CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2.4/dev' of github.com:Security-Onion-Solutions/securityonion into reyesj2/fix-14516

Browse Source
This commit is contained in:
reyesj2
2025-04-21 10:48:25 -05:00
parent c89adce3a1 af1bee4c68
commit 4e6c707067
5 changed files with 90 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json Normal file
View File

@@ -0,0 +1,46 @@
{%- set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') -%}
{%- set valid_identities = false -%}
{%- if identities -%}
{%- set valid_identities = true -%}
{%- for id, email in identities -%}
{%- if not id or not email -%}
{%- set valid_identities = false -%}
{%- break -%}
{%- endif -%}
{%- endfor -%}
{%- endif -%}
{
"package": {
"name": "log",
"version": ""
},
"name": "kratos-logs",
"namespace": "so",
"description": "Kratos logs",
"policy_id": "so-grid-nodes_general",
"inputs": {
"logs-logfile": {
"enabled": true,
"streams": {
"log.logs": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/kratos/kratos.log"
],
"data_stream.dataset": "kratos",
"tags": ["so-kratos"],
{%- if valid_identities -%}
"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos\n- if:\n has_fields:\n - identity_id\n then:{% for id, email in identities %}\n - if:\n equals:\n identity_id: \"{{ id }}\"\n then:\n - add_fields:\n target: ''\n fields:\n user.name: \"{{ email }}\"{% endfor %}",
{%- else -%}
"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos",
{%- endif -%}
"custom": "pipeline: kratos"
}
}
}
}
},
"force": true
}

30
salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json
View File

@@ -1,30 +0,0 @@
{
"package": {
"name": "log",
"version": ""
},
"name": "kratos-logs",
"namespace": "so",
"description": "Kratos logs",
"policy_id": "so-grid-nodes_general",
"inputs": {
"logs-logfile": {
"enabled": true,
"streams": {
"log.logs": {
"enabled": true,
"vars": {
"paths": [
"/opt/so/log/kratos/kratos.log"
],
"data_stream.dataset": "kratos",
"tags": ["so-kratos"],
"processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos",
"custom": "pipeline: kratos"
}
}
}
}
},
"force": true
}

7
salt/elasticsearch/enabled.sls
View File

@@ -204,12 +204,17 @@ so-elasticsearch-roles-load:
- docker_container: so-elasticsearch
- file: elasticsearch_sbin_jinja
{% if grains.role in ['so-eval', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-manager'] %}
{% if grains.role in ['so-managersearch', 'so-heavynode', 'so-manager'] %}
{% set ap = "absent" %}
{% endif %}
{% if grains.role in ['so-eval', 'so-standalone'] %}
{% if ELASTICSEARCHMERGED.index_clean %}
{% set ap = "present" %}
{% else %}
{% set ap = "absent" %}
{% endif %}
{% endif %}
{% if grains.role in ['so-eval', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-manager'] %}
so-elasticsearch-indices-delete:
cron.{{ap}}:
- name: /usr/sbin/so-elasticsearch-indices-delete > /opt/so/log/elasticsearch/cron-elasticsearch-indices-delete.log 2>&1

2
salt/manager/tools/sbin/so-minion
View File

@@ -126,7 +126,7 @@ function testMinion() {
}
function restartMinion() {
salt "$MINION_ID" system.reboot
salt "$MINION_ID" system.reboot --async
result=$?
exit $result

37
salt/soc/soc_soc.yaml
View File

@@ -138,6 +138,43 @@ soc:
title: Require TOTP
description: Require all users to enable Time-based One Time Passwords (MFA) upon login to SOC.
global: True
subgrids:
title: Subordinate Grids
description: |
Optional list of *subgrids* that this grid has access to manage. This is also known as a 'Manager of Managers' configuration. The values entered must originate from the remote subordinate grid. The API Client must be granted most permissions in order to perform required functions.
*Requires a valid Security Onion license key with subgrid allocations.*
global: True
syntax: json
forcedType: "[]{}"
uiElements:
- field: id
label: Unique Subgrid ID
regex: "^((?!_)).+$"
regexFailureMessage: Subgrid ID cannot start with an underscore
required: true
- field: managerUrl
label: Subgrid Manager URL
required: true
- field: clientId
label: Subgrid API Client ID
required: true
regex: "^socl_[a-z0-9_]+$"
regexFailureMessage: Client ID must be a valid socl_* API Client ID
- field: clientSecret
label: Subgrid API Client Secret
required: true
- field: tlsSkipVerify
label: Skip Subgrid TLS Certification Validation
forcedType: bool
default: false
- field: caCertificate
label: Subgrid CA Certificate
multiline: True
- field: enabled
label: Subgrid Enabled
forcedType: bool
default: false
modules:
elastalertengine:
aiRepoUrl: