mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-08 02:02:50 +01:00
Merge pull request #1008 from Security-Onion-Solutions/quickfix/lstoes
Quickfix/lstoes
This commit is contained in:
Josh Patterson
GitHub
@@ -19,7 +19,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
{ "set": { "field": "observer.name", "value": "{{agent.name}}",
|
||||
{ "set": { "field": "observer.name", "value": "{{agent.name}}" }},
|
||||
{ "remove": { "field": ["host", "path", "message", "scan.exiftool.keys"], "ignore_missing": true } },
|
||||
{ "pipeline": { "name": "common" } }
|
||||
]
|
||||
|
||||
@@ -31,6 +31,8 @@
|
||||
{% set esheap = salt['pillar.get']('elasticsearch:esheap', '') %}
|
||||
{% endif %}
|
||||
|
||||
{% set TEMPLATES = salt['pillar.get']('elasticsearch:templates', {}) %}
|
||||
|
||||
vm.max_map_count:
|
||||
sysctl.present:
|
||||
- value: 262144
|
||||
@@ -63,6 +65,13 @@ esingestdir:
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
estemplatedir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/elasticsearch/templates
|
||||
- user: 930
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
esingestconf:
|
||||
file.recurse:
|
||||
- name: /opt/so/conf/elasticsearch/ingest
|
||||
@@ -86,6 +95,21 @@ esyml:
|
||||
- group: 939
|
||||
- template: jinja
|
||||
|
||||
#sync templates to /opt/so/conf/elasticsearch/templates
|
||||
{% for TEMPLATE in TEMPLATES %}
|
||||
es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}:
|
||||
file.managed:
|
||||
- source: salt://elasticsearch/templates/{{TEMPLATE}}
|
||||
{% if 'jinja' in TEMPLATE.split('.')[-1] %}
|
||||
- name: /opt/so/conf/elasticsearch/templates/{{TEMPLATE.split('/')[1] | replace(".jinja", "")}}
|
||||
- template: jinja
|
||||
{% else %}
|
||||
- name: /opt/so/conf/elasticsearch/templates/{{TEMPLATE.split('/')[1]}}
|
||||
{% endif %}
|
||||
- user: 930
|
||||
- group: 939
|
||||
{% endfor %}
|
||||
|
||||
nsmesdir:
|
||||
file.directory:
|
||||
- name: /nsm/elasticsearch
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
# Reference /usr/share/logstash/pipeline.custom/templates/YOURTEMPLATE.json
|
||||
# For custom logstash templates, they should be placed in /opt/so/saltstack/local/salt/logstash/pipelines/templates/custom/
|
||||
13
salt/elasticsearch/templates/so/so-beats-template.json.jinja
Normal file
13
salt/elasticsearch/templates/so/so-beats-template.json.jinja
Normal file
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-beats:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-beats:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-beats-*"],
|
||||
"version": 50001,
|
||||
"order": 11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
394
salt/elasticsearch/templates/so/so-common-template.json
Normal file
394
salt/elasticsearch/templates/so/so-common-template.json
Normal file
@@ -0,0 +1,394 @@
|
||||
{
|
||||
"index_patterns": ["so-ids-*", "so-firewall-*", "so-syslog-*", "so-zeek-*", "so-import-*", "so-ossec-*", "so-strelka-*", "so-beats-*", "so-osquery-*","so-playbook-*"],
|
||||
"version":50001,
|
||||
"order":10,
|
||||
"settings":{
|
||||
"number_of_replicas":0,
|
||||
"number_of_shards":1,
|
||||
"index.refresh_interval":"30s",
|
||||
"index.routing.allocation.require.box_type":"hot"
|
||||
},
|
||||
"mappings":{
|
||||
"dynamic":false,
|
||||
"date_detection":false,
|
||||
"properties":{
|
||||
"@timestamp":{
|
||||
"type":"date"
|
||||
},
|
||||
"@version":{
|
||||
"type":"keyword"
|
||||
},
|
||||
"osquery":{
|
||||
"type":"object",
|
||||
"dynamic":true
|
||||
},
|
||||
"geoip":{
|
||||
"dynamic":true,
|
||||
"properties":{
|
||||
"ip":{
|
||||
"type":"ip"
|
||||
},
|
||||
"location":{
|
||||
"type":"geo_point"
|
||||
},
|
||||
"latitude":{
|
||||
"type":"half_float"
|
||||
},
|
||||
"longitude":{
|
||||
"type":"half_float"
|
||||
}
|
||||
}
|
||||
},
|
||||
"destination_geo":{
|
||||
"dynamic":true,
|
||||
"properties":{
|
||||
"ip":{
|
||||
"type":"ip"
|
||||
},
|
||||
"location":{
|
||||
"type":"geo_point"
|
||||
},
|
||||
"latitude":{
|
||||
"type":"half_float"
|
||||
},
|
||||
"longitude":{
|
||||
"type":"half_float"
|
||||
}
|
||||
}
|
||||
},
|
||||
"source_geo":{
|
||||
"dynamic":true,
|
||||
"properties":{
|
||||
"ip":{
|
||||
"type":"ip"
|
||||
},
|
||||
"location":{
|
||||
"type":"geo_point"
|
||||
},
|
||||
"latitude":{
|
||||
"type":"half_float"
|
||||
},
|
||||
"longitude":{
|
||||
"type":"half_float"
|
||||
}
|
||||
}
|
||||
},
|
||||
"agent":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"as":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"alert":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"client":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"cloud":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"code_signature":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"connection":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"container":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"data":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"dce_rpc":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"destination":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"dhcp":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"dnp3":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"dns":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"dll":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"ecs":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"error":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"event":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"file":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"flow":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"ftp":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"geo":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"group":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"hash":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"host":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"http":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"ingest":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"interface":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"irc":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"kerberos":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"log":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"manager":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"message":{
