CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6438 from Security-Onion-Solutions/hf/soc_append2.3.90

Browse Source 
hf/soc append2.3.90
This commit is contained in:
Mike Reeves
2021-12-02 15:10:51 -05:00
committed by GitHub
parent 946673dc3b 8d667795a7
commit 8448778ecd
1 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
salt/common/tools/sbin/soup
View File

@@ -599,18 +599,33 @@ up_to_2.3.80() {
up_to_2.3.90() {
for i in manager managersearch eval standalone; do
echo "Checking for compgen match of /opt/so/saltstack/local/pillar/minions/*_$i.sls"
if compgen -G "/opt/so/saltstack/local/pillar/minions/*_$i.sls"; then
echo "soc:" >> /opt/so/saltstack/local/pillar/minions/*_$i.sls
sed -i "/^soc:/a \\ es_index_patterns: '*:so-*,*:endgame-*'" /opt/so/saltstack/local/pillar/minions/*_$i.sls
echo "Found compgen match for /opt/so/saltstack/local/pillar/minions/*_$i.sls"
for f in $(compgen -G "/opt/so/saltstack/local/pillar/minions/*_$i.sls"); do
if grep -qozP "^soc:\n.*es_index_patterns: '\*:so-\*,\*:endgame-\*'" "$f"; then
echo "soc:es_index_patterns already present in $f"
else
echo "Appending soc pillar data to $f"
echo "soc:" >> "$f"
sed -i "/^soc:/a \\ es_index_patterns: '*:so-*,*:endgame-*'" "$f"
fi
done
fi
done
# Create Endgame Hostgroup
so-firewall addhostgroup endgame
echo "Adding endgame hostgroup with so-firewall"
if so-firewall addhostgroup endgame 2>&1 | grep -q 'Already exists'; then
echo 'endgame hostgroup already exists'
else
echo 'endgame hostgroup added'
fi
# Force influx to generate a new cert
mv /etc/pki/influxdb.crt /etc/pki/influxdb.crt.2390upgrade
mv /etc/pki/influxdb.key /etc/pki/influxdb.key.2390upgrade
echo "Moving influxdb.crt and influxdb.key to generate new certs"
mv -vf /etc/pki/influxdb.crt /etc/pki/influxdb.crt.2390upgrade
mv -vf /etc/pki/influxdb.key /etc/pki/influxdb.key.2390upgrade
# remove old common ingest pipeline in default
rm -vf /opt/so/saltstack/default/salt/elasticsearch/files/ingest/common