CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-15 13:42:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

Logstash Module - Update logstash output scripts

Browse Source
This commit is contained in:
Mike Reeves
2018-10-04 14:23:30 -04:00
parent 1b4ed11d3f
commit 55b2f2211f
2 changed files with 29 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
salt/logstash/files/dynamic/9500_output_beats.conf
View File

@@ -1,18 +1,18 @@
{%- if grains['role'] != 'so-master' -%} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Wes Lambert # Author: Wes Lambert
# Last Update: 12/11/2017 # Last Update: 09/14/2018
filter { filter {
if "beat" in [tags] { if "beat" in [tags] {
mutate { mutate {
##add_tag => [ "conf_file_9000"] ##add_tag => [ "conf_file_9500"]
} }
} }
} }
output { output {
if "beat" in [tags] { if "beat" in [tags] {
elasticsearch { elasticsearch {
hosts => "{{ ES }}" hosts => {{ ES }}
index => "logstash-beats-%{+YYYY.MM.dd}" index => "logstash-beats-%{+YYYY.MM.dd}"
template_name => "logstash-beats" template_name => "logstash-beats"
template => "/beats-template.json" template => "/beats-template.json"
@@ -20,4 +20,3 @@ output {
} }
} }
} }
{%- endif %}

26
salt/logstash/files/dynamic/9600_output_ossec.conf Normal file
View File

@@ -0,0 +1,26 @@
{%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 9/19/2018
filter {
if [event_type] =~ "ossec" {
mutate {
##add_tag => [ "conf_file_9600"]
}
}
}
output {
if [event_type] =~ "ossec" or "ossec" in [tags] {
elasticsearch {
hosts => {{ ES }}
index => "logstash-ossec-%{+YYYY.MM.dd}"
template_name => "logstash-ossec"
template => "/logstash-ossec-template.json"
template_overwrite => true
}
}
}