Merge pull request #68 from defensivedepth/osquery

Osquery/Fleet initial enhancements

salt/filebeat/etc/filebeat.yml

@@ -2,6 +2,7 @@
 {%- set HOSTNAME = salt['grains.get']('host', '') %}
 {%- set BROVER = salt['pillar.get']('static:broversion', 'COMMUNITY') %}
 {%- set WAZUHENABLED = salt['pillar.get']('static:wazuh_enabled', '1') %}
+{%- set FLEETENABLED = salt['pillar.get']('static:fleet_enabled', '1') %}
 
 name: {{ HOSTNAME }}
 
@@ -61,6 +62,18 @@ filebeat.prospectors:
 
 {%- endif %}
 
+{%- if FLEETENABLED == '1' %}
+
+  - type: log
+    paths:
+      - /osquery/logs/result.log
+    fields:
+      type: osquery
+    fields_under_root: true
+    clean_removed: false
+    close_removed: false
+
+{%- endif %}
 #----------------------------- Logstash output ---------------------------------
 output.logstash:
   # Boolean flag to enable or disable the output module.

salt/filebeat/init.sls

@@ -63,6 +63,7 @@ so-filebeat:
       - /opt/so/log/suricata:/suricata:ro
       - /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro
       - /opt/so/wazuh/logs/archives/:/wazuh/archives:ro
+      - /opt/so/log/fleet/:/osquery/logs:ro
 {%- if grains['role'] == 'so-master' %}
       - /etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
       - /etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro

salt/logstash/files/custom/parsers/7100_osquery_wel.conf

@@ -0,0 +1,23 @@
+# Author: Josh Brower
+# Last Update: 12/28/2018
+# If log is tagged osquery and there is an eventid column, then cleanup and parse out the EventData column
+
+filter {
+  if "osquery" in [tags] and [osquery][columns][eventid] {
+
+	mutate {
+     gsub => ["[osquery][columns][data]", "\\x0A", ""]
+    }
+
+	json {
+      source => "[osquery][columns][data]"
+      target => "[osquery][columns][data]"
+     }
+
+ 	mutate {
+     merge => { "[osquery][columns]" => "[osquery][columns][data]" }
+     remove_field => ["[osquery][columns][data]"]
+  	}
+
+  }
+}

salt/logstash/files/custom/parsers/9100_output_osquery.conf

@@ -0,0 +1,19 @@
+{%- if grains['role'] == 'so-eval' -%}
+{%- set ES = salt['pillar.get']('master:mainip', '') -%}
+{%- else %}
+{%- set ES = salt['pillar.get']('node:mainip', '') -%}
+{%- endif %}
+# Author: Josh Brower
+# Last Update: 12/28/2018
+# Output to ES for osquery tagged logs
+
+
+output {
+  if "osquery" in [tags] {
+    elasticsearch {
+      hosts => "{{ ES }}"
+      index => "logstash-osquery-%{+YYYY.MM.dd}"
+      template => "/logstash-template.json"
+    }
+  }
+}

salt/logstash/files/dynamic/0006_input_beats.conf

@@ -25,5 +25,16 @@ filter {
       add_field => { "syslog-host_from" => "%{[beat][name]}" }
       remove_field => [ "beat", "prospector", "input", "offset" ]
     }
+    
+    if [type] == "osquery" {
+    mutate {
+      remove_tag => ["beat"]
+      add_tag => ["osquery"]
+        	}
+   json {
+    source => "message"
+    target => "osquery"
+        }
+    
   }
 }