CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #257 from Security-Onion-Solutions/features/features_setup

Browse Source 
Initial Features Support
This commit is contained in:
Mike Reeves
2020-01-28 10:15:27 -05:00
committed by GitHub
parent 5321c0db5d 38f42eafa5
commit 67d940048f
23 changed files with 120 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/common/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{%- set GRAFANA = salt['pillar.get']('master:grafana', '0') %} {%- set GRAFANA = salt['pillar.get']('master:grafana', '0') %}
# Add socore Group # Add socore Group
@@ -118,7 +118,7 @@ nginxtmp:
so-core: so-core:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-core:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-core:{{ VERSION }}
- hostname: so-core - hostname: so-core
- user: socore - user: socore
- binds: - binds:
@@ -172,7 +172,7 @@ tgrafconf:
so-telegraf: so-telegraf:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-telegraf:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-telegraf:{{ VERSION }}
- environment: - environment:
- HOST_PROC=/host/proc - HOST_PROC=/host/proc
- HOST_ETC=/host/etc - HOST_ETC=/host/etc
@@ -227,7 +227,7 @@ influxdbconf:
so-influxdb: so-influxdb:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-influxdb:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-influxdb:{{ VERSION }}
- hostname: influxdb - hostname: influxdb
- environment: - environment:
- INFLUXDB_HTTP_LOG_ENABLED=false - INFLUXDB_HTTP_LOG_ENABLED=false
@@ -385,7 +385,7 @@ dashboard-{{ SN }}:
so-grafana: so-grafana:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-grafana:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-grafana:{{ VERSION }}
- hostname: grafana - hostname: grafana
- user: socore - user: socore
- binds: - binds:

42
salt/common/tools/sbin/so-features-enable Normal file
View File

@@ -0,0 +1,42 @@
#!/bin/bash
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
. /usr/sbin/so-common
VERSION=$(grep soversion /opt/so/saltstack/pillar/static.sls | cut -d':' -f2|sed 's/ //g')
# Modify static.sls to enable Features
sed -i 's/features: False/features: True/' /opt/so/saltstack/pillar/static.sls
SUFFIX="-features"
TRUSTED_CONTAINERS=( \
"so-elasticsearch:$VERSION$SUFFIX" \
"so-filebeat:$VERSION$SUFFIX" \
"so-kibana:$VERSION$SUFFIX" \
"so-logstash:$VERSION$SUFFIX" )
for i in "${TRUSTED_CONTAINERS[@]}"
do
# Pull down the trusted docker image
echo "Downloading $i"
docker pull --disable-content-trust=false docker.io/soshybridhunter/$i
# Tag it with the new registry destination
docker tag soshybridhunter/$i $HOSTNAME:5000/soshybridhunter/$i
docker push $HOSTNAME:5000/soshybridhunter/$i
done
for i in "${TRUSTED_CONTAINERS[@]}"
do
echo "Removing $i locally"
docker rmi soshybridhunter/$i
done

4
salt/curator/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% if grains['role'] == 'so-node' or grains['role'] == 'so-eval' %} {% if grains['role'] == 'so-node' or grains['role'] == 'so-eval' %}
# Curator # Curator
@@ -116,7 +116,7 @@ curdel:
so-curator: so-curator:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-curator:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-curator:{{ VERSION }}
- hostname: curator - hostname: curator
- name: so-curator - name: so-curator
- user: curator - user: curator

4
salt/elastalert/init.sls
View File

@@ -12,7 +12,7 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% if grains['role'] == 'so-master' %} {% if grains['role'] == 'so-master' %}
@@ -112,7 +112,7 @@ elastaconf:
so-elastalert: so-elastalert:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-elastalert:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-elastalert:{{ VERSION }}
- hostname: elastalert - hostname: elastalert
- name: so-elastalert - name: so-elastalert
- user: elastalert - user: elastalert

11
salt/elasticsearch/init.sls
View File

@@ -12,8 +12,15 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
{% if grains['role'] == 'so-master' %} {% if grains['role'] == 'so-master' %}
{% set esclustername = salt['pillar.get']('master:esclustername', '') %} {% set esclustername = salt['pillar.get']('master:esclustername', '') %}
@@ -102,7 +109,7 @@ eslogdir:
so-elasticsearch: so-elasticsearch:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-elasticsearch:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-elasticsearch:{{ VERSION }}{{ FEATURES }}
- hostname: elasticsearch - hostname: elasticsearch
- name: so-elasticsearch - name: so-elasticsearch
- user: elasticsearch - user: elasticsearch

