CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rename component mappings and references for Security Onion

Browse Source
This commit is contained in:
Wes
2022-09-20 20:33:06 +00:00
parent 7f2c5bc757
commit 46dd4c2749
3 changed files with 104 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
salt/elasticsearch/defaults.yaml
View File

@@ -80,8 +80,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.apm_server@package"
- "so-logs-elastic_agent.apm_server@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -114,8 +114,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.auditbeat@package"
- "so-logs-elastic_agent.auditbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -148,8 +148,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.cloudbeat@package"
- "so-logs-elastic_agent.cloudbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -182,8 +182,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.endpoint_security@package"
- "so-logs-elastic_agent.endpoint_security@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -216,8 +216,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.filebeat@package"
- "so-logs-elastic_agent.filebeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -250,8 +250,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.fleet_server@package"
- "so-logs-elastic_agent.fleet_server@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -284,8 +284,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.heartbeat@package"
- "so-logs-elastic_agent.heartbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -318,8 +318,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent@package"
- "so-logs-elastic_agent@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -352,8 +352,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.metricbeat@package"
- "so-logs-elastic_agent.metricbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -386,8 +386,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.osquerybeat@package"
- "so-logs-elastic_agent.osquerybeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -420,8 +420,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.packetbeat@package"
- "so-logs-elastic_agent.packetbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:

40
salt/elasticsearch/templates/component/elastic-agent/so-fleet_agent_id_verification-1.json
View File

@@ -1,10 +1,48 @@
{
"component_templates": [
{
"name": ".fleet_agent_id_verification-1",
"name": "so-fleet_agent_id_verification-1",
"component_template": {
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
},
"index": {
"final_pipeline": ".fleet_final_pipeline-1"
}

47
salt/elasticsearch/templates/component/elastic-agent/so-fleet_globals-1.json
View File

@@ -1,13 +1,52 @@
{
"component_templates": [
{
"name": ".fleet_globals-1",
"name": "so-fleet_globals-1",
"component_template": {
"template": {
"settings": {},
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
"mappings": {
"_meta": {
"managed_by": "fleet",
"managed_by": "security_onion",
"managed": true
},
"dynamic_templates": [
@@ -25,7 +64,7 @@
}
},
"_meta": {
"managed_by": "fleet",
"managed_by": "security_onion",
"managed": true
}
}