CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion-saltstack into dev

Browse Source
This commit is contained in:
m0duspwnens
2020-03-18 10:45:53 -04:00
parent 4aba09c44e 0d3280feb7
commit 88acbc4d4d
6 changed files with 13 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/kibana/etc/config.json
View File

@@ -1,8 +1,9 @@
{ "attributes": { "attributes":
{ {
"defaultIndex": "*:logstash-*", "defaultIndex": "*:so-*",
"discover:sampleSize":"10", "discover:sampleSize":"100",
"dashboard:defaultDarkTheme":true, "dashboard:defaultDarkTheme":true,
"theme:darkMode":true,
"timepicker:timeDefaults":"{\n \"from\": \"now-24h\",\n \"to\": \"now\",\n \"mode\": \"quick\"\n}" "timepicker:timeDefaults":"{\n \"from\": \"now-24h\",\n \"to\": \"now\",\n \"mode\": \"quick\"\n}"
} }
} }

2
salt/kibana/etc/kibana.yml
View File

@@ -4,7 +4,7 @@
server.name: kibana server.name: kibana
server.host: "0" server.host: "0"
server.basePath: /kibana server.basePath: /kibana
elasticsearch.url: http://{{ ES }}:9200 elasticsearch.hosts: [ "http://{{ ES }}:9200" ]
#kibana.index: ".kibana" #kibana.index: ".kibana"
#elasticsearch.username: elastic #elasticsearch.username: elastic
#elasticsearch.password: changeme #elasticsearch.password: changeme

6
salt/logstash/pipelines/config/so/9600_output_ossec.conf.jinja
View File

@@ -21,9 +21,9 @@ output {
elasticsearch { elasticsearch {
pipeline => "%{event_type}" pipeline => "%{event_type}"
hosts => "{{ ES }}" hosts => "{{ ES }}"
index => "so-ossec-%{+YYYY.MM.dd}" index => "so-common-%{+YYYY.MM.dd}"
template_name => "so-ossec" template_name => "so-common"
template => "/so-ossec-template.json" template => "/so-common-template.json"
template_overwrite => true template_overwrite => true
} }
} }

6
salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja
View File

@@ -20,9 +20,9 @@ output {
if [event_type] =~ "strelka" { if [event_type] =~ "strelka" {
elasticsearch { elasticsearch {
hosts => "{{ ES }}" hosts => "{{ ES }}"
index => "so-strelka-%{+YYYY.MM.dd}" index => "so-common-%{+YYYY.MM.dd}"
template_name => "so-strelka" template_name => "so-common"
template => "/so-strelka-template.json" template => "/so-common-template.json"
template_overwrite => true template_overwrite => true
} }
} }

2
salt/logstash/pipelines/templates/so/so-common-template.json
View File

@@ -1,5 +1,5 @@
{ {
"index_patterns": ["so-ids-*", "so-firewall-*", "so-syslog-*", "so-zeek-*", "so-import-*", "so-ossec-*", "so-strelka", "so-beats-*"], "index_patterns": ["so-ids-*", "so-firewall-*", "so-syslog-*", "so-zeek-*", "so-import-*", "so-ossec-*", "so-strelka-*", "so-beats-*"],
"version":50001, "version":50001,
"order" : 10, "order" : 10,
"settings":{ "settings":{

4
setup/so-functions
View File

@@ -460,7 +460,7 @@ docker_registry() {
} }
docker_seed_registry() { docker_seed_registry() {
VERSION="HH1.1.4" VERSION="HH1.2.1"
if [ $INSTALLTYPE != 'HELIXSENSOR' ]; then if [ $INSTALLTYPE != 'HELIXSENSOR' ]; then
TRUSTED_CONTAINERS=( \ TRUSTED_CONTAINERS=( \
"so-acng:$VERSION" \ "so-acng:$VERSION" \
@@ -743,7 +743,7 @@ master_static() {
touch /opt/so/saltstack/pillar/static.sls touch /opt/so/saltstack/pillar/static.sls
echo "static:" > /opt/so/saltstack/pillar/static.sls echo "static:" > /opt/so/saltstack/pillar/static.sls
echo " soversion: HH1.1.4" >> /opt/so/saltstack/pillar/static.sls echo " soversion: HH1.2.1" >> /opt/so/saltstack/pillar/static.sls
echo " hnmaster: $HNMASTER" >> /opt/so/saltstack/pillar/static.sls echo " hnmaster: $HNMASTER" >> /opt/so/saltstack/pillar/static.sls
echo " ntpserver: $NTPSERVER" >> /opt/so/saltstack/pillar/static.sls echo " ntpserver: $NTPSERVER" >> /opt/so/saltstack/pillar/static.sls
echo " proxy: $PROXY" >> /opt/so/saltstack/pillar/static.sls echo " proxy: $PROXY" >> /opt/so/saltstack/pillar/static.sls