CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-25 14:07:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'remotes/origin/dev' into issue/1681

Browse Source
This commit is contained in:
m0duspwnens
2020-11-11 11:39:08 -05:00
parent 5a95159ec3 fc9c31706d
commit 529da993aa
3 changed files with 97 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/elasticsearch/files/ingest/syslog
+1 -1
View File
@@ -13,7 +13,7 @@
} }
}, },
{ "grok": { "field": "message", "patterns": ["<%{INT:syslog.priority}>%{DATA:syslog.timestamp} %{WORD:source.application}: %{GREEDYDATA:real_message}"], "ignore_failure": false } }, { "grok": { "field": "message", "patterns": ["<%{INT:syslog.priority}>%{DATA:syslog.timestamp} %{WORD:source.application}: %{GREEDYDATA:real_message}"], "ignore_failure": false } },
{ "set": { "if": "ctx.source.application == 'filterlog'", "field": "dataset", "value": "firewall" } }, { "set": { "if": "ctx.source?.application == 'filterlog'", "field": "dataset", "value": "firewall" } },
{ "pipeline": { "if": "ctx.dataset == 'firewall'", "name": "filterlog" } }, { "pipeline": { "if": "ctx.dataset == 'firewall'", "name": "filterlog" } },
{ "pipeline": { "name": "common" } } { "pipeline": { "name": "common" } }
] ]
salt/top.sls
+96
View File
@@ -6,6 +6,13 @@
{% set DOMAINSTATS = salt['pillar.get']('manager:domainstats', '0') %} {% set DOMAINSTATS = salt['pillar.get']('manager:domainstats', '0') %}
{% set FLEETMANAGER = salt['pillar.get']('global:fleet_manager', False) %} {% set FLEETMANAGER = salt['pillar.get']('global:fleet_manager', False) %}
{% set FLEETNODE = salt['pillar.get']('global:fleet_node', False) %} {% set FLEETNODE = salt['pillar.get']('global:fleet_node', False) %}
{% set ELASTALERT = salt['pillar.get']('elastalert:enabled', True) %}
{% set ELASTICSEARCH = salt['pillar.get']('elasticsearch:enabled', True) %}
{% set FILEBEAT = salt['pillar.get']('filebeat:enabled', True) %}
{% set KIBANA = salt['pillar.get']('kibana:enabled', True) %}
{% set LOGSTASH = salt['pillar.get']('logstash:enabled', True) %}
{% set CURATOR = salt['pillar.get']('curator:enabled', True) %}
{% set REDIS = salt['pillar.get']('redis:enabled', True) %}
{% set STRELKA = salt['pillar.get']('strelka:enabled', '0') %} {% set STRELKA = salt['pillar.get']('strelka:enabled', '0') %}
{% set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %} {% set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %}
{% import_yaml 'salt/minion.defaults.yaml' as saltversion %} {% import_yaml 'salt/minion.defaults.yaml' as saltversion %}
@@ -51,8 +58,12 @@ base:
- suricata - suricata
- zeek - zeek
- redis - redis
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
- schedule - schedule
'*_sensor and G@saltversion:{{saltversion}}': '*_sensor and G@saltversion:{{saltversion}}':
@@ -101,8 +112,12 @@ base:
{%- if WAZUH != 0 %} {%- if WAZUH != 0 %}
- wazuh - wazuh
{%- endif %} {%- endif %}
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if KIBANA %}
- kibana - kibana
{%- endif %}
- pcap - pcap
- suricata - suricata
{%- if ZEEKVER != 'SURICATA' %} {%- if ZEEKVER != 'SURICATA' %}
@@ -111,9 +126,15 @@ base:
{%- if STRELKA %} {%- if STRELKA %}
- strelka - strelka
{%- endif %} {%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
{%- if CURATOR %}
- curator - curator
{%- endif %}
{%- if ELASTALERT %}
- elastalert - elastalert
{%- endif %}
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
- fleet - fleet
- redis - redis
@@ -158,12 +179,24 @@ base:
{%- if WAZUH != 0 %} {%- if WAZUH != 0 %}
- wazuh - wazuh
{%- endif %} {%- endif %}
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if REDIS %}
- redis - redis
{%- endif %}
{%- if KIBANA %}
- kibana - kibana
{%- endif %}
{%- if ELASTALERT %}
- elastalert - elastalert
{%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
- utility - utility
- schedule - schedule
