From 152fdaa7bb4f826329244172ca8ec4e93cb32ed1 Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Tue, 15 Apr 2025 11:40:43 -0400 Subject: [PATCH 1/8] Support Kratos user.name lookup --- .../grid-nodes_general/kratos-logs.json | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) rename salt/elasticfleet/files/{integrations => integrations-dynamic}/grid-nodes_general/kratos-logs.json (52%) diff --git a/salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json similarity index 52% rename from salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json rename to salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json index 6a67c9c1c..5ae81ba83 100644 --- a/salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json +++ b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json @@ -1,3 +1,4 @@ +{% set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') %} { "package": { "name": "log", @@ -19,7 +20,7 @@ ], "data_stream.dataset": "kratos", "tags": ["so-kratos"], - "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos", + "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos\n- if:\n has_fields:\n - identity_id\n then:{% for id, email in identities %}\n - if:\n equals:\n identity_id: \"{{ id }}\"\n then:\n - add_fields:\n target: ''\n fields:\n user.name: \"{{ email }}\"{% endfor %}", "custom": "pipeline: kratos" } } @@ -28,3 +29,4 @@ }, "force": true } + From 5fd7bf311d2310512b0d2fbac051c4a8b5a73e7e Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Tue, 15 Apr 2025 13:57:55 -0400 Subject: [PATCH 2/8] Add fallback --- .../grid-nodes_general/kratos-logs.json | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json index 5ae81ba83..f6b01cdff 100644 --- a/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json +++ b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json @@ -1,4 +1,14 @@ -{% set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') %} +{%- set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') -%} +{%- set valid_identities = false -%} +{%- if identities -%} + {%- set valid_identities = true -%} + {%- for id, email in identities -%} + {%- if not id or not email -%} + {%- set valid_identities = false -%} + {%- break -%} + {%- endif -%} + {%- endfor -%} +{%- endif -%} { "package": { "name": "log", @@ -20,7 +30,11 @@ ], "data_stream.dataset": "kratos", "tags": ["so-kratos"], + {%- if valid_identities -%} "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos\n- if:\n has_fields:\n - identity_id\n then:{% for id, email in identities %}\n - if:\n equals:\n identity_id: \"{{ id }}\"\n then:\n - add_fields:\n target: ''\n fields:\n user.name: \"{{ email }}\"{% endfor %}", + {%- else -%} + "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos", + {%- endif -%} "custom": "pipeline: kratos" } } From 366e39950a5a8394e64d7c9a51c20446b0ae66dc Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 16 Apr 2025 15:55:16 -0400 Subject: [PATCH 3/8] subord annotations; ensure node reboots occur in background --- salt/manager/tools/sbin/so-minion | 2 +- salt/soc/soc_soc.yaml | 37 +++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion index ebbfa8fff..98add9a96 100755 --- a/salt/manager/tools/sbin/so-minion +++ b/salt/manager/tools/sbin/so-minion @@ -126,7 +126,7 @@ function testMinion() { } function restartMinion() { - salt "$MINION_ID" system.reboot + salt "$MINION_ID" system.reboot --async result=$? exit $result diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index ac22aa2c1..48fef3dfb 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -138,6 +138,43 @@ soc: title: Require TOTP description: Require all users to enable Time-based One Time Passwords (MFA) upon login to SOC. global: True + subgrids: + title: Subordinate Grids + description: | + Optional list of *subgrids* that this grid has access to manage. This is also known as a 'Manager of Managers' configuration. The values entered must originate from the remote subordinate grid. The API Client must have be granted most permissions in order to perform required duties. + + *Requires a valid Security Onion license key with subgrid allocations.* + global: True + syntax: json + forcedType: "[]{}" + uiElements: + - field: id + label: Unique Subgrid ID + regex: "^(?!\s*all\s*$).*$" + regexFailureMessage: Subgrid ID cannot be named 'all' + required: true + - field: managerUrl + label: Subgrid Manager URL + required: true + - field: clientId + label: Subgrid API Client ID + required: true + regex: "^socl_[a-z0-9_]+$" + regexFailureMessage: Client ID must be a valid socl_* API Client ID + - field: clientSecret + label: Subgrid API Client Secret + required: true + - field: tlsSkipVerify + label: Skip Subgrid TLS Certification Validation + forcedType: bool + default: false + - field: caCertificate + label: Subgrid CA Certificate + multiline: True + - field: enabled + label: Subgrid Enabled + forcedType: bool + default: false modules: elastalertengine: aiRepoUrl: From 8f1e528f1c6ce8458cb39f4c1dc21c67d3b52512 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Thu, 17 Apr 2025 11:09:39 -0400 Subject: [PATCH 4/8] improve regex --- salt/soc/soc_soc.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 48fef3dfb..cac8c91d6 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -150,8 +150,8 @@ soc: uiElements: - field: id label: Unique Subgrid ID - regex: "^(?!\s*all\s*$).*$" - regexFailureMessage: Subgrid ID cannot be named 'all' + regex: "^_.*$" + regexFailureMessage: Subgrid ID cannot start with an underscore required: true - field: managerUrl label: Subgrid Manager URL From b607689993aea9eba6de80163251a778927a0044 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Thu, 17 Apr 2025 11:47:52 -0400 Subject: [PATCH 5/8] improve regex --- salt/soc/soc_soc.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index cac8c91d6..dfaf7ab09 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -150,7 +150,7 @@ soc: uiElements: - field: id label: Unique Subgrid ID - regex: "^_.*$" + regex: "^((?!_)).+$" regexFailureMessage: Subgrid ID cannot start with an underscore required: true - field: managerUrl From d0375d3c7e75f1874beb1d5108cfd7526689547a Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Thu, 17 Apr 2025 11:51:21 -0400 Subject: [PATCH 6/8] fix typo --- salt/soc/soc_soc.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index dfaf7ab09..7658d24dd 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -141,7 +141,7 @@ soc: subgrids: title: Subordinate Grids description: | - Optional list of *subgrids* that this grid has access to manage. This is also known as a 'Manager of Managers' configuration. The values entered must originate from the remote subordinate grid. The API Client must have be granted most permissions in order to perform required duties. + Optional list of *subgrids* that this grid has access to manage. This is also known as a 'Manager of Managers' configuration. The values entered must originate from the remote subordinate grid. The API Client must be granted most permissions in order to perform required duties. *Requires a valid Security Onion license key with subgrid allocations.* global: True From 3b447b343f6993b2d27fb6a6a6a6b9b01caf8dd9 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Thu, 17 Apr 2025 11:51:45 -0400 Subject: [PATCH 7/8] fix typo --- salt/soc/soc_soc.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 7658d24dd..91ab6e3c1 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -141,7 +141,7 @@ soc: subgrids: title: Subordinate Grids description: | - Optional list of *subgrids* that this grid has access to manage. This is also known as a 'Manager of Managers' configuration. The values entered must originate from the remote subordinate grid. The API Client must be granted most permissions in order to perform required duties. + Optional list of *subgrids* that this grid has access to manage. This is also known as a 'Manager of Managers' configuration. The values entered must originate from the remote subordinate grid. The API Client must be granted most permissions in order to perform required functions. *Requires a valid Security Onion license key with subgrid allocations.* global: True From e3c8d22cac379a044c2d6b2d3f5a67f54b465afb Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 18 Apr 2025 16:43:17 -0400 Subject: [PATCH 8/8] Update enabled.sls --- salt/elasticsearch/enabled.sls | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls index af162d9e9..1d25fa668 100644 --- a/salt/elasticsearch/enabled.sls +++ b/salt/elasticsearch/enabled.sls @@ -204,12 +204,17 @@ so-elasticsearch-roles-load: - docker_container: so-elasticsearch - file: elasticsearch_sbin_jinja -{% if grains.role in ['so-eval', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-manager'] %} +{% if grains.role in ['so-managersearch', 'so-heavynode', 'so-manager'] %} +{% set ap = "absent" %} +{% endif %} +{% if grains.role in ['so-eval', 'so-standalone'] %} {% if ELASTICSEARCHMERGED.index_clean %} {% set ap = "present" %} {% else %} {% set ap = "absent" %} {% endif %} +{% endif %} +{% if grains.role in ['so-eval', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-manager'] %} so-elasticsearch-indices-delete: cron.{{ap}}: - name: /usr/sbin/so-elasticsearch-indices-delete > /opt/so/log/elasticsearch/cron-elasticsearch-indices-delete.log 2>&1