CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14345 from Security-Onion-Solutions/reyesj2-patch-2

Browse Source 
osquery templates
This commit is contained in:
Jorge Reyes
2025-03-05 14:28:08 -06:00
committed by GitHub
parent 3a465c2e69 d2884ef00b
commit 515cb3aea8
2 changed files with 46 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
salt/elasticsearch/defaults.yaml
View File

@@ -2659,7 +2659,25 @@ elasticsearch:
set_priority:
priority: 50
min_age: 30d
so-logs-osquery_manager_x_action_x_responses:
so-logs-osquery-manager-action_x_responses:
index_sorting: false
index_template:
_meta:
managed: true
managed_by: security_onion
package:
name: elastic_agent
composed_of:
- logs-osquery_manager.action.responses
ignore_missing_component_templates: []
index_patterns:
- .logs-osquery_manager.action.responses*
priority: 501
template:
settings:
index:
number_of_replicas: 0
so-logs-osquery-manager_x_action_x_responses:
index_sorting: false
index_template:
_meta:
@@ -2683,9 +2701,10 @@ elasticsearch:
priority: 501
template:
settings:
lifecycle:
name:
so-logs-osquery-manager.action.responses-logs
index:
lifecycle:
name: so-logs-osquery_manager.action.responses-logs
number_of_replicas: 0
policy:
phases:
@@ -2711,7 +2730,25 @@ elasticsearch:
set_priority:
priority: 50
min_age: 30d
so-logs-osquery_manager_x_result:
so-logs-osquery-manager-actions:
index_sorting: false
index_template:
_meta:
managed: true
managed_by: security_onion
package:
name: elastic_agent
composed_of:
- logs-osquery_manager.actions
ignore_missing_component_templates: []
index_patterns:
- .logs-osquery_manager.actions*
priority: 501
template:
settings:
index:
number_of_replicas: 0
so-logs-osquery-manager_x_result:
index_sorting: false
index_template:
_meta:
@@ -2737,7 +2774,7 @@ elasticsearch:
settings:
index:
lifecycle:
name: so-logs-osquery_manager.result-logs
name: so-logs-osquery-manager.result-logs
number_of_replicas: 0
policy:
phases:

6
salt/elasticsearch/soc_elasticsearch.yaml
View File

@@ -368,8 +368,10 @@ elasticsearch:
so-logs-detections_x_alerts: *indexSettings
so-logs-http_endpoint_x_generic: *indexSettings
so-logs-httpjson_x_generic: *indexSettings
so-logs-osquery_manager_x_action_x_responses: *indexSettings
so-logs-osquery_manager_x_result: *indexSettings
so-logs-osquery-manager-actions: *indexSettings
so-logs-osquery-manager-action_x_responses: *indexSettings
so-logs-osquery-manager_x_action_x_responses: *indexSettings
so-logs-osquery-manager_x_result: *indexSettings
so-logs-elastic_agent_x_apm_server: *indexSettings
so-logs-elastic_agent_x_auditbeat: *indexSettings
so-logs-elastic_agent_x_cloudbeat: *indexSettings