mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-09 10:42:54 +01:00
2.4 strelka
This commit is contained in:
m0duspwnens
@@ -1,420 +0,0 @@
|
||||
{%- if grains.role in ['so-sensor', 'so-heavynode'] -%}
|
||||
{%- set mainint = salt['pillar.get']('host:mainint') %}
|
||||
{%- set ip = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %}
|
||||
{%- else %}
|
||||
{%- set ip = salt['pillar.get']('global:managerip') %}
|
||||
{%- endif -%}
|
||||
logging_cfg: '/etc/strelka/logging.yaml'
|
||||
limits:
|
||||
max_files: 0
|
||||
time_to_live: 0
|
||||
max_depth: 15
|
||||
distribution: 600
|
||||
scanner: 150
|
||||
coordinator:
|
||||
addr: '{{ ip }}:6380'
|
||||
db: 0
|
||||
tasting:
|
||||
mime_db: null
|
||||
yara_rules: '/etc/strelka/taste/'
|
||||
scanners:
|
||||
'ScanBase64':
|
||||
- positive:
|
||||
filename: '^base64_'
|
||||
priority: 5
|
||||
'ScanBatch':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/x-msdos-batch'
|
||||
- 'batch_file'
|
||||
priority: 5
|
||||
'ScanBzip2':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-bzip2'
|
||||
- 'bzip2_file'
|
||||
priority: 5
|
||||
'ScanDocx':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
|
||||
priority: 5
|
||||
options:
|
||||
extract_text: False
|
||||
'ScanElf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-object'
|
||||
- 'application/x-executable'
|
||||
- 'application/x-sharedlib'
|
||||
- 'application/x-coredump'
|
||||
- 'elf_file'
|
||||
priority: 5
|
||||
'ScanEmail':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.ms-outlook'
|
||||
- 'message/rfc822'
|
||||
- 'email_file'
|
||||
priority: 5
|
||||
'ScanEntropy':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
'ScanExiftool':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/msword'
|
||||
- 'application/vnd.openxmlformats-officedocument'
|
||||
- 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
|
||||
- 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
|
||||
- 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
|
||||
- 'olecf_file'
|
||||
- 'ooxml_file'
|
||||
- 'audio/mpeg'
|
||||
- 'mp3_file'
|
||||
- 'mhtml_file'
|
||||
- 'application/pdf'
|
||||
- 'pdf_file'
|
||||
- 'text/rtf'
|
||||
- 'rtf_file'
|
||||
- 'wordml_file'
|
||||
- 'application/x-dosexec'
|
||||
- 'mz_file'
|
||||
- 'application/x-object'
|
||||
- 'application/x-executable'
|
||||
- 'application/x-sharedlib'
|
||||
- 'application/x-coredump'
|
||||
- 'elf_file'
|
||||
- 'lnk_file'
|
||||
- 'application/x-mach-binary'
|
||||
- 'macho_file'
|
||||
- 'image/gif'
|
||||
- 'gif_file'
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
- 'image/png'
|
||||
- 'png_file'
|
||||
- 'image/tiff'
|
||||
- 'type_is_tiff'
|
||||
- 'image/x-ms-bmp'
|
||||
- 'bmp_file'
|
||||
- 'application/x-shockwave-flash'
|
||||
- 'fws_file'
|
||||
- 'psd_file'
|
||||
- 'video/mp4'
|
||||
- 'video/quicktime'
|
||||
- 'video/x-msvideo'
|
||||
- 'avi_file'
|
||||
- 'video/x-ms-wmv'
|
||||
- 'wmv_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanGif':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/gif'
|
||||
- 'gif_file'
|
||||
priority: 5
|
||||
'ScanGzip':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/gzip'
|
||||
- 'application/x-gzip'
|
||||
- 'gzip_file'
|
||||
priority: 5
|
||||
'ScanHash':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
'ScanHeader':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
options:
|
||||
length: 50
|
||||
'ScanHtml':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'hta_file'
|
||||
- 'text/html'
|
||||
- 'html_file'
|
||||
priority: 5
|
||||
options:
|
||||
parser: "html5lib"
|
||||
'ScanIni':
|
||||
- positive:
|
||||
filename: '(\.([Cc][Ff][Gg]|[Ii][Nn][Ii])|PROJECT)$'
|
||||
flavors:
|
||||
- 'ini_file'
|
||||
priority: 5
|
||||
'ScanJarManifest':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'jar_manifest_file'
|
||||
priority: 5
|
||||
'ScanJavascript':
|
||||
- negative:
|
||||
flavors:
|
||||
- 'text/html'
|
||||
- 'html_file'
|
||||
positive:
|
||||
flavors:
|
||||
- 'javascript_file'
|
||||
- 'text/javascript'
|
||||
priority: 5
|
||||
options:
|
||||
beautify: True
|
||||
'ScanJpeg':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
priority: 5
|
||||
'ScanJson':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/json'
|
||||
- 'json_file'
|
||||
priority: 5
|
||||
'ScanLibarchive':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.ms-cab-compressed'
|
||||
- 'cab_file'
|
||||
- 'application/x-7z-compressed'
|
||||
- '_7zip_file'
|
||||
- 'application/x-cpio'
|
||||
- 'cpio_file'
|
||||
- 'application/x-xar'
|
||||
- 'xar_file'
|
||||
- 'arj_file'
|
||||
- 'iso_file'
|
||||
- 'application/x-debian-package'
|
||||
- 'debian_package_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanLzma':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-lzma'
|
||||
- 'lzma_file'
|
||||
- 'application/x-xz'
|
||||
- 'xz_file'
|
||||
priority: 5
|
||||
'ScanMacho':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-mach-binary'
|
||||
- 'macho_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanOcr':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
- 'image/png'
|
||||
- 'png_file'
|
||||
- 'image/tiff'
|
||||
- 'type_is_tiff'
|
||||
- 'image/x-ms-bmp'
|
||||
- 'bmp_file'
|
||||
priority: 5
|
||||
options:
|
||||
extract_text: False
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanOle':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/CDFV2'
|
||||
- 'application/msword'
|
||||
- 'olecf_file'
|
||||
priority: 5
|
||||
'ScanPdf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/pdf'
|
||||
- 'pdf_file'
|
||||
priority: 5
|
||||
options:
|
||||
extract_text: False
|
||||
limit: 2000
|
||||
'ScanPe':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-dosexec'
|
||||
- 'mz_file'
|
||||
priority: 5
|
||||
'ScanPgp':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/pgp-keys'
|
||||
- 'pgp_file'
|
||||
priority: 5
|
||||
'ScanPhp':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/x-php'
|
||||
- 'php_file'
|
||||
priority: 5
|
||||
'ScanPkcs7':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'pkcs7_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanPlist':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'bplist_file'
|
||||
- 'plist_file'
|
||||
priority: 5
|
||||
options:
|
||||
keys:
|
||||
- 'KeepAlive'
|
||||
- 'Label'
|
||||
- 'NetworkState'
|
||||
- 'Program'
|
||||
- 'ProgramArguments'
|
||||
- 'RunAtLoad'
|
||||
- 'StartInterval'
|
||||
'ScanRar':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-rar'
|
||||
- 'rar_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanRpm':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-rpm'
|
||||
- 'rpm_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanRtf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/rtf'
|
||||
- 'rtf_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanRuby':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/x-ruby'
|
||||
priority: 5
|
||||
'ScanSwf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-shockwave-flash'
|
||||
- 'fws_file'
|
||||
- 'cws_file'
|
||||
- 'zws_file'
|
||||
priority: 5
|
||||
'ScanTar':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-tar'
|
||||
- 'tar_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanTnef':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.ms-tnef'
|
||||
- 'tnef_file'
|
||||
priority: 5
|
||||
'ScanUpx':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'upx_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanUrl':
|
||||
- negative:
|
||||
flavors:
|
||||
- 'javascript_file'
|
||||
positive:
|
||||
flavors:
|
||||
- 'text/plain'
|
||||
priority: 5
|
||||
'ScanVb':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'vb_file'
|
||||
- 'vbscript'
|
||||
priority: 5
|
||||
'ScanVba':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'mhtml_file'
|
||||
- 'application/msword'
|
||||
- 'olecf_file'
|
||||
- 'wordml_file'
|
||||
priority: 5
|
||||
options:
|
||||
analyze_macros: True
|
||||
'ScanX509':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'x509_der_file'
|
||||
priority: 5
|
||||
options:
|
||||
type: 'der'
|
||||
- positive:
|
||||
flavors:
|
||||
- 'x509_pem_file'
|
||||
priority: 5
|
||||
options:
|
||||
type: 'pem'
|
||||
'ScanXml':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/xml'
|
||||
- 'text/xml'
|
||||
- 'xml_file'
|
||||
- 'mso_file'
|
||||
- 'soap_file'
|
||||
priority: 5
|
||||
'ScanYara':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
options:
|
||||
location: '/etc/yara/'
|
||||
'ScanZip':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/java-archive'
|
||||
- 'application/zip'
|
||||
- 'zip_file'
|
||||
- 'application/vnd.openxmlformats-officedocument'
|
||||
- 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
|
||||
- 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
|
||||
- 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
|
||||
- 'ooxml_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
password_file: '/etc/strelka/passwords.dat'
|
||||
'ScanZlib':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/zlib'
|
||||
- 'zlib_file'
|
||||
priority: 5
|
||||
1
salt/strelka/files/backend/backend.yaml.jinja
Normal file
1
salt/strelka/files/backend/backend.yaml.jinja
Normal file
@@ -0,0 +1 @@
|
||||
{{ BACKENDCONFIG | yaml(false) }}
|
||||
@@ -1,78 +0,0 @@
|
||||
version: 1
|
||||
formatters:
|
||||
simple:
|
||||
format: '%(asctime)s - [%(levelname)s] %(name)s [%(module)s.%(funcName)s]: %(message)s'
|
||||
datefmt: '%Y-%m-%d %H:%M:%S'
|
||||
handlers:
|
||||
console:
|
||||
class: logging.StreamHandler
|
||||
formatter: simple
|
||||
stream: ext://sys.stdout
|
||||
root:
|
||||
level: DEBUG
|
||||
handlers: [console]
|
||||
loggers:
|
||||
OpenSSL:
|
||||
propagate: 0
|
||||
bs4:
|
||||
propagate: 0
|
||||
bz2:
|
||||
propagate: 0
|
||||
chardet:
|
||||
propagate: 0
|
||||
docx:
|
||||
propagate: 0
|
||||
elftools:
|
||||
propagate: 0
|
||||
email:
|
||||
propagate: 0
|
||||
entropy:
|
||||
propagate: 0
|
||||
esprima:
|
||||
propagate: 0
|
||||
gzip:
|
||||
propagate: 0
|
||||
hashlib:
|
||||
propagate: 0
|
||||
json:
|
||||
propagate: 0
|
||||
libarchive:
|
||||
propagate: 0
|
||||
lxml:
|
||||
propagate: 0
|
||||
lzma:
|
||||
propagate: 0
|
||||
macholibre:
|
||||
propagate: 0
|
||||
olefile:
|
||||
propagate: 0
|
||||
oletools:
|
||||
propagate: 0
|
||||
pdfminer:
|
||||
propagate: 0
|
||||
pefile:
|
||||
propagate: 0
|
||||
pgpdump:
|
||||
propagate: 0
|
||||
pygments:
|
||||
propagate: 0
|
||||
pylzma:
|
||||
propagate: 0
|
||||
rarfile:
|
||||
propagate: 0
|
||||
requests:
|
||||
propagate: 0
|
||||
rpmfile:
|
||||
propagate: 0
|
||||
ssdeep:
|
||||
propagate: 0
|
||||
tarfile:
|
||||
propagate: 0
|
||||
tnefparse:
|
||||
propagate: 0
|
||||
yara:
|
||||
propagate: 0
|
||||
zipfile:
|
||||
propagate: 0
|
||||
zlib:
|
||||
propagate: 0
|
||||
1
salt/strelka/files/backend/logging.yaml.jinja
Normal file
1
salt/strelka/files/backend/logging.yaml.jinja
Normal file
@@ -0,0 +1 @@
|
||||
{{ LOGGINGCONFIG | yaml(false) }}
|
||||
@@ -1,2 +0,0 @@
|
||||
infected
|
||||
password
|
||||
1
salt/strelka/files/backend/passwords.dat.jinja
Normal file
1
salt/strelka/files/backend/passwords.dat.jinja
Normal file
@@ -0,0 +1 @@
|
||||
{{ PASSWORDS | join('\n') }}
|
||||
Reference in New Issue
Block a user