CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Disable Strelka for all things

Browse Source
This commit is contained in:
Mike Reeves
2020-04-09 11:49:38 -04:00
parent 8ffeb0a33d
commit 5a985736e5
1 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
salt/filebeat/etc/filebeat.yml
View File

@@ -110,6 +110,26 @@ filebeat.inputs:
fields_under_root: true fields_under_root: true
clean_removed: false clean_removed: false
close_removed: false close_removed: false
{%- if STRELKAENABLED == '1' %}
- type: log
paths:
- /nsm/strelka/log/strelka.log
fields:
module: strelka
category: file
dataset: file
processors:
- drop_fields:
fields: ["source", "prospector", "input", "offset", "beat"]
fields_under_root: true
clean_removed: false
close_removed: false
{%- endif %}
{%- endif %} {%- endif %}
{%- if WAZUHENABLED == '1' %} {%- if WAZUHENABLED == '1' %}
@@ -160,25 +180,6 @@ filebeat.inputs:
{%- endif %} {%- endif %}
{%- if STRELKAENABLED == '1' %}
- type: log
paths:
- /nsm/strelka/log/strelka.log
fields:
module: strelka
category: file
dataset: file
processors:
- drop_fields:
fields: ["source", "prospector", "input", "offset", "beat"]
fields_under_root: true
clean_removed: false
close_removed: false
{%- endif %}
#----------------------------- Elasticsearch/Logstash output --------------------------------- #----------------------------- Elasticsearch/Logstash output ---------------------------------
{%- if grains['role'] == "so-eval" %} {%- if grains['role'] == "so-eval" %}
output.elasticsearch: output.elasticsearch: