CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #316 from Security-Onion-Solutions/bugfix/wazuhpath

Browse Source 
Fix Wazuh paths for logstash/fb
This commit is contained in:
Mike Reeves
2020-02-07 08:54:44 -05:00
committed by GitHub
parent a77f44cf29 bf6101fc30
commit 7fc0a09abf
6 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/filebeat/init.sls
View File

@@ -57,8 +57,8 @@ so-filebeat:
- /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro - /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
- /nsm/zeek:/nsm/zeek:ro - /nsm/zeek:/nsm/zeek:ro
- /opt/so/log/suricata:/suricata:ro - /opt/so/log/suricata:/suricata:ro
- /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro - /opt/so/log/wazuh/logs/alerts:/wazuh/alerts:ro
- /opt/so/wazuh/logs/archives/:/wazuh/archives:ro - /opt/so/log/wazuh/logs/archives:/wazuh/archives:ro
- /opt/so/log/fleet/:/osquery/logs:ro - /opt/so/log/fleet/:/osquery/logs:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro - /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro - /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro

3
salt/logstash/conf/pipelines/eval/templates/9000_output_bro.conf
View File

@@ -1,5 +1,6 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- set NAME = grains.host -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %} {%- endif %}
@@ -12,7 +13,7 @@
filter { filter {
if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] { if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
mutate { mutate {
##add_tag => [ "conf_file_9000"] add_field => { "sensor_name" => "{{ NAME }}" }
} }
} }
} }

3
salt/logstash/conf/pipelines/eval/templates/9400_output_suricata.conf
View File

@@ -1,5 +1,6 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- set NAME = grains.host -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %} {%- endif %}
@@ -11,7 +12,7 @@
filter { filter {
if [event_type] == "suricata" and "test_data" not in [tags] { if [event_type] == "suricata" and "test_data" not in [tags] {
mutate { mutate {
##add_tag => [ "conf_file_9400"] add_field => { "sensor_name" => "{{ NAME }}" }
} }
} }
} }

4
salt/logstash/conf/pipelines/helix/templates/9997_output_helix.conf
View File

@@ -1,4 +1,6 @@
{% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %} {% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
{% set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %}
{% set CBNAME = grains.host %}
filter { filter {
if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509$/ { if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509$/ {
@@ -34,6 +36,8 @@ filter {
copy => { "class" => "program"} copy => { "class" => "program"}
rename => { "source_port" => "srcport" } rename => { "source_port" => "srcport" }
rename => { "destination_port" => "dstport" } rename => { "destination_port" => "dstport" }
add_field => { "metacbid" => "{{ UNIQUEID }}"}
add_field => { "metacbname" => "{{ CBNAME }}"}
remove_field => ["source_ip", "destination_ip"] remove_field => ["source_ip", "destination_ip"]
remove_field => ["sensorname", "sensor_name", "service", "source", "tags", "syslog-host"] remove_field => ["sensorname", "sensor_name", "service", "source", "tags", "syslog-host"]
remove_field => ["sensor_name", "source_ips", "ips", "destination_ips", "syslog-priority", "syslog-file_name", "syslog-facility"] remove_field => ["sensor_name", "source_ips", "ips", "destination_ips", "syslog-priority", "syslog-file_name", "syslog-facility"]

4
salt/logstash/init.sls
View File

@@ -241,8 +241,8 @@ so-logstash:
{%- if grains['role'] == 'so-eval' %} {%- if grains['role'] == 'so-eval' %}
- /nsm/zeek:/nsm/zeek:ro - /nsm/zeek:/nsm/zeek:ro
- /opt/so/log/suricata:/suricata:ro - /opt/so/log/suricata:/suricata:ro
- /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro - /opt/so/log/wazuh/logs/alerts:/wazuh/alerts:ro
- /opt/so/wazuh/logs/archives/:/wazuh/archives:ro - /opt/so/log/wazuh/logs/archives:/wazuh/archives:ro
- /opt/so/log/fleet/:/osquery/logs:ro - /opt/so/log/fleet/:/osquery/logs:ro
- /opt/so/log/strelka:/strelka:ro - /opt/so/log/strelka:/strelka:ro
{%- endif %} {%- endif %}

3
salt/wazuh/init.sls
View File

@@ -95,7 +95,8 @@ so-wazuh:
- 0.0.0.0:1514:1514/tcp - 0.0.0.0:1514:1514/tcp
- 0.0.0.0:55000:55000 - 0.0.0.0:55000:55000
- binds: - binds:
- /opt/so/conf/wazuh/:/var/ossec/data/:rw - /opt/so/conf/wazuh/etc:/var/ossec/data/etc:rw
- /opt/so/log/wazuh:/var/ossec/data/logs:rw
# Register the agent # Register the agent
registertheagent: registertheagent: