From b952728b2c340e40870c2282fa1cd269a24a72c5 Mon Sep 17 00:00:00 2001 From: DefensiveDepth Date: Mon, 26 Aug 2024 15:57:21 -0400 Subject: [PATCH 1/2] Fix policy load --- .../so-elastic-fleet-integration-policy-elastic-fleet-server | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticfleet/tools/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server b/salt/elasticfleet/tools/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server index c304d5ba5..8f7c8b8b4 100644 --- a/salt/elasticfleet/tools/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server +++ b/salt/elasticfleet/tools/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server @@ -17,7 +17,7 @@ for POLICYNAME in $POLICY; do printf "\nUpdating Policy: $POLICYNAME\n" # First get the Integration ID - elastic_fleet_integration_check "$POLICYNAME" "/opt/so/conf/elastic-fleet/integrations/fleet-server/fleet-server.json" + INTEGRATION_ID=$(/usr/sbin/so-elastic-fleet-agent-policy-view "$POLICYNAME" | jq -r '.item.package_policies[] | select(.package.name == "fleet_server") | .id') # Modify the default integration policy to update the policy_id and an with the correct naming UPDATED_INTEGRATION_POLICY=$(jq --arg policy_id "$POLICYNAME" --arg name "fleet_server-$POLICYNAME" ' From 726df310eebfa9e33c3bc6b75011d5557b1c67d0 Mon Sep 17 00:00:00 2001 From: DefensiveDepth Date: Mon, 26 Aug 2024 16:15:56 -0400 Subject: [PATCH 2/2] Add context --- salt/manager/tools/sbin/soup | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index e634e0489..c74edf1eb 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -675,6 +675,7 @@ up_to_2.4.90() { so-yaml.py remove /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.password so-yaml.py add /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.config.password "$kafkatrimpass" so-yaml.py add /opt/so/saltstack/local/pillar/kafka/soc_kafka.sls kafka.config.trustpass "$kafkatrust" + echo "If the Detection index exists, update the refresh_interval" so-elasticsearch-query so-detection*/_settings -X PUT -d '{"index":{"refresh_interval":"1s"}}' INSTALLEDVERSION=2.4.90