CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix Wazuh paths for logstash/fb

Browse Source
This commit is contained in:
Mike Reeves
2020-02-07 08:52:09 -05:00
parent afdb2f93f0
commit 6ceb127c46
6 changed files with 30 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/filebeat/init.sls
View File

@@ -57,8 +57,8 @@ so-filebeat:
- /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
- /nsm/zeek:/nsm/zeek:ro
- /opt/so/log/suricata:/suricata:ro
- /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro
- /opt/so/wazuh/logs/archives/:/wazuh/archives:ro
- /opt/so/log/wazuh/logs/alerts:/wazuh/alerts:ro
- /opt/so/log/wazuh/logs/archives:/wazuh/archives:ro
- /opt/so/log/fleet/:/osquery/logs:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro

3
salt/logstash/conf/pipelines/eval/templates/9000_output_bro.conf
View File

@@ -1,5 +1,6 @@
{%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- set NAME = grains.host -%}
{%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
@@ -12,7 +13,7 @@
filter {
if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
mutate {
##add_tag => [ "conf_file_9000"]
add_field => { "sensor_name" => "{{ NAME }}" }
}
}
}

3
salt/logstash/conf/pipelines/eval/templates/9400_output_suricata.conf
View File

@@ -1,5 +1,6 @@
{%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- set NAME = grains.host -%}
{%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
@@ -11,7 +12,7 @@
filter {
if [event_type] == "suricata" and "test_data" not in [tags] {
mutate {
##add_tag => [ "conf_file_9400"]
add_field => { "sensor_name" => "{{ NAME }}" }
}
}
}

4
salt/logstash/conf/pipelines/helix/templates/9997_output_helix.conf
View File

@@ -1,4 +1,6 @@
{% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
{% set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %}
{% set CBNAME = grains.host %}
filter {
if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509$/ {
@@ -34,6 +36,8 @@ filter {
copy => { "class" => "program"}
rename => { "source_port" => "srcport" }
rename => { "destination_port" => "dstport" }
add_field => { "metacbid" => "{{ UNIQUEID }}"}
add_field => { "metacbname" => "{{ CBNAME }}"}
remove_field => ["source_ip", "destination_ip"]
remove_field => ["sensorname", "sensor_name", "service", "source", "tags", "syslog-host"]
remove_field => ["sensor_name", "source_ips", "ips", "destination_ips", "syslog-priority", "syslog-file_name", "syslog-facility"]

4
salt/logstash/init.sls
View File

@@ -241,8 +241,8 @@ so-logstash:
{%- if grains['role'] == 'so-eval' %}
- /nsm/zeek:/nsm/zeek:ro
- /opt/so/log/suricata:/suricata:ro
- /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro
- /opt/so/wazuh/logs/archives/:/wazuh/archives:ro
- /opt/so/log/wazuh/logs/alerts:/wazuh/alerts:ro
- /opt/so/log/wazuh/logs/archives:/wazuh/archives:ro
- /opt/so/log/fleet/:/osquery/logs:ro
- /opt/so/log/strelka:/strelka:ro
{%- endif %}

22
salt/wazuh/init.sls
View File

@@ -12,7 +12,7 @@ ossecm:
user.present:
- uid: 943
- gid: 945
- home: /opt/so/wazuh
- home: /opt/so/conf/wazuh
- createhome: False
- allow_uid_change: True
- allow_gid_change: True
@@ -22,7 +22,7 @@ ossecr:
user.present:
- uid: 944
- gid: 945
- home: /opt/so/wazuh
- home: /opt/so/conf/wazuh
- createhome: False
- allow_uid_change: True
- allow_gid_change: True
@@ -32,11 +32,23 @@ ossec:
user.present:
- uid: 945
- gid: 945
- home: /opt/so/wazuh
- home: /opt/so/conf/wazuh
- createhome: False
- allow_uid_change: True
- allow_gid_change: True
wazuhdir:
file.directory:
- name: /opt/so/conf/wazuh
- user: 945
- group: 945
wazuhlogdir:
file.directory:
- name: /opt/so/log/wazuh
- user: 945
- group: 945
# Add wazuh agent
wazuhpkgs:
pkg.installed:
@@ -83,7 +95,9 @@ so-wazuh:
- 0.0.0.0:1514:1514/tcp
- 0.0.0.0:55000:55000
- binds:
- /opt/so/wazuh/:/var/ossec/data/:rw
- /opt/so/conf/wazuh/etc:/var/ossec/data/etc:rw
- /opt/so/log/wazuh:/var/ossec/data/logs:rw
# Register the agent
registertheagent: