CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-09-17 13:19:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

drop remapped sentinel_one_cloud_funnel.login index template

Browse Source
This commit is contained in:
reyesj2
2026-09-08 08:30:00 -05:00
parent a74046fc24
commit 721b1d6207
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/common/tools/sbin/so-common
+13
View File
@@ -418,6 +418,19 @@ is_single_node_grid() {
grep "role: so-" /etc/salt/grains | grep -E "eval|standalone|import" &> /dev/null
}
remove_elasticsearch_index_template() {
local template_name=$1
local reason=${2:-"Removing index template for upgrade"}
# check if template exists
if so-elasticsearch-query "_index_template/$template_name" --fail --retry 3 --retry-delay 5 >/dev/null 2>&1; then
echo "Removing Elasticsearch index template: $template_name ($reason)"
if ! so-elasticsearch-query "_index_template/$template_name" -XDELETE --fail --retry 3 --retry-delay 5; then
return 1
fi
fi
}
initialize_elasticsearch_indices() {
local index_names=$1
local default_entry=${2:-'{"@timestamp":"0"}'}
salt/manager/tools/sbin/soup
+6
View File
@@ -1050,6 +1050,12 @@ post_to_3.2.0() {
up_to_3.3.0() {
# download 9.4.5 elastic agent packages
determine_elastic_agent_upgrade
# remove existing (patched) elasticsearch index template to match integration naming change
if ! remove_elasticsearch_index_template "so-logs-sentinel_one_cloud_funnel.login" "sentinel_one_cloud_funnel.login changed to sentinel_one_cloud_funnel.logins"; then
FINAL_MESSAGE_QUEUE+=("WARNING: Unable to automatically remove the so-logs-sentinel_one_cloud_funnel.login index template. This step can be performed manually using the following command:")
FINAL_MESSAGE_QUEUE+=(" - sudo so-elasticsearch-query _index_template/so-logs-sentinel_one_cloud_funnel.login -XDELETE && so-checkin")
fi
INSTALLEDVERSION=3.3.0
}