2.4 strelka

salt/common/tools/sbin/so-yara-update

@@ -1,84 +0,0 @@
-#!/bin/bash
-# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
-# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
-# https://securityonion.net/license; you may not use this file except in compliance with the
-# Elastic License 2.0.
-
-
-{%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %}
-
-echo "Starting to check for yara rule updates at $(date)..."
-
-output_dir="/opt/so/saltstack/default/salt/strelka/rules"
-mkdir -p $output_dir
-repos="$output_dir/repos.txt"
-newcounter=0
-
-{% if ISAIRGAP is sameas true %}
-
-echo "Airgap mode enabled."
-
-clone_dir="/nsm/repo/rules/strelka"
-repo_name="signature-base"
-mkdir -p /opt/so/saltstack/default/salt/strelka/rules/signature-base
-# Ensure a copy of the license is available for the rules
-[ -f $clone_dir/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name
-
-# Copy over rules
-for i in $(find $clone_dir/yara -name "*.yar*"); do
-  rule_name=$(echo $i | awk -F '/' '{print $NF}')
-  echo "Adding rule: $rule_name..."
-  cp $i $output_dir/$repo_name
-  ((newcounter++))
-done
-
-echo "Done!"
-
-if [ "$newcounter" -gt 0 ];then
-  echo "$newcounter rules added."
-fi
-
-{% else %}
-
-gh_status=$(curl -s -o /dev/null -w "%{http_code}" https://github.com)
-clone_dir="/tmp"
-if [ "$gh_status" == "200" ]  || [ "$gh_status" == "301" ]; then
-
-  while IFS= read -r repo; do
-    if ! $(echo "$repo" | grep -qE '^#'); then
-      # Remove old repo if existing bc of previous error condition or unexpected disruption
-      repo_name=`echo $repo | awk -F '/' '{print $NF}'`
-      [ -d $output_dir/$repo_name ] && rm -rf $output_dir/$repo_name
-
-      # Clone repo and make appropriate directories for rules
-      git clone $repo $clone_dir/$repo_name
-      echo "Analyzing rules from $clone_dir/$repo_name..."
-      mkdir -p $output_dir/$repo_name
-      # Ensure a copy of the license is available for the rules
-      [ -f $clone_dir/$repo_name/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name
-
-      # Copy over rules
-      for i in $(find $clone_dir/$repo_name -name "*.yar*"); do
-        rule_name=$(echo $i | awk -F '/' '{print $NF}')
-        echo "Adding rule: $rule_name..."
-        cp $i $output_dir/$repo_name
-        ((newcounter++))
-     done
-     rm -rf $clone_dir/$repo_name
-    fi
-    done < $repos
-
-  echo "Done!"
-  
-  if [ "$newcounter" -gt 0 ];then
-    echo "$newcounter rules added."
-  fi
-  
-else
-  echo "Server returned $gh_status status code."
-  echo "No connectivity to Github...exiting..."
-  exit 1
-fi
-{% endif %}
-
-echo "Finished rule updates at $(date)..."