CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-19 07:23:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixup logic

Browse Source
This commit is contained in:
DefensiveDepth
2025-12-10 17:16:35 -05:00
parent 8ef6c2f91d
commit 5ab6bda639
2 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
salt/suricata/cron/so-suricata-rulestats
View File

@@ -17,14 +17,23 @@ query() {
STATS=$(query "ruleset-stats") STATS=$(query "ruleset-stats")
RELOAD=$(query "ruleset-reload-time") RELOAD=$(query "ruleset-reload-time")
[ -z "$RELOAD" ] && RELOAD='{}'
if echo "$STATS" | jq -e '.return == "OK"' > /dev/null 2>&1; then # Outputs valid JSON on success, empty on failure
LOADED=$(echo "$STATS" | jq -r '.message[0].rules_loaded') OUTPUT=$(jq -n \
FAILED=$(echo "$STATS" | jq -r '.message[0].rules_failed') --argjson stats "$STATS" \
LAST_RELOAD=$(echo "$RELOAD" | jq -r '.message[0].last_reload') --argjson reload "$RELOAD" \
'if $stats.return == "OK" and ($stats.message[0].rules_loaded | type) == "number" and ($stats.message[0].rules_failed | type) == "number" then
{
rules_loaded: $stats.message[0].rules_loaded,
rules_failed: $stats.message[0].rules_failed,
last_reload: ($reload.message[0].last_reload // ""),
return: "OK"
}
else empty end' 2>/dev/null)
jq -n --argjson loaded "$LOADED" --argjson failed "$FAILED" --arg reload "$LAST_RELOAD" \ if [ -n "$OUTPUT" ]; then
'{rules_loaded: $loaded, rules_failed: $failed, last_reload: $reload, return: "OK"}' > "$OUTFILE" echo "$OUTPUT" > "$OUTFILE"
else else
echo '{"return":"FAIL"}' > "$OUTFILE" echo '{"return":"FAIL"}' > "$OUTFILE"
fi fi

10
salt/telegraf/scripts/surirules.sh
View File

@@ -18,11 +18,15 @@ if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
if [ -f "$STATSFILE" ] && [ $(($(date +%s) - $(stat -c %Y "$STATSFILE"))) -lt 90 ] && jq -e '.return == "OK" and .rules_loaded != null and .rules_failed != null' "$STATSFILE" > /dev/null 2>&1; then if [ -f "$STATSFILE" ] && [ $(($(date +%s) - $(stat -c %Y "$STATSFILE"))) -lt 90 ] && jq -e '.return == "OK" and .rules_loaded != null and .rules_failed != null' "$STATSFILE" > /dev/null 2>&1; then
LOADED=$(jq -r '.rules_loaded' "$STATSFILE") LOADED=$(jq -r '.rules_loaded' "$STATSFILE")
FAILED=$(jq -r '.rules_failed' "$STATSFILE") FAILED=$(jq -r '.rules_failed' "$STATSFILE")
RELOAD_TIME=$(jq -r '.last_reload // ""' "$STATSFILE") RELOAD_TIME=$(jq -r 'if .last_reload then .last_reload else "" end' "$STATSFILE")
echo "surirules loaded=${LOADED}i,failed=${FAILED}i,reload_time=\"${RELOAD_TIME}\",status=\"ok\"" if [ -n "$RELOAD_TIME" ]; then
echo "surirules loaded=${LOADED}i,failed=${FAILED}i,reload_time=\"${RELOAD_TIME}\",status=\"ok\""
else
echo "surirules loaded=${LOADED}i,failed=${FAILED}i,status=\"ok\""
fi
else else
echo "surirules loaded=0i,failed=0i,reload_time=\"\",status=\"unknown\"" echo "surirules loaded=0i,failed=0i,status=\"unknown\""
fi fi
fi fi