CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-27 15:07:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

handle import node and merge with 2.4/dev

Browse Source
This commit is contained in:
m0duspwnens
2023-05-05 14:41:26 -04:00
parent 47a580d110 61a43f7df5
commit 5405bc4e20
207 changed files with 1016 additions and 958 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/pcap/config.sls
+116
View File
@@ -0,0 +1,116 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from "pcap/config.map.jinja" import PCAPMERGED with context %}
{% from 'bpf/pcap.map.jinja' import PCAPBPF %}
{% set BPF_COMPILED = "" %}
# PCAP Section
stenographergroup:
group.present:
- name: stenographer
- gid: 941
stenographer:
user.present:
- uid: 941
- gid: 941
- home: /opt/so/conf/steno
stenoconfdir:
file.directory:
- name: /opt/so/conf/steno
- user: 941
- group: 939
- makedirs: True
pcap_sbin:
file.recurse:
- name: /usr/sbin
- source: salt://pcap/tools/sbin
- user: 939
- group: 939
- file_mode: 755
{% if PCAPBPF %}
{% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + PCAPBPF|join(" "),cwd='/root') %}
{% if BPF_CALC['stderr'] == "" %}
{% set BPF_COMPILED = ",\\\"--filter=" + BPF_CALC['stdout'] + "\\\"" %}
{% else %}
bpfcompilationfailure:
test.configurable_test_state:
- changes: False
- result: False
- comment: "BPF Compilation Failed - Discarding Specified BPF"
{% endif %}
{% endif %}
stenoconf:
file.managed:
- name: /opt/so/conf/steno/config
- source: salt://pcap/files/config.jinja
- user: stenographer
- group: stenographer
- mode: 644
- template: jinja
- defaults:
PCAPMERGED: {{ PCAPMERGED }}
BPF_COMPILED: "{{ BPF_COMPILED }}"
stenoca:
file.directory:
- name: /opt/so/conf/steno/certs
- user: 941
- group: 939
pcapdir:
file.directory:
- name: /nsm/pcap
- user: 941
- group: 941
- makedirs: True
pcaptmpdir:
file.directory:
- name: /nsm/pcaptmp
- user: 941
- group: 941
- makedirs: True
pcapoutdir:
file.directory:
- name: /nsm/pcapout
- user: 939
- group: 939
- makedirs: True
pcapindexdir:
file.directory:
- name: /nsm/pcapindex
- user: 941
- group: 941
- makedirs: True
stenolog:
file.directory:
- name: /opt/so/log/stenographer
- user: 941
- group: 941
- makedirs: True
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}
salt/pcap/disabled.sls
+3
View File
@@ -1,6 +1,9 @@
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
include:
- pcap.sostatus
so-steno:
docker_container.absent:
- force: True
salt/pcap/enabled.sls
+3 -92
View File
@@ -6,98 +6,9 @@
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from "pcap/config.map.jinja" import PCAPMERGED with context %}
{% from 'bpf/pcap.map.jinja' import PCAPBPF %}
{% set BPF_COMPILED = "" %}
# PCAP Section
stenographergroup:
group.present:
- name: stenographer
- gid: 941
stenographer:
user.present:
- uid: 941
- gid: 941
- home: /opt/so/conf/steno
stenoconfdir:
file.directory:
- name: /opt/so/conf/steno
- user: 941
- group: 939
- makedirs: True
{% if PCAPBPF %}
{% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + PCAPBPF|join(" "),cwd='/root') %}
{% if BPF_CALC['stderr'] == "" %}
{% set BPF_COMPILED = ",\\\"--filter=" + BPF_CALC['stdout'] + "\\\"" %}
{% else %}
bpfcompilationfailure:
test.configurable_test_state:
- changes: False
- result: False
- comment: "BPF Compilation Failed - Discarding Specified BPF"
{% endif %}
{% endif %}
stenoconf:
file.managed:
- name: /opt/so/conf/steno/config
- source: salt://pcap/files/config.jinja
- user: stenographer
- group: stenographer
- mode: 644
- template: jinja
- defaults:
PCAPMERGED: {{ PCAPMERGED }}
BPF_COMPILED: "{{ BPF_COMPILED }}"
stenoca:
file.directory:
- name: /opt/so/conf/steno/certs
- user: 941
- group: 939
pcapdir:
file.directory:
- name: /nsm/pcap
- user: 941
- group: 941
- makedirs: True
pcaptmpdir:
file.directory:
- name: /nsm/pcaptmp
- user: 941
- group: 941
- makedirs: True
pcapoutdir:
file.directory:
- name: /nsm/pcapout
- user: 939
- group: 939
- makedirs: True
pcapindexdir:
file.directory:
- name: /nsm/pcapindex
- user: 941
- group: 941
- makedirs: True
stenolog:
file.directory:
- name: /opt/so/log/stenographer
- user: 941
- group: 941
- makedirs: True
include:
- pcap.config
- pcap.sostatus
so-steno:
docker_container.running:
salt/pcap/init.sls
+5 -2
View File
@@ -1,9 +1,12 @@
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from 'pcap/config.map.jinja' import PCAPMERGED %}
include:
- pcap.sostatus
{% if PCAPMERGED.enabled %}
{% if PCAPMERGED.enabled and GLOBALS.role != 'so-import'%}
- pcap.enabled
{% elif GLOBALS.role == 'so-import' %}
- pcap.config
- pcap.disabled
{% else %}
- pcap.disabled
{% endif %}
salt/pcap/sostatus.sls
+11
View File
@@ -1,5 +1,16 @@
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
append_so-steno_so-status.conf:
file.append:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-steno
- unless: grep -q so-steno /opt/so/conf/so-status/so-status.conf
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}
salt/pcap/tools/sbin/so-pcap-export
Executable
+18
View File
@@ -0,0 +1,18 @@
#!/bin/bash
#
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
if [ $# -lt 2 ]; then
echo "Usage: $0 <steno-query> Output-Filename"
exit 1
fi
docker exec -t so-sensoroni scripts/stenoquery.sh "$1" -w /nsm/pcapout/$2.pcap
echo ""
echo "If successful, the output was written to: /nsm/pcapout/$2.pcap"
salt/pcap/tools/sbin/so-pcap-restart
Executable
+12
View File
@@ -0,0 +1,12 @@
#!/bin/bash
#
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
. /usr/sbin/so-common
/usr/sbin/so-restart steno $1
salt/pcap/tools/sbin/so-pcap-start
Executable
+12
View File
@@ -0,0 +1,12 @@
#!/bin/bash
#
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
. /usr/sbin/so-common
/usr/sbin/so-start steno $1
salt/pcap/tools/sbin/so-pcap-stop
Executable
+12
View File
@@ -0,0 +1,12 @@
#!/bin/bash
#
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
. /usr/sbin/so-common
/usr/sbin/so-stop steno $1