CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #257 from Security-Onion-Solutions/features/features_setup

Browse Source 
Initial Features Support
This commit is contained in:
Mike Reeves
2020-01-28 10:15:27 -05:00
committed by GitHub
parent 5321c0db5d 38f42eafa5
commit 67d940048f
23 changed files with 120 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/common/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{%- set GRAFANA = salt['pillar.get']('master:grafana', '0') %}
# Add socore Group
@@ -118,7 +118,7 @@ nginxtmp:
so-core:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-core:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-core:{{ VERSION }}
- hostname: so-core
- user: socore
- binds:
@@ -172,7 +172,7 @@ tgrafconf:
so-telegraf:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-telegraf:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-telegraf:{{ VERSION }}
- environment:
- HOST_PROC=/host/proc
- HOST_ETC=/host/etc
@@ -227,7 +227,7 @@ influxdbconf:
so-influxdb:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-influxdb:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-influxdb:{{ VERSION }}
- hostname: influxdb
- environment:
- INFLUXDB_HTTP_LOG_ENABLED=false
@@ -385,7 +385,7 @@ dashboard-{{ SN }}:
so-grafana:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-grafana:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-grafana:{{ VERSION }}
- hostname: grafana
- user: socore
- binds:

42
salt/common/tools/sbin/so-features-enable Normal file
View File

@@ -0,0 +1,42 @@
#!/bin/bash
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
. /usr/sbin/so-common
VERSION=$(grep soversion /opt/so/saltstack/pillar/static.sls | cut -d':' -f2|sed 's/ //g')
# Modify static.sls to enable Features
sed -i 's/features: False/features: True/' /opt/so/saltstack/pillar/static.sls
SUFFIX="-features"
TRUSTED_CONTAINERS=( \
"so-elasticsearch:$VERSION$SUFFIX" \
"so-filebeat:$VERSION$SUFFIX" \
"so-kibana:$VERSION$SUFFIX" \
"so-logstash:$VERSION$SUFFIX" )
for i in "${TRUSTED_CONTAINERS[@]}"
do
# Pull down the trusted docker image
echo "Downloading $i"
docker pull --disable-content-trust=false docker.io/soshybridhunter/$i
# Tag it with the new registry destination
docker tag soshybridhunter/$i $HOSTNAME:5000/soshybridhunter/$i
docker push $HOSTNAME:5000/soshybridhunter/$i
done
for i in "${TRUSTED_CONTAINERS[@]}"
do
echo "Removing $i locally"
docker rmi soshybridhunter/$i
done

4
salt/curator/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{% if grains['role'] == 'so-node' or grains['role'] == 'so-eval' %}
# Curator
@@ -116,7 +116,7 @@ curdel:
so-curator:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-curator:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-curator:{{ VERSION }}
- hostname: curator
- name: so-curator
- user: curator

4
salt/elastalert/init.sls
View File

@@ -12,7 +12,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{% if grains['role'] == 'so-master' %}
@@ -112,7 +112,7 @@ elastaconf:
so-elastalert:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-elastalert:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-elastalert:{{ VERSION }}
- hostname: elastalert
- name: so-elastalert
- user: elastalert

13
salt/elasticsearch/init.sls
View File

@@ -12,8 +12,15 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
{% if grains['role'] == 'so-master' %}
{% set esclustername = salt['pillar.get']('master:esclustername', '') %}
@@ -102,7 +109,7 @@ eslogdir:
so-elasticsearch:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-elasticsearch:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-elasticsearch:{{ VERSION }}{{ FEATURES }}
- hostname: elasticsearch
- name: so-elasticsearch
- user: elasticsearch
@@ -135,4 +142,4 @@ so-elasticsearch-pipelines-file:
so-elasticsearch-pipelines:
cmd.run:
- name: /opt/so/conf/elasticsearch/so-elasticsearch-pipelines {{ esclustername }}
- name: /opt/so/conf/elasticsearch/so-elasticsearch-pipelines {{ esclustername }}

10
salt/filebeat/init.sls
View File

@@ -12,9 +12,15 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
# Filebeat Setup
filebeatetcdir:
@@ -49,7 +55,7 @@ filebeatconfsync:
so-filebeat:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-filebeat:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-filebeat:{{ VERSION }}{{ FEATURES }}
- hostname: so-filebeat
- user: root
- extra_hosts: {{ MASTER }}:{{ MASTERIP }}