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
@@ -207,10 +240,18 @@ base:
{%- if WAZUH != 0 %} {%- if WAZUH != 0 %}
- wazuh - wazuh
{%- endif %} {%- endif %}
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if REDIS %}
- redis - redis
{%- endif %}
{%- if KIBANA %}
- kibana - kibana
{%- endif %}
- pcap - pcap
- suricata - suricata
{%- if ZEEKVER != 'SURICATA' %} {%- if ZEEKVER != 'SURICATA' %}
@@ -219,9 +260,15 @@ base:
{%- if STRELKA %} {%- if STRELKA %}
- strelka - strelka
{%- endif %} {%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
{%- if CURATOR %}
- curator - curator
{%- endif %}
{%- if ELASTALERT %}
- elastalert - elastalert
{%- endif %}
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
- fleet - fleet
- fleet.install_package - fleet.install_package
@@ -248,7 +295,9 @@ base:
'*_node and I@node:node_type:parser and G@saltversion:{{saltversion}}': '*_node and I@node:node_type:parser and G@saltversion:{{saltversion}}':
- match: compound - match: compound
- firewall - firewall
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
- fleet.install_package - fleet.install_package
{%- endif %} {%- endif %}
@@ -258,8 +307,12 @@ base:
'*_node and I@node:node_type:hot and G@saltversion:{{saltversion}}': '*_node and I@node:node_type:hot and G@saltversion:{{saltversion}}':
- match: compound - match: compound
- firewall - firewall
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if CURATOR %}
- curator - curator
{%- endif %}
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
- fleet.install_package - fleet.install_package
{%- endif %} {%- endif %}
@@ -269,7 +322,9 @@ base:
'*_node and I@node:node_type:warm and G@saltversion:{{saltversion}}': '*_node and I@node:node_type:warm and G@saltversion:{{saltversion}}':
- match: compound - match: compound
- firewall - firewall
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
- fleet.install_package - fleet.install_package
{%- endif %} {%- endif %}
@@ -286,10 +341,18 @@ base:
{%- if WAZUH != 0 %} {%- if WAZUH != 0 %}
- wazuh - wazuh
{%- endif %} {%- endif %}
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if CURATOR %}
- curator - curator
{%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
- fleet.install_package - fleet.install_package
{%- endif %} {%- endif %}
@@ -332,13 +395,28 @@ base:
{%- if WAZUH != 0 %} {%- if WAZUH != 0 %}
- wazuh - wazuh
{%- endif %} {%- endif %}
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if REDIS %}
- redis - redis
{%- endif %}
{%- if CURATOR %}
- curator - curator
{%- endif %}
{%- if KIBANA %}
- kibana - kibana
{%- endif %}
{%- if ELASTALERT %}
- elastalert - elastalert
{%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
- utility - utility
- schedule - schedule
{%- if FLEETMANAGER or FLEETNODE %} {%- if FLEETMANAGER or FLEETNODE %}
@@ -370,11 +448,21 @@ base:
{%- if WAZUH != 0 %} {%- if WAZUH != 0 %}
- wazuh - wazuh
{%- endif %} {%- endif %}
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if LOGSTASH %}
- logstash - logstash
{%- endif %}
{%- if REDIS %}
- redis - redis
{%- endif %}
{%- if CURATOR %}
- curator - curator
{%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
{%- if STRELKA %} {%- if STRELKA %}
- strelka - strelka
{%- endif %} {%- endif %}
@@ -386,7 +474,9 @@ base:
{%- if ZEEKVER != 'SURICATA' %} {%- if ZEEKVER != 'SURICATA' %}
- zeek - zeek
{%- endif %} {%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
- schedule - schedule
- docker_clean - docker_clean
@@ -417,9 +507,15 @@ base:
- idstools - idstools
- suricata.manager - suricata.manager
- pcap - pcap
{%- if ELASTICSEARCH %}
- elasticsearch - elasticsearch
{%- endif %}
{%- if KIBANA %}
- kibana - kibana
{%- endif %}
{%- if FILEBEAT %}
- filebeat - filebeat
{%- endif %}
- utility - utility
- suricata - suricata
- zeek - zeek
sigs/images/so-acng.sig
BIN
View File
Binary file not shown.