CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10367 from Security-Onion-Solutions/2.4/integrationfix

Browse Source 
Update Integrations
This commit is contained in:
Josh Brower
2023-05-16 12:56:47 -04:00
committed by GitHub
parent 82fdee45aa 000507c366
commit 8101171c97
3 changed files with 39 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
salt/elasticfleet/files/integrations/endpoints-initial/system-endpoints.json
View File

@@ -1,11 +1,11 @@
{
"policy_id": "endpoints-initial",
"package": {
"name": "system",
"version": ""
},
"name": "system-endpoints",
"namespace": "default",
"policy_id": "endpoints-initial",
"inputs": {
"system-logfile": {
"enabled": true,
@@ -13,14 +13,9 @@
"system.auth": {
"enabled": true,
"vars": {
"ignore_older": "72h",
"paths": [
"/var/log/auth.log*",
"/var/log/secure*"
],
"preserve_original_event": false,
"tags": [
"system-auth"
]
}
},
@@ -30,47 +25,33 @@
"paths": [
"/var/log/messages*",
"/var/log/syslog*"
],
"tags": [],
"ignore_older": "72h"
]
}
}
}
},
"system-winlog": {
"enabled": true,
"vars": {
"preserve_original_event": false
},
"streams": {
"system.application": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
}
},
"system.security": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
}
},
"system.system": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
}
}
}
},
"system-system/metrics": {
"enabled": false
}
},
"system-system/metrics": {
"enabled": false
}
}
}

48
salt/elasticfleet/files/integrations/endpoints-initial/windows-endpoints.json
View File

@@ -1,11 +1,12 @@
{
"policy_id": "endpoints-initial",
"package": {
"name": "windows",
"version": ""
},
"name": "windows-endpoints",
"description": "",
"namespace": "default",
"policy_id": "endpoints-initial",
"inputs": {
"windows-winlog": {
"enabled": true,
@@ -13,47 +14,54 @@
"windows.forwarded": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": [
"forwarded"
]
],
"preserve_original_event": false
}
},
"windows.powershell": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"event_id": "400, 403, 600, 800",
"ignore_older": "72h",
"language": 0,
"tags": []
"tags": [],
"preserve_original_event": false
}
},
"windows.powershell_operational": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"event_id": "4103, 4104, 4105, 4106",
"ignore_older": "72h",
"language": 0,
"tags": []
"tags": [],
"preserve_original_event": false
}
},
"windows.sysmon_operational": {
"enabled": true,
"vars": {
"preserve_original_event": false,
"ignore_older": "72h",
"language": 0,
"tags": []
"tags": [],
"preserve_original_event": false
}
}
}
},
"windows-windows/metrics": {
"enabled": false
"enabled": false,
"streams": {
"windows.perfmon": {
"enabled": false,
"vars": {
"perfmon.group_measurements_by_instance": false,
"perfmon.ignore_non_existent_counters": false,
"perfmon.queries": "- object: 'Process'\n instance: [\"*\"]\n counters:\n - name: '% Processor Time'\n field: cpu_perc\n format: \"float\"\n - name: \"Working Set\"\n",
"period": "10s"
}
},
"windows.service": {
"enabled": false,
"vars": {
"period": "60s"
}
}
}
}
}
}

11
salt/elasticfleet/files/integrations/grid-nodes/system-grid-nodes.json
View File

@@ -1,11 +1,11 @@
{
"policy_id": "so-grid-nodes",
"package": {
"name": "system",
"version": ""
},
"name": "system-grid-nodes",
"namespace": "default",
"policy_id": "so-grid-nodes",
"inputs": {
"system-logfile": {
"enabled": true,
@@ -13,14 +13,9 @@
"system.auth": {
"enabled": true,
"vars": {
"ignore_older": "72h",
"paths": [
"/var/log/auth.log*",
"/var/log/secure*"
],
"preserve_original_event": false,
"tags": [
"system-auth"
]
}
},
@@ -30,9 +25,7 @@
"paths": [
"/var/log/messages*",
"/var/log/syslog*"
],
"tags": [],
"ignore_older": "72h"
]
}
}
}