CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

logstash helix

Browse Source
This commit is contained in:
m0duspwnens
2019-12-09 10:22:35 -05:00
parent 599341483e
commit a4b59ee8bf
4 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pillar/top.sls
View File

@@ -27,3 +27,7 @@ base:
- nodes.{{ grains.id }} - nodes.{{ grains.id }}
- static - static
- firewall.* - firewall.*
'G@role:so-helix':
- fireeye
- static

2
salt/logstash/files/dynamic/9997_output_helix.conf
View File

@@ -1,4 +1,4 @@
{% set helix_api_key = salt['pillar.get']('fireeye:helix:api_key', '') %} {% set HELIXAPIKEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
filter { filter {
if "fe_clone" in [type] { if "fe_clone" in [type] {

11
setup/functions.sh
View File

@@ -476,6 +476,17 @@ filter_unused_nics() {
FNICS=$(ip link | grep -vwe $grep_string | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}') FNICS=$(ip link | grep -vwe $grep_string | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}')
} }
fireeye_pillar() {
FIREEYEPILLARPATH=$TMP/pillar/fireeye
echo "" >> $FIREEYEPILLARPATH/init.sls
echo "fireeye:" >> $FIREEYEPILLARPATH/init.sls
echo " helix:" >> $FIREEYEPILLARPATH/init.sls
echo " api_key: $HELIXAPIKEY" >> $FIREEYEPILLARPATH/init.sls
}
generate_passwords(){ generate_passwords(){
# Generate Random Passwords for Things # Generate Random Passwords for Things
MYSQLPASS=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1) MYSQLPASS=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1)

2
setup/so-setup.sh
View File

@@ -193,6 +193,8 @@ if (whiptail_you_sure) ; then
master_pillar >> $SETUPLOG 2>&1 master_pillar >> $SETUPLOG 2>&1
echo "** Generating the patch pillar **" >> $SETUPLOG echo "** Generating the patch pillar **" >> $SETUPLOG
patch_pillar >> $SETUPLOG 2>&1 patch_pillar >> $SETUPLOG 2>&1
echo "** Generating the FireEye pillar **" >> $SETUPLOG
fireeye_pillar >> $SETUPLOG 2>&1
echo -e "XXX\n24\nCopying Minion Pillars to Master... \nXXX" echo -e "XXX\n24\nCopying Minion Pillars to Master... \nXXX"
copy_minion_tmp_files >> $SETUPLOG 2>&1 copy_minion_tmp_files >> $SETUPLOG 2>&1
# Do a checkin to push the key up # Do a checkin to push the key up