10
salt/filebeat/init.sls
View File

@@ -12,9 +12,15 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') %} {%- set MASTERIP = salt['pillar.get']('static:masterip', '') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
# Filebeat Setup # Filebeat Setup
filebeatetcdir: filebeatetcdir:
@@ -49,7 +55,7 @@ filebeatconfsync:
so-filebeat: so-filebeat:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-filebeat:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-filebeat:{{ VERSION }}{{ FEATURES }}
- hostname: so-filebeat - hostname: so-filebeat
- user: root - user: root
- extra_hosts: {{ MASTER }}:{{ MASTERIP }} - extra_hosts: {{ MASTER }}:{{ MASTERIP }}

4
salt/fleet/init.sls
View File

@@ -1,7 +1,7 @@
{%- set MYSQLPASS = salt['pillar.get']('auth:mysql', 'iwonttellyou') %} {%- set MYSQLPASS = salt['pillar.get']('auth:mysql', 'iwonttellyou') %}
{%- set FLEETPASS = salt['pillar.get']('auth:fleet', 'bazinga') -%} {%- set FLEETPASS = salt['pillar.get']('auth:fleet', 'bazinga') -%}
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%} {%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# Fleet Setup # Fleet Setup
@@ -63,7 +63,7 @@ fleetdbpriv:
so-fleet: so-fleet:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-fleet:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-fleet:{{ VERSION }}
- hostname: so-fleet - hostname: so-fleet
- port_bindings: - port_bindings:
- 0.0.0.0:8080:8080 - 0.0.0.0:8080:8080

8
salt/hive/init.sls
View File

@@ -1,5 +1,5 @@
{% set MASTERIP = salt['pillar.get']('master:mainip', '') %} {% set MASTERIP = salt['pillar.get']('master:mainip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
hiveconfdir: hiveconfdir:
file.directory: file.directory:
@@ -57,7 +57,7 @@ hiveesdata:
so-thehive-es: so-thehive-es:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive-es:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-thehive-es:{{ VERSION }}
- hostname: so-thehive-es - hostname: so-thehive-es
- name: so-thehive-es - name: so-thehive-es
- user: 939 - user: 939
@@ -85,7 +85,7 @@ so-thehive-es:
# Install Cortex # Install Cortex
so-cortex: so-cortex:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive-cortex:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-thehive-cortex:{{ VERSION }}
- hostname: so-cortex - hostname: so-cortex
- name: so-cortex - name: so-cortex
- user: 939 - user: 939
@@ -102,7 +102,7 @@ cortexscript:
so-thehive: so-thehive:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-thehive:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-thehive:{{ VERSION }}
- environment: - environment:
- ELASTICSEARCH_HOST={{ MASTERIP }} - ELASTICSEARCH_HOST={{ MASTERIP }}
- hostname: so-thehive - hostname: so-thehive

4
salt/idstools/init.sls
View File

@@ -12,7 +12,7 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# IDSTools Setup # IDSTools Setup
idstoolsdir: idstoolsdir:
@@ -64,7 +64,7 @@ ruleslink:
so-idstools: so-idstools:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-idstools:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-idstools:{{ VERSION }}
- hostname: so-idstools - hostname: so-idstools
- user: socore - user: socore
- binds: - binds:

10
salt/kibana/init.sls
View File

@@ -1,5 +1,11 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
# Add ES Group # Add ES Group
kibanasearchgroup: kibanasearchgroup:
@@ -56,7 +62,7 @@ synckibanacustom:
# Start the kibana docker # Start the kibana docker
so-kibana: so-kibana:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-kibana:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-kibana:{{ VERSION }}{{ FEATURES }}
- hostname: kibana - hostname: kibana
- user: kibana - user: kibana
- environment: - environment:

11
salt/logstash/init.sls
View File

@@ -12,8 +12,15 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% set FEATURES = salt['pillar.get']('elastic:features', False) %}
{% if FEATURES %}
{% set FEATURES = "-features" %}
{% else %}
{% set FEATURES = '' %}
{% endif %}
# Logstash Section - Decide which pillar to use # Logstash Section - Decide which pillar to use
{% if grains['role'] == 'so-sensor' %} {% if grains['role'] == 'so-sensor' %}
@@ -200,7 +207,7 @@ lslogdir:
so-logstash: so-logstash:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-logstash:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-logstash:{{ VERSION }}{{ FEATURES }}
- hostname: so-logstash - hostname: so-logstash
- name: so-logstash - name: so-logstash
- user: logstash - user: logstash

