CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Split Sensoroni and Stenographer executables into separate images

Browse Source
This commit is contained in:
Jason Ertel
2020-06-21 08:33:09 -04:00
parent 6dbe83a77f
commit 76e3118bd3
2 changed files with 45 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/pcap/files/sensoroni.json
View File

@@ -12,6 +12,7 @@
"apiKey": "{{ SENSORONIKEY }}" "apiKey": "{{ SENSORONIKEY }}"
}, },
"stenoquery": { "stenoquery": {
"executablePath": "/opt/sensoroni/scripts/stenoquery.sh",
"pcapInputPath": "/nsm/pcap", "pcapInputPath": "/nsm/pcap",
"pcapOutputPath": "/nsm/pcapout" "pcapOutputPath": "/nsm/pcapout"
} }

59
salt/pcap/init.sls
View File

@@ -20,19 +20,28 @@
# PCAP Section # PCAP Section
# Create the logstash group
stenographergroup: stenographergroup:
group.present: group.present:
- name: stenographer - name: stenographer
- gid: 941 - gid: 941
# Add the logstash user for the jog4j settings
stenographer: stenographer:
user.present: user.present:
- uid: 941 - uid: 941
- gid: 941 - gid: 941
- home: /opt/so/conf/steno - home: /opt/so/conf/steno
sensoronigroup:
group.present:
- name: sensoroni
- gid: 948
sensoroni:
user.present:
- uid: 948
- gid: 948
- home: /opt/so/conf/steno
stenoconfdir: stenoconfdir:
file.directory: file.directory:
- name: /opt/so/conf/steno - name: /opt/so/conf/steno
@@ -58,8 +67,8 @@ stenoconf:
file.managed: file.managed:
- name: /opt/so/conf/steno/config - name: /opt/so/conf/steno/config
- source: salt://pcap/files/config - source: salt://pcap/files/config
- user: root - user: stenographer
- group: root - group: stenographer
- mode: 644 - mode: 644
- template: jinja - template: jinja
- defaults: - defaults:
@@ -67,10 +76,10 @@ stenoconf:
sensoroniagentconf: sensoroniagentconf:
file.managed: file.managed:
- name: /opt/so/conf/steno/sensoroni.json - name: /opt/so/conf/sensoroni/sensoroni.json
- source: salt://pcap/files/sensoroni.json - source: salt://pcap/files/sensoroni.json
- user: stenographer - user: sensoroni
- group: stenographer - group: sensoroni
- mode: 600 - mode: 600
- template: jinja - template: jinja
@@ -97,8 +106,8 @@ pcaptmpdir:
pcapoutdir: pcapoutdir:
file.directory: file.directory:
- name: /nsm/pcapout - name: /nsm/pcapout
- user: 941 - user: sensoroni
- group: 941 - group: sensoroni
- makedirs: True - makedirs: True
pcapindexdir: pcapindexdir:
@@ -115,23 +124,43 @@ stenolog:
- group: 941 - group: 941
- makedirs: True - makedirs: True
pcap_network:
docker_network.present
so-steno: so-steno:
docker_container.running: docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-steno:{{ VERSION }} - image: {{ MASTER }}:5000/soshybridhunter/so-steno:{{ VERSION }}
- network_mode: host - network_mode: host
- privileged: True - privileged: True
- port_bindings: - networks:
- 127.0.0.1:1234:1234 - pcap_network:
- aliases:
- steno
- require:
- docker_network: pcap_network
- binds: - binds:
- /opt/so/conf/steno/certs:/etc/stenographer/certs:rw - /opt/so/conf/steno/certs:/etc/stenographer/certs:rw
- /opt/so/conf/steno/config:/etc/stenographer/config:rw - /opt/so/conf/steno/config:/etc/stenographer/config:rw
- /nsm/pcap:/nsm/pcap:rw - /nsm/pcap:/nsm/pcap:rw
- /nsm/pcapindex:/nsm/pcapindex:rw - /nsm/pcapindex:/nsm/pcapindex:rw
- /nsm/pcaptmp:/tmp:rw - /nsm/pcaptmp:/tmp:rw
- /nsm/pcapout:/nsm/pcapout:rw
- /opt/so/log/stenographer:/var/log/stenographer:rw - /opt/so/log/stenographer:/var/log/stenographer:rw
- /opt/so/conf/steno/sensoroni.json:/opt/sensoroni/sensoroni.json:ro
- /opt/so/log/stenographer:/opt/sensoroni/logs:rw
- watch: - watch:
- file: /opt/so/conf/steno/config - file: /opt/so/conf/steno/config
- file: /opt/so/conf/steno/sensoroni.json
so-sensoroni:
docker_container.running:
- image: {{ MASTER }}:5000/soshybridhunter/so-soc:{{ VERSION }}
- networks:
- pcap_network:
- aliases:
- sensoroni
- require:
- docker_network: pcap_network
- binds:
- /opt/so/conf/steno/certs:/etc/stenographer/certs:rw
- /nsm/pcapout:/nsm/pcapout:rw
- /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro
- /opt/so/log/sensoroni:/opt/sensoroni/logs:rw
- watch:
- file: /opt/so/conf/sensoroni/sensoroni.json