 ];then + local_sum=$(sha256sum $output_dir/$repo_name/$rule_name | awk '{print $1}') + if [ "$repo_sum" != "$local_sum" ]; then + echo "Checksums do not match!" + echo "Updating $rule_name..." + cp $i $output_dir/$repo_name; + ((updatecounter++)) + fi + else + # If rule doesn't exist already, we'll add it + echo "Adding new rule: $rule_name..." + cp $i $output_dir/$repo_name + ((newcounter++)) + fi + fi; +done + +# Check to see if we have any old rules that need to be removed +for i in $(find $output_dir/$repo_name -name "*.yar*" | awk -F '/' '{print $NF}'); do + is_repo_rule=$(find $clone_dir -name "$i" | wc -l) + if [ $is_repo_rule -eq 0 ]; then + echo "Could not find $i in source $repo_name repo...removing from $output_dir/$repo_name..." + rm $output_dir/$repo_name/$i + ((deletecounter++)) + fi +done + +echo "Done!" + + if [ "$newcounter" -gt 0 ];then + echo "$newcounter new rules added." + fi + + if [ "$updatecounter" -gt 0 ];then + echo "$updatecounter rules updated." + fi + + if [ "$deletecounter" -gt 0 ];then + echo "$deletecounter rules removed because they were deprecated or don't exist in the source repo." + fi + +{%- else -%} + +clone_dir="/tmp" if [ "$gh_status" == "200" ] || [ "$gh_status" == "301" ]; then while IFS= read -r repo; do @@ -100,3 +160,4 @@ else echo "No connectivity to Github...exiting..." exit 1 fi +{%- endif -%} \ No newline at end of file diff --git a/salt/manager/init.sls b/salt/manager/init.sls index 3b4852542..0046deb95 100644 --- a/salt/manager/init.sls +++ b/salt/manager/init.sls @@ -16,6 +16,7 @@ {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %} {% set MANAGER = salt['grains.get']('master') %} {% set managerproxy = salt['pillar.get']('global:managerupdate', '0') %} +{% set STRELKA_RULES = salt['pillar.get']('strelka:rules', '1') %} socore_own_saltstack: file.directory: @@ -76,3 +77,10 @@ so-aptcacherng: - /opt/so/conf/aptcacher-ng/etc/acng.conf:/etc/apt-cacher-ng/acng.conf:ro {% endif %} + +strelka_yara_update: + cron.present: + - user: root + - name: '/usr/sbin/so-yara-update > /dev/null 2>&1' + - hour: '7' + - minute: '1' diff --git a/salt/soctopus/init.sls b/salt/soctopus/init.sls index 39768fc42..f57ce216d 100644 --- a/salt/soctopus/init.sls +++ b/salt/soctopus/init.sls @@ -1,8 +1,9 @@ {% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %} {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %} {% set MANAGER = salt['grains.get']('master') %} -{%- set MANAGER_URL = salt['pillar.get']('global:url_base', '') %} -{%- set MANAGER_IP = salt['pillar.get']('global:managerip', '') %} +{% set MANAGER_URL = salt['pillar.get']('global:url_base', '') %} +{% set MANAGER_IP = salt['pillar.get']('global:managerip', '') %} +{% set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %} soctopusdir: file.directory: @@ -59,6 +60,9 @@ so-soctopus: - /opt/so/log/soctopus/:/var/log/SOCtopus/:rw - /opt/so/rules/elastalert/playbook:/etc/playbook-rules:rw - /opt/so/conf/navigator/nav_layer_playbook.json:/etc/playbook/nav_layer_playbook.json:rw + {% if ISAIRGAP is sameas true %} + - /nsm/repo/rules/sigma:/soctopus/sigma + {% endif %} - port_bindings: - 0.0.0.0:7000:7000 - extra_hosts: diff --git a/salt/strelka/init.sls b/salt/strelka/init.sls index 1e87aa602..61d0ce8ad 100644 --- a/salt/strelka/init.sls +++ b/salt/strelka/init.sls @@ -12,11 +12,11 @@ # # You should have received a copy of the GNU General Public License # along with this program. If not, see . -{%- set MANAGER = salt['grains.get']('master') %} -{%- set MANAGERIP = salt['pillar.get']('global:managerip', '') %} +{% set MANAGER = salt['grains.get']('master') %} +{% set MANAGERIP = salt['pillar.get']('global:managerip', '') %} {% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %} {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %} -{%- set STRELKA_RULES = salt['pillar.get']('strelka:rules', '1') -%} +{% set STRELKA_RULES = salt['pillar.get']('strelka:rules', '1') %} # Strelka config strelkaconfdir: @@ -43,12 +43,6 @@ strelkasync: - template: jinja {%- if STRELKA_RULES == 1 %} -strelka_yara_update: - cron.present: - - user: root - - name: '[ -d /opt/so/saltstack/default/salt/strelka/rules/ ] && /usr/sbin/so-yara-update > /dev/null 2>&1' - - hour: '7' - - minute: '1' strelkarules: file.recurse: @@ -56,6 +50,7 @@ strelkarules: - source: salt://strelka/rules - user: 939 - group: 939 + {%- endif %} strelkadatadir: diff --git a/setup/so-functions b/setup/so-functions index 2bcae4a30..17736dd76 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -50,6 +50,14 @@ airgap_rules() { # Copy the rules for suricata if using Airgap mkdir -p /nsm/repo/rules cp -v /root/SecurityOnion/agrules/emerging-all.rules /nsm/repo/rules/ + + # Copy over sigma rules + cp -Rv /root/SecurityOnion/agrules/sigma /nsm/repo/rules/ + + # Don't leave Strelka out + cp -v /root/SecurityOnion/agrules/strelka /nsm/repo/rules/ + + } analyze_system() { diff --git a/setup/so-setup b/setup/so-setup index d04f4afc5..25b877910 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -331,7 +331,7 @@ if [[ $is_manager && ! $is_eval ]]; then whiptail_oinkcode fi - if [[ $STRELKA == 1 ]]; then + if [[ "$STRELKA" == 1 ]]; then STRELKARULES=1 fi @@ -573,6 +573,9 @@ fi docker_seed_registry 2>> "$setup_log" # ~ 60% when finished set_progress_str 60 "$(print_salt_state_apply 'manager')" + if [[ "$STRELKARULES" == 1 ]]; then + /usr/sbin/so-yara-update >> $setup_log 2>&1 + fi salt-call state.apply -l info manager >> $setup_log 2>&1 set_progress_str 61 "$(print_salt_state_apply 'idstools')" @@ -682,9 +685,6 @@ fi if [[ "$STRELKA" = 1 ]]; then set_progress_str 80 "$(print_salt_state_apply 'strelka')" salt-call state.apply -l info strelka >> $setup_log 2>&1 - if [[ $STRELKARULES == 1 ]]; then - /usr/sbin/so-yara-update >> $setup_log 2>&1 - fi fi if [[ $is_manager || $is_helix || $is_import ]]; then From 5f567368beafcd6700a09d31b014f315b3fa4496 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Fri, 11 Sep 2020 18:30:21 -0400 Subject: [PATCH 2/8] add redis to eval if playbook enabled --- salt/top.sls | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/top.sls b/salt/top.sls index 04627b18f..7120c15b7 100644 --- a/salt/top.sls +++ b/salt/top.sls @@ -128,6 +128,7 @@ base: {%- endif %} {%- if PLAYBOOK != 0 %} - playbook + - redis {%- endif %} {%- if FREQSERVER != 0 %} - freqserver From 311d67b9341801f453736b9c6627191c8c62fef6 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Sat, 12 Sep 2020 06:14:58 -0400 Subject: [PATCH 3/8] Hunt: fix RFB groupby #1332 --- salt/soc/files/soc/soc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index be557b58d..29ae59219 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -124,7 +124,7 @@ { "name": "PE", "description": "PE files list", "query": "event.dataset:pe | groupby file.machine file.os file.subsystem"}, { "name": "RADIUS", "description": "RADIUS grouped by username", "query": "event.dataset:radius | groupby user.name.keyword"}, { "name": "RDP", "description": "RDP grouped by client name", "query": "event.dataset:rdp | groupby client.name"}, - { "name": "RFB", "description": "RFB grouped by desktop name", "query": "event.dataset:rfb | groupby rfb.desktop.name"}, + { "name": "RFB", "description": "RFB grouped by desktop name", "query": "event.dataset:rfb | groupby rfb.desktop.name.keyword"}, { "name": "Signatures", "description": "Zeek signatures grouped by signature id", "query": "event.dataset:signatures | groupby signature_id"}, { "name": "SIP", "description": "SIP grouped by user agent", "query": "event.dataset:sip | groupby client.user_agent"}, { "name": "SMB_Files", "description": "SMB files grouped by action", "query": "event.dataset:smb_files | groupby file.action"}, From 259df2ed6b809d9f9e5a2047cf9907e333d174e7 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Sat, 12 Sep 2020 23:06:06 -0400 Subject: [PATCH 4/8] Fix Strelka --- salt/common/tools/sbin/so-yara-update | 1 + setup/so-functions | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-yara-update b/salt/common/tools/sbin/so-yara-update index 918d6a9aa..1404b53d7 100755 --- a/salt/common/tools/sbin/so-yara-update +++ b/salt/common/tools/sbin/so-yara-update @@ -16,6 +16,7 @@ # along with this program. If not, see . {%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') -%} + output_dir="/opt/so/saltstack/default/salt/strelka/rules" #mkdir -p $output_dir repos="$output_dir/repos.txt" diff --git a/setup/so-functions b/setup/so-functions index 17736dd76..0b017f269 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -55,7 +55,7 @@ airgap_rules() { cp -Rv /root/SecurityOnion/agrules/sigma /nsm/repo/rules/ # Don't leave Strelka out - cp -v /root/SecurityOnion/agrules/strelka /nsm/repo/rules/ + cp -Rv /root/SecurityOnion/agrules/strelka /nsm/repo/rules/ } From bb936c5bee2a0ffbc9c84971597f63dff6e2bbd6 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Sat, 12 Sep 2020 23:07:15 -0400 Subject: [PATCH 5/8] Fix Strelka --- salt/common/tools/sbin/so-yara-update | 2 ++ 1 file changed, 2 insertions(+) diff --git a/salt/common/tools/sbin/so-yara-update b/salt/common/tools/sbin/so-yara-update index 1404b53d7..6dc94b6b0 100755 --- a/salt/common/tools/sbin/so-yara-update +++ b/salt/common/tools/sbin/so-yara-update @@ -29,6 +29,8 @@ updatecounter=0 gh_status=$(curl -s -o /dev/null -w "%{http_code}" http://github.com) {%- if ISAIRGAP is sameas true -%} + + clone_dir="/nsm/repo/rules/strelka" repo_name="signature-base" mkdir -p $output_dir/$repo_name From d6d22fb0e0ac72a71ef0360ffb0d61a55cf5d75d Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Sat, 12 Sep 2020 23:07:35 -0400 Subject: [PATCH 6/8] Fix Strelka --- salt/common/tools/sbin/so-yara-update | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/common/tools/sbin/so-yara-update b/salt/common/tools/sbin/so-yara-update index 6dc94b6b0..dc76e0676 100755 --- a/salt/common/tools/sbin/so-yara-update +++ b/salt/common/tools/sbin/so-yara-update @@ -89,6 +89,7 @@ echo "Done!" {%- else -%} + clone_dir="/tmp" if [ "$gh_status" == "200" ] || [ "$gh_status" == "301" ]; then From 89c38541ee35e6b9b91ff2bef0ae28b0f957542a Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Sun, 13 Sep 2020 02:52:19 -0400 Subject: [PATCH 7/8] Force all SOC quick actions to open in new tab --- salt/soc/files/soc/soc.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index 29ae59219..ebfa1a632 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -143,10 +143,10 @@ { "name": "Firewall", "description": "Firewall events grouped by action", "query": "event_type:firewall | groupby action"} ], "actions": [ - { "name": "", "description": "actionPcapHelp", "icon": "fa-stream", "link": "/joblookup?esid={eventId}" }, - { "name": "", "description": "actionAlertHelp", "icon": "fa-bell", "link": "/soctopus/thehive/alert/{eventId}" }, - { "name": "", "description": "actionGoogleHelp", "icon": "fab fa-google", "link": "https://www.google.com/search?q={value}" }, - { "name": "actionVirusTotal", "description": "actionVirusTotalHelp", "icon": "", "link": "https://www.virustotal.com/gui/search/{value}" } + { "name": "", "description": "actionPcapHelp", "icon": "fa-stream", "link": "/joblookup?esid={eventId}", "target": "_blank" }, + { "name": "", "description": "actionAlertHelp", "icon": "fa-bell", "link": "/soctopus/thehive/alert/{eventId}", "target": "_blank" }, + { "name": "", "description": "actionGoogleHelp", "icon": "fab fa-google", "link": "https://www.google.com/search?q={value}", "target": "_blank" }, + { "name": "actionVirusTotal", "description": "actionVirusTotalHelp", "icon": "", "link": "https://www.virustotal.com/gui/search/{value}", "target": "_blank" } ] } } From 18dc7a915a77f77457491d7a4694f40db9004b93 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Sun, 13 Sep 2020 08:26:33 -0400 Subject: [PATCH 8/8] Hunt: Fix Tunnel query #1335 --- salt/soc/files/soc/soc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index ebfa1a632..bbb600a6b 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -135,7 +135,7 @@ { "name": "SSH", "description": "SSH grouped by version", "query": "event.dataset:ssh | groupby ssh.version"}, { "name": "SSL", "description": "SSL grouped by version and server name", "query": "event.dataset:ssl | groupby ssl.version ssl.server_name"}, { "name": "SYSLOG", "description": "SYSLOG grouped by severity and facility ", "query": "event.dataset:syslog | groupby syslog.severity syslog.facility"}, - { "name": "Tunnels", "description": "Tunnels grouped by action", "query": "event.dataset:tunnels | groupby event.action"}, + { "name": "Tunnel", "description": "Tunnels grouped by action", "query": "event.dataset:tunnel | groupby event.action"}, { "name": "Weird", "description": "Zeek weird log grouped by name", "query": "event.dataset:weird | groupby weird.name"}, { "name": "x509", "description": "x.509 grouped by key length", "query": "event.dataset:x509 | groupby x509.certificate.key.length"}, { "name": "x509", "description": "x.509 grouped by issuer", "query": "event.dataset:x509 | groupby x509.certificate.issuer"},