4
salt/fleet/init.sls
View File

@@ -1,7 +1,7 @@
{%- set MYSQLPASS = salt['pillar.get']('auth:mysql', 'iwonttellyou') %}
{%- set FLEETPASS = salt['pillar.get']('auth:fleet', 'bazinga') -%}
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# Fleet Setup
@@ -63,7 +63,7 @@ fleetdbpriv:
so-fleet:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-fleet:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-fleet:{{ VERSION }}
- hostname: so-fleet
- port_bindings:
- 0.0.0.0:8080:8080

8
salt/hive/init.sls
View File

@@ -1,5 +1,5 @@
{% set MASTERIP = salt['pillar.get']('master:mainip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
hiveconfdir:
file.directory:
@@ -57,7 +57,7 @@ hiveesdata:
so-thehive-es:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive-es:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive-es:{{ VERSION }}
- hostname: so-thehive-es
- name: so-thehive-es
- user: 939
@@ -85,7 +85,7 @@ so-thehive-es:
# Install Cortex
so-cortex:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive-cortex:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive-cortex:{{ VERSION }}
- hostname: so-cortex
- name: so-cortex
- user: 939
@@ -102,7 +102,7 @@ cortexscript:
so-thehive:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive:{{ VERSION }}
- environment:
- ELASTICSEARCH_HOST={{ MASTERIP }}
- hostname: so-thehive

4
salt/idstools/init.sls
View File

@@ -12,7 +12,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# IDSTools Setup
idstoolsdir:
@@ -64,7 +64,7 @@ ruleslink:
so-idstools:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-idstools:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-idstools:{{ VERSION }}
- hostname: so-idstools
- user: socore
- binds:

10
salt/kibana/init.sls
View File

@@ -1,5 +1,11 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
# Add ES Group
kibanasearchgroup:
@@ -56,7 +62,7 @@ synckibanacustom:
# Start the kibana docker
so-kibana:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-kibana:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-kibana:{{ VERSION }}{{ FEATURES }}
- hostname: kibana
- user: kibana
- environment:

11
salt/logstash/init.sls
View File

@@ -12,8 +12,15 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
# Logstash Section - Decide which pillar to use
{% if grains['role'] == 'so-sensor' %}
@@ -200,7 +207,7 @@ lslogdir:
so-logstash:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-logstash:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-logstash:{{ VERSION }}{{ FEATURES }}
- hostname: so-logstash
- name: so-logstash
- user: logstash

4
salt/master/init.sls
View File

@@ -12,7 +12,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
{% set masterproxy = salt['pillar.get']('static:masterupdate', '0') %}
@@ -59,7 +59,7 @@ acngcopyconf:
# Install the apt-cacher-ng container
so-aptcacherng:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-acng:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-acng:{{ VERSION }}
- hostname: so-acng
- port_bindings:
- 0.0.0.0:3142:3142

4
salt/mysql/init.sls
View File

@@ -1,7 +1,7 @@
{%- set MYSQLPASS = salt['pillar.get']('auth:mysql', 'iwonttellyou') %}
{%- set FLEETPASS = salt['pillar.get']('auth:fleet', 'bazinga') %}
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# MySQL Setup
mysqlpkgs:
@@ -52,7 +52,7 @@ mysqldatadir:
so-mysql:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-mysql:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-mysql:{{ VERSION }}
- hostname: so-mysql
- user: socore
- port_bindings:

4
salt/pcap/init.sls
View File

@@ -12,7 +12,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# PCAP Section
@@ -130,7 +130,7 @@ stenolog:
so-steno:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-steno:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-steno:{{ VERSION }}
- network_mode: host
- privileged: True
- port_bindings:

6
salt/playbook/init.sls
View File

@@ -1,5 +1,5 @@
{% set MASTERIP = salt['pillar.get']('master:mainip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
playbookdb:
@@ -28,7 +28,7 @@ navigatorconfig:
so-playbook:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-playbook:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-playbook:{{ VERSION }}
- hostname: playbook
- name: so-playbook
- binds:
@@ -38,7 +38,7 @@ so-playbook:
so-navigator:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-navigator:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-navigator:{{ VERSION }}
- hostname: navigator
- name: so-navigator
- binds:

