CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

logging changes. ensure salt master has pillarWatch engine

Browse Source
This commit is contained in:
m0duspwnens
2024-04-19 09:32:32 -04:00
parent 1f6eb9cdc3
commit 6c5e0579cf
3 changed files with 30 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
salt/salt/engines/master/pillarWatch.py
View File

@@ -7,13 +7,14 @@
import logging
import re
import salt.client
log = logging.getLogger(__name__)
local = salt.client.LocalClient()
# will need this in future versions of this engine
#import salt.client
#local = salt.client.LocalClient()
def start(fpa, interval=10):
log.info("pillarWatch engine: checking watched pillars for changes")
log.info("pillarWatch engine: ##### checking watched pillars for changes #####")
# try to open the file that stores the previous runs data
# if the file doesn't exist, create a blank one
@@ -41,7 +42,7 @@ def start(fpa, interval=10):
# this var is used to track how many times the pattern has been found in the pillar file so that we can access the proper index later
patternFound = 0
with open(pillarFile, "r") as file:
log.info("pillarWatch engine: checking file: %s" % pillarFile)
log.debug("pillarWatch engine: checking file: %s" % pillarFile)
for line in file:
log.trace("pillarWatch engine: inspecting line: %s in file: %s" % (line, file))
log.trace("pillarWatch engine: looking for: %s" % patterns[patternFound])
@@ -50,7 +51,7 @@ def start(fpa, interval=10):
# for pipeline. once pipeline is found, it will record the value
if re.search('^' + patterns[patternFound] + ':', line.strip()):
# strip the newline because it makes the logs u-g-l-y
log.info("pillarWatch engine: found: %s" % line.strip('\n'))
log.debug("pillarWatch engine: found: %s" % line.strip('\n'))
patternFound += 1
# we have found the final key in the pillar that we are looking for, get the previous value then the current value
if patternFound == len(patterns):
@@ -62,8 +63,8 @@ def start(fpa, interval=10):
if pillar in l:
previousPillarValue = str(l.split(":")[1].strip())
currentPillarValue = str(line.split(":")[1]).strip()
log.info("pillarWatch engine: %s currentPillarValue: %s" % (pillar, currentPillarValue))
log.info("pillarWatch engine: %s previousPillarValue: %s" % (pillar, previousPillarValue))
log.debug("pillarWatch engine: %s currentPillarValue: %s" % (pillar, currentPillarValue))
log.debug("pillarWatch engine: %s previousPillarValue: %s" % (pillar, previousPillarValue))
# if the pillar we are checking for changes has been defined in the dataFile,
# replace the previousPillarValue with the currentPillarValue. if it isn't in there, append it.
if pillar in df:
@@ -78,9 +79,7 @@ def start(fpa, interval=10):
if patternFound == len(patterns):
break
# if the pillar value changed, then we find what actions we should take
log.info("pillarWatch engine: checking if currentPillarValue != previousPillarValue")
log.info("pillarWatch engine: %s currentPillarValue: %s" % (pillar, currentPillarValue))
log.info("pillarWatch engine: %s previousPillarValue: %s" % (pillar, previousPillarValue))
log.debug("pillarWatch engine: checking if currentPillarValue != previousPillarValue")
if currentPillarValue != previousPillarValue:
log.info("pillarWatch engine: currentPillarValue != previousPillarValue: %s != %s" % (currentPillarValue, previousPillarValue))
# check if the previous pillar value is defined in the pillar from -> to actions
@@ -108,17 +107,17 @@ def start(fpa, interval=10):
# a match for the previous pillar wasn't defined in the action in either the form of a direct match or wildcard
else:
ACTIONS=['NO DEFINED ACTION FOR US TO TAKE']
log.info("pillarWatch engine: all defined actions: %s" % actions['from'])
log.info("pillarWatch engine: ACTIONS: %s chosen based on previousPillarValue: %s switching to currentPillarValue: %s" % (ACTIONS, previousPillarValue, currentPillarValue))
log.debug("pillarWatch engine: all defined actions: %s" % actions['from'])
log.debug("pillarWatch engine: ACTIONS: %s chosen based on previousPillarValue: %s switching to currentPillarValue: %s" % (ACTIONS, previousPillarValue, currentPillarValue))
for action in ACTIONS:
log.info("pillarWatch engine: action: %s" % action)
if action != 'NO DEFINED ACTION FOR US TO TAKE':
for saltModule, args in action.items():
log.info("pillarWatch engine: saltModule: %s" % saltModule)
log.info("pillarWatch engine: args: %s" % args)
__salt__[saltModule](**args)
#actionReturn = __salt__[saltModule](**args)
#log.info("pillarWatch engine: actionReturn: %s" % actionReturn)
log.debug("pillarWatch engine: saltModule: %s" % saltModule)
log.debug("pillarWatch engine: args: %s" % args)
#__salt__[saltModule](**args)
actionReturn = __salt__[saltModule](**args)
log.info("pillarWatch engine: actionReturn: %s" % actionReturn)
dataFile.seek(0)
dataFile.write(df)

16
salt/salt/files/engines.conf
View File

@@ -18,19 +18,19 @@ engines:
KAFKA:
- cmd.run:
cmd: /usr/sbin/so-yaml.py replace /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.enabled True
- cmd.run:
cmd: salt-call saltutil.kill_all_jobs
- cmd.run:
cmd: salt-call state.highstate &
# - cmd.run:
# cmd: salt-call saltutil.kill_all_jobs
# - cmd.run:
# cmd: salt-call state.highstate &
KAFKA:
to:
'*':
- cmd.run:
cmd: /usr/sbin/so-yaml.py replace /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.enabled False
- cmd.run:
cmd: salt-call saltutil.kill_all_jobs
- cmd.run:
cmd: salt-call state.highstate &
# - cmd.run:
# cmd: salt-call saltutil.kill_all_jobs
# - cmd.run:
# cmd: salt-call state.highstate &
- files:
- /opt/so/saltstack/local/pillar/idstools/soc_idstools.sls
- /opt/so/saltstack/local/pillar/idstools/adv_idstools.sls

5
salt/salt/master.sls
View File

@@ -27,6 +27,11 @@ checkmine_engine:
- source: salt://salt/engines/master/checkmine.py
- makedirs: True
pillarWatch_engine:
file.managed:
- name: /etc/salt/engines/pillarWatch.py
- source: salt://salt/engines/master/pillarWatch.py
engines_config:
file.managed:
- name: /etc/salt/master.d/engines.conf