4
salt/master/init.sls
View File

@@ -12,7 +12,7 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% set masterproxy = salt['pillar.get']('static:masterupdate', '0') %} {% set masterproxy = salt['pillar.get']('static:masterupdate', '0') %}
@@ -59,7 +59,7 @@ acngcopyconf:
# Install the apt-cacher-ng container # Install the apt-cacher-ng container
so-aptcacherng: so-aptcacherng:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-acng:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-acng:{{ VERSION }}
- hostname: so-acng - hostname: so-acng
- port_bindings: - port_bindings:
- 0.0.0.0:3142:3142 - 0.0.0.0:3142:3142

4
salt/mysql/init.sls
View File

@@ -1,7 +1,7 @@
{%- set MYSQLPASS = salt['pillar.get']('auth:mysql', 'iwonttellyou') %} {%- set MYSQLPASS = salt['pillar.get']('auth:mysql', 'iwonttellyou') %}
{%- set FLEETPASS = salt['pillar.get']('auth:fleet', 'bazinga') %} {%- set FLEETPASS = salt['pillar.get']('auth:fleet', 'bazinga') %}
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') %} {%- set MASTERIP = salt['pillar.get']('static:masterip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# MySQL Setup # MySQL Setup
mysqlpkgs: mysqlpkgs:
@@ -52,7 +52,7 @@ mysqldatadir:
so-mysql: so-mysql:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-mysql:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-mysql:{{ VERSION }}
- hostname: so-mysql - hostname: so-mysql
- user: socore - user: socore
- port_bindings: - port_bindings:

4
salt/pcap/init.sls
View File

@@ -12,7 +12,7 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# PCAP Section # PCAP Section
@@ -130,7 +130,7 @@ stenolog:
so-steno: so-steno:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-steno:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-steno:{{ VERSION }}
- network_mode: host - network_mode: host
- privileged: True - privileged: True
- port_bindings: - port_bindings:

6
salt/playbook/init.sls
View File

@@ -1,5 +1,5 @@
{% set MASTERIP = salt['pillar.get']('master:mainip', '') %} {% set MASTERIP = salt['pillar.get']('master:mainip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
playbookdb: playbookdb:
@@ -28,7 +28,7 @@ navigatorconfig:
so-playbook: so-playbook:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-playbook:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-playbook:{{ VERSION }}
- hostname: playbook - hostname: playbook
- name: so-playbook - name: so-playbook
- binds: - binds:
@@ -38,7 +38,7 @@ so-playbook:
so-navigator: so-navigator:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-navigator:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-navigator:{{ VERSION }}
- hostname: navigator - hostname: navigator
- name: so-navigator - name: so-navigator
- binds: - binds:

4
salt/redis/init.sls
View File

@@ -13,7 +13,7 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set lsaccessip = salt['pillar.get']('master:lsaccessip', '') %} {% set lsaccessip = salt['pillar.get']('master:lsaccessip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# Redis Setup # Redis Setup
@@ -48,7 +48,7 @@ redisconfsync:
so-redis: so-redis:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-redis:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-redis:{{ VERSION }}
- hostname: so-redis - hostname: so-redis
- user: socore - user: socore
- port_bindings: - port_bindings:

4
salt/sensoroni/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
sensoronidir: sensoronidir:
@@ -32,7 +32,7 @@ sensoronisync:
so-sensoroni: so-sensoroni:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-sensoroni:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-sensoroni:{{ VERSION }}
- hostname: sensoroni - hostname: sensoroni
- name: so-sensoroni - name: so-sensoroni
- binds: - binds:

4
salt/soctopus/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
soctopusdir: soctopusdir:
@@ -49,7 +49,7 @@ navigatordefaultlayer:
so-soctopus: so-soctopus:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-soctopus:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-soctopus:{{ VERSION }}
- hostname: soctopus - hostname: soctopus
- name: so-soctopus - name: so-soctopus
- binds: - binds:

4
salt/suricata/init.sls
View File

@@ -15,7 +15,7 @@
{% set interface = salt['pillar.get']('sensor:interface', 'bond0') %} {% set interface = salt['pillar.get']('sensor:interface', 'bond0') %}
{% set BROVER = salt['pillar.get']('static:broversion', '') %} {% set BROVER = salt['pillar.get']('static:broversion', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# Suricata # Suricata
@@ -82,7 +82,7 @@ surithresholding:
so-suricata: so-suricata:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-suricata:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-suricata:{{ VERSION }}
- privileged: True - privileged: True
- environment: - environment:
- INTERFACE={{ interface }} - INTERFACE={{ interface }}

4
salt/tcpreplay/init.sls
View File

@@ -1,11 +1,11 @@
{% if grains['role'] == 'so-sensor' or grains['role'] == 'so-eval' %} {% if grains['role'] == 'so-sensor' or grains['role'] == 'so-eval' %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
so-tcpreplay: so-tcpreplay:
docker_container.running: docker_container.running:
- network_mode: "host" - network_mode: "host"
- image: {{ MASTER }}:5000/soshybridhunter/so-tcpreplay:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-tcpreplay:{{ VERSION }}
- name: so-tcpreplay - name: so-tcpreplay
- user: root - user: root
- interactive: True - interactive: True

4
salt/wazuh/init.sls
View File

@@ -1,5 +1,5 @@
{%- set HOSTNAME = salt['grains.get']('host', '') %} {%- set HOSTNAME = salt['grains.get']('host', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# Add ossec group # Add ossec group
ossecgroup: ossecgroup:
@@ -74,7 +74,7 @@ wazuhmgrwhitelist:
so-wazuh: so-wazuh:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-wazuh:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-wazuh:{{ VERSION }}
- hostname: {{HOSTNAME}}-wazuh-manager - hostname: {{HOSTNAME}}-wazuh-manager
- name: so-wazuh - name: so-wazuh
- detach: True - detach: True

4
salt/zeek/init.sls
View File

@@ -1,4 +1,4 @@
{% set VERSION = salt['pillar.get']('static:soversion', '1.1.4') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
# Zeek Salt State # Zeek Salt State
# Add Zeek group # Add Zeek group
@@ -100,7 +100,7 @@ localzeeksync:
so-zeek: so-zeek:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-zeek:HH{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-zeek:{{ VERSION }}
- privileged: True - privileged: True
- binds: - binds:
- /nsm/zeek/logs:/nsm/zeek/logs:rw - /nsm/zeek/logs:/nsm/zeek/logs:rw

4
setup/functions.sh
View File

@@ -714,7 +714,7 @@ master_static() {
touch /opt/so/saltstack/pillar/static.sls touch /opt/so/saltstack/pillar/static.sls
echo "static:" > /opt/so/saltstack/pillar/static.sls echo "static:" > /opt/so/saltstack/pillar/static.sls
echo " soversion: 1.1.4" >> /opt/so/saltstack/pillar/static.sls echo " soversion: HH1.1.4" >> /opt/so/saltstack/pillar/static.sls
echo " hnmaster: $HNMASTER" >> /opt/so/saltstack/pillar/static.sls echo " hnmaster: $HNMASTER" >> /opt/so/saltstack/pillar/static.sls
echo " ntpserver: $NTPSERVER" >> /opt/so/saltstack/pillar/static.sls echo " ntpserver: $NTPSERVER" >> /opt/so/saltstack/pillar/static.sls
echo " proxy: $PROXY" >> /opt/so/saltstack/pillar/static.sls echo " proxy: $PROXY" >> /opt/so/saltstack/pillar/static.sls
@@ -732,6 +732,8 @@ master_static() {
echo " cortexorguserkey: $CORTEXORGUSERKEY" >> /opt/so/saltstack/pillar/static.sls echo " cortexorguserkey: $CORTEXORGUSERKEY" >> /opt/so/saltstack/pillar/static.sls
echo " fleetsetup: 0" >> /opt/so/saltstack/pillar/static.sls echo " fleetsetup: 0" >> /opt/so/saltstack/pillar/static.sls
echo " sensoronikey: $SENSORONIKEY" >> /opt/so/saltstack/pillar/static.sls echo " sensoronikey: $SENSORONIKEY" >> /opt/so/saltstack/pillar/static.sls
echo "elastic:" >> /opt/so/saltstack/pillar/static.sls
echo " features: False" >> /opt/so/saltstack/pillar/static.sls
if [[ $MASTERUPDATES == 'MASTER' ]]; then if [[ $MASTERUPDATES == 'MASTER' ]]; then
echo " masterupdate: 1" >> /opt/so/saltstack/pillar/static.sls echo " masterupdate: 1" >> /opt/so/saltstack/pillar/static.sls
else else