|
||||
"type":"text",
|
||||
"fields":{
|
||||
"keyword":{
|
||||
"type":"keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"modbus":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"mysql":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"network":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"notice":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"ntlm":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"observer":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"organization":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"os":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"package":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"pe":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"process":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"radius":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"rdp":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"registry":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"related":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"request":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"rfb":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"rule":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"scan":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"server":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"service":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"sip":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"smb":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"smtp":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"snmp":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"socks":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"software":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"source":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"ssh":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"ssl":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"syslog":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"tags":{
|
||||
"type":"text",
|
||||
"fields":{
|
||||
"keyword":{
|
||||
"type":"keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
"threat":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"tls":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"trace":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"tunnel":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"user":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"user_agent":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"version":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"vlan":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"vulnerability":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"weird":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"winlog":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
},
|
||||
"x509":{
|
||||
"type":"object",
|
||||
"dynamic": true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-firewall:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-firewall:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-firewall-*"],
|
||||
"version":50001,
|
||||
"order":11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
13
salt/elasticsearch/templates/so/so-flow-template.json.jinja
Normal file
13
salt/elasticsearch/templates/so/so-flow-template.json.jinja
Normal file
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-flow:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-flow:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-flow-*"],
|
||||
"version": 50001,
|
||||
"order": 11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
13
salt/elasticsearch/templates/so/so-ids-template.json.jinja
Normal file
13
salt/elasticsearch/templates/so/so-ids-template.json.jinja
Normal file
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-ids:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-ids:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-ids-*"],
|
||||
"version":50001,
|
||||
"order":11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-import:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-import:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-import-*"],
|
||||
"version":50001,
|
||||
"order": 11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-osquery:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-osquery:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-osquery-*"],
|
||||
"version":50001,
|
||||
"order":11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
13
salt/elasticsearch/templates/so/so-ossec-template.json.jinja
Normal file
13
salt/elasticsearch/templates/so/so-ossec-template.json.jinja
Normal file
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-ossec:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-ossec:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-ossec-*"],
|
||||
"version":50001,
|
||||
"order":11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-strelka:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-strelka:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-strelka-*"],
|
||||
"version":50001,
|
||||
"order":11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-syslog:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-syslog:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-syslog-*"],
|
||||
"version":50001,
|
||||
"order":11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
|
||||
13
salt/elasticsearch/templates/so/so-zeek-template.json.jinja
Normal file
13
salt/elasticsearch/templates/so/so-zeek-template.json.jinja
Normal file
@@ -0,0 +1,13 @@
|
||||
{%- set SHARDS = salt['pillar.get']('elasticsearch:index_settings:so-zeek:shards', 1) %}
|
||||
{%- set REPLICAS = salt['pillar.get']('elasticsearch:replicas', 0) %}
|
||||
{%- set REFRESH = salt['pillar.get']('elasticsearch:index_settings:so-zeek:refresh', '30s') %}
|
||||
{
|
||||
"index_patterns": ["so-zeek-*"],
|
||||
"version":50001,
|
||||
"order":11,
|
||||
"settings":{
|
||||
"number_of_replicas":{{ REPLICAS }},
|
||||
"number_of_shards":{{ SHARDS }},
|
||||
"index.refresh_interval":"{{ REFRESH }}"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user