4
salt/redis/init.sls
View File

@@ -13,7 +13,7 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set lsaccessip = salt['pillar.get']('master:lsaccessip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# Redis Setup
@@ -48,7 +48,7 @@ redisconfsync:
so-redis:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-redis:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-redis:{{ VERSION }}
- hostname: so-redis
- user: socore
- port_bindings:

4
salt/sensoroni/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
sensoronidir:
@@ -32,7 +32,7 @@ sensoronisync:
so-sensoroni:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-sensoroni:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-sensoroni:{{ VERSION }}
- hostname: sensoroni
- name: so-sensoroni
- binds:

4
salt/soctopus/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
soctopusdir:
@@ -49,7 +49,7 @@ navigatordefaultlayer:
so-soctopus:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-soctopus:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-soctopus:{{ VERSION }}
- hostname: soctopus
- name: so-soctopus
- binds:

4
salt/suricata/init.sls
View File

@@ -15,7 +15,7 @@
{% set interface = salt['pillar.get']('sensor:interface', 'bond0') %}
{% set BROVER = salt['pillar.get']('static:broversion', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# Suricata
@@ -82,7 +82,7 @@ surithresholding:
so-suricata:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-suricata:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-suricata:{{ VERSION }}
- privileged: True
- environment:
- INTERFACE={{ interface }}

4
salt/tcpreplay/init.sls
View File

@@ -1,11 +1,11 @@
{% if grains['role'] == 'so-sensor' or grains['role'] == 'so-eval' %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
so-tcpreplay:
docker_container.running:
- network_mode: "host"
- image: {{ MASTER }}:5000/soshybridhunter/so-tcpreplay:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-tcpreplay:{{ VERSION }}
- name: so-tcpreplay
- user: root
- interactive: True

4
salt/wazuh/init.sls
View File

@@ -1,5 +1,5 @@
{%- set HOSTNAME = salt['grains.get']('host', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# Add ossec group
ossecgroup:
@@ -74,7 +74,7 @@ wazuhmgrwhitelist:
so-wazuh:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-wazuh:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-wazuh:{{ VERSION }}
- hostname: {{HOSTNAME}}-wazuh-manager
- name: so-wazuh
- detach: True

4
salt/zeek/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %}
# Zeek Salt State
# Add Zeek group
@@ -100,7 +100,7 @@ localzeeksync:
so-zeek:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-zeek:HH{{ VERSION }}
- image: {{ MASTER }}:5000/soshybridhunter/so-zeek:{{ VERSION }}
- privileged: True
- binds:
- /nsm/zeek/logs:/nsm/zeek/logs:rw

4
setup/functions.sh
View File

@@ -714,7 +714,7 @@ master_static() {
touch /opt/so/saltstack/pillar/static.sls
echo "static:" > /opt/so/saltstack/pillar/static.sls
echo " soversion: 1.1.4" >> /opt/so/saltstack/pillar/static.sls
echo " soversion: HH1.1.4" >> /opt/so/saltstack/pillar/static.sls
echo " hnmaster: $HNMASTER" >> /opt/so/saltstack/pillar/static.sls
echo " ntpserver: $NTPSERVER" >> /opt/so/saltstack/pillar/static.sls
echo " proxy: $PROXY" >> /opt/so/saltstack/pillar/static.sls
@@ -732,6 +732,8 @@ master_static() {
echo " cortexorguserkey: $CORTEXORGUSERKEY" >> /opt/so/saltstack/pillar/static.sls
echo " fleetsetup: 0" >> /opt/so/saltstack/pillar/static.sls
echo " sensoronikey: $SENSORONIKEY" >> /opt/so/saltstack/pillar/static.sls
echo "elastic:" >> /opt/so/saltstack/pillar/static.sls
echo " features: False" >> /opt/so/saltstack/pillar/static.sls
if [[ $MASTERUPDATES == 'MASTER' ]]; then
echo " masterupdate: 1" >> /opt/so/saltstack/pillar/static.sls
else