CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 18:52:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

first commit of importpcap node mode code, kek

Browse Source
This commit is contained in:
m0duspwnens
2020-08-05 14:44:23 -04:00
parent 51934d6e5f
commit 66ca7b266c
4 changed files with 193 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
setup/so-setup
View File

@@ -165,6 +165,8 @@ elif [ "$install_type" = 'FLEET' ]; then
OSQUERY=1
elif [ "$install_type" = 'HELIXSENSOR' ]; then
is_helix=true
elif [ "$install_type" = 'IMPORTPCAP' ]; then
is_importpcap=true
fi
if [[ $is_manager && $is_sensor ]]; then
@@ -173,8 +175,10 @@ elif [[ $is_fleet_standalone ]]; then
check_requirements "dist" "fleet"
elif [[ $is_sensor && ! $is_eval ]]; then
check_requirements "dist" "sensor"
elif [[ $is_distmanager || $is_minion ]]; then
elif [[ $is_distmanager || $is_minion ]] && [[ ! $is_importpcap ]]; then
check_requirements "dist"
elif [[ $is_importpcap ]]; then
check_requirements "importpcap"
fi
whiptail_patch_schedule
@@ -239,13 +243,38 @@ if [[ $is_node ]]; then
CURCLOSEDAYS=30
fi
if [[ $is_importpcap ]]; then
patch_schedule=Automatic
RULESETUP=ETOPEN
NSMSETUP=BASIC
HNSENSOR=inherit
MANAGERUPDATES=0
MANAGERADV=BASIC
ZEEKVERSION=ZEEK
NIDS=Suricata
RULESETUP=ETOPEN
GRAFANA=0
OSQUERY=0
WAZUH=0
THEHIVE=0
PLAYBOOK=0
STRELKA=0
fi
# Start user prompts
if [[ $is_helix || $is_sensor ]]; then
whiptail_sensor_nics
fi
if [[ $is_helix || $is_sensor || $is_importpcap ]]; then
calculate_useable_cores
fi
if [[ $is_helix || $is_manager ]]; then
if [[ $is_helix || $is_manager || $is_importpcap ]]; then
whiptail_homenet_manager
fi
@@ -274,6 +303,9 @@ if [[ $is_manager ]]; then
if [[ $STRELKA == 1 ]]; then
whiptail_strelka_rules
fi
fi
if [[ $is_manager || $is_importpcap ]]; then
collect_webuser_inputs
get_redirect
fi
@@ -335,7 +367,7 @@ else
FLEETNODEPASSWD1=$WEBPASSWD1
fi
if [[ $is_manager ]]; then whiptail_so_allow; fi
if [[ $is_manager || $is_importpcap ]]; then whiptail_so_allow; fi
whiptail_make_changes
@@ -359,7 +391,7 @@ fi
} >> $setup_log 2>&1
if [[ $is_manager ]]; then
if [[ $is_manager || $is_importpcap ]]; then
{
generate_passwords;
secrets_pillar;
@@ -399,6 +431,9 @@ fi
if [[ $is_sensor || $is_helix ]]; then
set_progress_str 3 'Configuring sensor interface'
configure_network_sensor >> $setup_log 2>&1
fi
if [[ $is_sensor || $is_helix || $is_importpcap ]]; then
set_progress_str 4 'Generating sensor pillar'
sensor_pillar >> $setup_log 2>&1
fi
@@ -415,7 +450,7 @@ fi
set_progress_str 9 'Initializing Salt minion'
configure_minion "$minion_type" >> $setup_log 2>&1
if [[ $is_manager || $is_helix ]]; then
if [[ $is_manager || $is_helix || $is_importpcap ]]; then
set_progress_str 10 'Configuring Salt master'
{
create_local_directories;
@@ -459,7 +494,7 @@ fi
accept_salt_key_remote >> $setup_log 2>&1
fi
if [[ $is_manager ]]; then
if [[ $is_manager || $is_importpcap ]]; then
set_progress_str 20 'Accepting Salt key'
salt-key -ya "$MINION_ID" >> $setup_log 2>&1
fi
@@ -472,10 +507,15 @@ fi
salt-call state.apply salt.minion -l info >> $setup_log 2>&1
fi
if [[ $is_importpcap ]]; then
set_progress_str 22 'Configuring bond interface'
salt-call state.apply importpcap.bond -l info >> $setup_log 2>&1
fi
set_progress_str 23 'Generating CA and checking in'
salt_checkin >> $setup_log 2>&1
if [[ $is_manager || $is_helix ]]; then
if [[ $is_manager || $is_helix || $is_importpcap ]]; then
set_progress_str 25 'Configuring firewall'
set_initial_firewall_policy >> $setup_log 2>&1
@@ -485,14 +525,18 @@ fi
set_progress_str 26 'Downloading containers from the internet'
fi
salt-call state.apply -l info registry >> $setup_log 2>&1
docker_seed_registry 2>> "$setup_log" # ~ 60% when finished
if [[ ! $is_importpcap ]]; then
salt-call state.apply -l info registry >> $setup_log 2>&1
docker_seed_registry 2>> "$setup_log" # ~ 60% when finished
fi
set_progress_str 60 "$(print_salt_state_apply 'manager')"
salt-call state.apply -l info manager >> $setup_log 2>&1
set_progress_str 61 "$(print_salt_state_apply 'idstools')"
salt-call state.apply -l info idstools >> $setup_log 2>&1
if [[ ! $is_importpcap ]]; then
set_progress_str 61 "$(print_salt_state_apply 'idstools')"
salt-call state.apply -l info idstools >> $setup_log 2>&1
fi
set_progress_str 61 "$(print_salt_state_apply 'suricata.manager')"
salt-call state.apply -l info suricata.manager >> $setup_log 2>&1
@@ -513,7 +557,7 @@ fi
set_progress_str 64 "$(print_salt_state_apply 'nginx')"
salt-call state.apply -l info nginx >> $setup_log 2>&1
if [[ $is_manager || $is_node ]]; then
if [[ $is_manager || $is_node || $is_importpcap ]]; then
set_progress_str 64 "$(print_salt_state_apply 'elasticsearch')"
salt-call state.apply -l info elasticsearch >> $setup_log 2>&1
fi
@@ -521,7 +565,9 @@ fi
if [[ $is_sensor ]]; then
set_progress_str 65 "$(print_salt_state_apply 'pcap')"
salt-call state.apply -l info pcap >> $setup_log 2>&1
fi
if [[ $is_sensor || $is_importpcap ]]; then
set_progress_str 66 "$(print_salt_state_apply 'suricata')"
salt-call state.apply -l info suricata >> $setup_log 2>&1
@@ -534,13 +580,15 @@ fi
salt-call state.apply -l info curator >> $setup_log 2>&1
fi
if [[ $is_manager ]]; then
if [[ $is_manager || $is_importpcap ]]; then
set_progress_str 69 "$(print_salt_state_apply 'soc')"
salt-call state.apply -l info soc >> $setup_log 2>&1
set_progress_str 70 "$(print_salt_state_apply 'kibana')"
salt-call state.apply -l info kibana >> $setup_log 2>&1
fi
if [[ $is_manager ]]; then
set_progress_str 71 "$(print_salt_state_apply 'elastalert')"
salt-call state.apply -l info elastalert >> $setup_log 2>&1
@@ -598,7 +646,7 @@ fi
fi
fi
if [[ $is_manager || $is_helix ]]; then
if [[ $is_manager || $is_helix || $is_importpcap ]]; then
set_progress_str 81 "$(print_salt_state_apply 'utility')"
salt-call state.apply -l info utility >> $setup_log 2>&1
fi