Merge branch 'dev' into feature/setup-refactor

# Conflicts: # README.md # VERSION # pillar/top.sls # salt/common/grafana/grafana_dashboards/eval/eval.json # salt/common/init.sls # salt/common/tools/sbin/so-status # salt/curator/init.sls # salt/elastalert/init.sls # salt/elasticsearch/init.sls # salt/filebeat/init.sls # salt/fleet/files/scripts/so-fleet-setup # salt/fleet/init.sls # salt/grafana/dashboards/sensor_nodes/sensor.json # salt/hive/init.sls # salt/idstools/init.sls # salt/kibana/bin/so-kibana-config-load # salt/logstash/init.sls # salt/master/init.sls # salt/mysql/init.sls # salt/nginx/etc/index.html # salt/pcap/init.sls # salt/playbook/init.sls # salt/reactor/fleet.sls # salt/redis/init.sls # salt/sensoroni/init.sls # salt/soctopus/init.sls # salt/strelka/init.sls # salt/suricata/init.sls # salt/tcpreplay/init.sls # salt/wazuh/init.sls # salt/zeek/init.sls # setup/so-functions # setup/so-setup # setup/so-whiptail
2026-02-20 14:05:26 +01:00 · 2020-05-04 10:35:53 -04:00
parent 26e40f433b 285d74767d
commit 714cd522cb
100 changed files with 850 additions and 4627 deletions
--- a/pillar/masters/example.sls
+++ b/pillar/masters/example.sls
@@ -1,10 +0,0 @@
-# Example Pillar file for a master
-master:
-  esaccessip: 127.0.0.1
-  esheap: CHANGEME
-  esclustername: {{ grains.host }}
-  freq: 0
-  domainstats: 0
-  lsheap: 1500m
-  lsaccessip: 127.0.0.1
-  elastalert: 1
--- a/pillar/nodes/example.sls
+++ b/pillar/nodes/example.sls
@@ -1,5 +0,0 @@
-# Example Pillar file for a sensor
-node:
-  ls_heapsize: CHANGEME
-  es_heapsize: CHANGEME
-  node_type: CHANGEME
--- a/pillar/top.sls
+++ b/pillar/top.sls
@@ -1,4 +1,11 @@
 base:
+  '*':
+    - patch.needs_restarting
+
+  '*_eval or *_helix or *_heavynode or *_sensor':
+    - match: compound
+    - zeek
+
  '*_mastersearch or *_heavynode':
    - match: compound
    - logstash
@@ -66,7 +73,3 @@ base:
    - logstash
    - logstash.search
    - minions.{{ grains.id }}
-
-  '*':
-    - patch.needs_restarting
-    - docker.config
--- a/pillar/zeek/init.sls
+++ b/pillar/zeek/init.sls
@@ -0,0 +1,55 @@
+zeek:
+  zeekctl:
+    MailTo: root@localhost
+    MailConnectionSummary: 1
+    MinDiskSpace: 5
+    MailHostUpDown: 1
+    LogRotationInterval: 3600
+    LogExpireInterval: 0
+    StatsLogEnable: 1
+    StatsLogExpireInterval: 0
+    StatusCmdShowAll: 0
+    CrashExpireInterval: 0
+    SitePolicyScripts: local.zeek
+    LogDir: /nsm/zeek/logs
+    SpoolDir: /nsm/zeek/spool
+    CfgDir: /opt/zeek/etc
+    CompressLogs: 1
+  local:
+    '@load':
+      - misc/loaded-scripts
+      - tuning/defaults
+      - misc/capture-loss
+      - misc/stats
+      - frameworks/software/vulnerable
+      - frameworks/software/version-changes
+      - protocols/ftp/software
+      - protocols/smtp/software
+      - protocols/ssh/software
+      - protocols/http/software
+      - protocols/dns/detect-external-names
+      - protocols/ftp/detect
+      - protocols/conn/known-hosts
+      - protocols/conn/known-services
+      - protocols/ssl/known-certs
+      - protocols/ssl/validate-certs
+      - protocols/ssl/log-hostcerts-only
+      - protocols/ssh/geo-data
+      - protocols/ssh/detect-bruteforcing
+      - protocols/ssh/interesting-hostnames
+      - protocols/http/detect-sqli
+      - frameworks/files/hash-all-files
+      - frameworks/files/detect-MHR
+      - policy/frameworks/notice/extend-email/hostnames
+      - ja3
+      - hassh
+      - intel
+      - cve-2020-0601
+      - securityonion/bpfconf
+      - securityonion/communityid
+      - securityonion/file-extraction
+    '@load-sigs':
+      - frameworks/signatures/detect-windows-shells
+    redef:
+      - LogAscii::use_json = T;
+      - LogAscii::json_timestamps = JSON::TS_ISO8601;