CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #53 from weslambert/master

Browse Source 
Wazuh archive logs
This commit is contained in:
Mike Reeves
2018-12-12 16:33:48 -05:00
committed by GitHub
parent d12f49aa9d 41e9c4c7e0
commit 90d648cef1
3 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/filebeat/etc/filebeat.yml
View File

@@ -47,6 +47,16 @@ filebeat.prospectors:
fields_under_root: true fields_under_root: true
clean_removed: false clean_removed: false
close_removed: false close_removed: false
- type: log
paths:
- /wazuh/archives/archives.json
fields:
type: ossec_archive
fields_under_root: true
clean_removed: false
close_removed: false
{%- endif %} {%- endif %}
#----------------------------- Logstash output --------------------------------- #----------------------------- Logstash output ---------------------------------

1
salt/filebeat/init.sls
View File

@@ -62,6 +62,7 @@ so-filebeat:
- /nsm/bro:/nsm/bro:ro - /nsm/bro:/nsm/bro:ro
- /opt/so/log/suricata:/suricata:ro - /opt/so/log/suricata:/suricata:ro
- /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro - /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro
- /opt/so/wazuh/logs/archives/:/wazuh/archives:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro - /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro - /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro
- /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro - /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro

5
salt/logstash/files/dynamic/0006_input_beats.conf
View File

@@ -9,7 +9,7 @@ input {
} }
} }
filter { filter {
if [type] == "ids" { if [type] == "ids" or [type] =~ "bro" {
mutate { mutate {
rename => { "host" => "beat_host" } rename => { "host" => "beat_host" }
remove_tag => ["beat"] remove_tag => ["beat"]
@@ -17,11 +17,10 @@ filter {
add_field => { "syslog-host_from" => "%{[beat][name]}" } add_field => { "syslog-host_from" => "%{[beat][name]}" }
} }
} }
if "bro" in [tags] { if [type] =~ "ossec" {
mutate { mutate {
rename => { "host" => "beat_host" } rename => { "host" => "beat_host" }
remove_tag => ["beat"] remove_tag => ["beat"]
add_field => { "sensor_name" => "%{[beat][name]}" }
add_field => { "syslog-host_from" => "%{[beat][name]}" } add_field => { "syslog-host_from" => "%{[beat][name]}" }
} }
} }