Merge branch 'master' of https://github.com/TOoSmOotH/securityonion-saltstack

salt/filebeat/etc/filebeat.yml

@@ -2,6 +2,7 @@
 {%- set HOSTNAME = salt['grains.get']('host', '') %}
 {%- set BROVER = salt['pillar.get']('static:broversion', 'COMMUNITY') %}
 {%- set WAZUHENABLED = salt['pillar.get']('static:wazuh_enabled', '1') %}
+{%- set FLEETENABLED = salt['pillar.get']('static:fleet_enabled', '1') %}
 
 name: {{ HOSTNAME }}
 
@@ -61,6 +62,18 @@ filebeat.prospectors:
 
 {%- endif %}
 
+{%- if FLEETENABLED == '1' %}
+
+  - type: log
+    paths:
+      - /osquery/logs/result.log
+    fields:
+      type: osquery
+    fields_under_root: true
+    clean_removed: false
+    close_removed: false
+
+{%- endif %}
 #----------------------------- Logstash output ---------------------------------
 output.logstash:
   # Boolean flag to enable or disable the output module.

salt/filebeat/init.sls

@@ -63,6 +63,7 @@ so-filebeat:
       - /opt/so/log/suricata:/suricata:ro
       - /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro
       - /opt/so/wazuh/logs/archives/:/wazuh/archives:ro
+      - /opt/so/log/fleet/:/osquery/logs:ro
 {%- if grains['role'] == 'so-master' %}
       - /etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
       - /etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro

salt/logstash/conf/conf.enabled.txt.so-eval

@@ -107,3 +107,5 @@
 /usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
 /usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
 /usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
+/usr/share/logstash/pipeline.dynamic/7100_osquery_wel.conf
+/usr/share/logstash/pipeline.dynamic/9100_output_osquery.conf

salt/logstash/files/dynamic/0006_input_beats.conf

@@ -25,5 +25,15 @@ filter {
       add_field => { "syslog-host_from" => "%{[beat][name]}" }
       remove_field => [ "beat", "prospector", "input", "offset" ]
     }
+   }
+    if [type] == "osquery" {
+    mutate {
+      remove_tag => ["beat"]
+      add_tag => ["osquery"]
+        	}
+   json {
+    source => "message"
+    target => "osquery"
+        }
   }
 }

salt/logstash/files/dynamic/7100_osquery_wel.conf

@@ -0,0 +1,23 @@
+# Author: Josh Brower
+# Last Update: 12/28/2018
+# If log is tagged osquery and there is an eventid column - then cleanup and parse out the EventData column
+
+filter {
+  if "osquery" in [tags] and [osquery][columns][eventid] {
+
+        mutate {
+     gsub => ["[osquery][columns][data]", "\\x0A", ""]
+    }
+
+        json {
+      source => "[osquery][columns][data]"
+      target => "[osquery][columns][data]"
+     }
+
+        mutate {
+     merge => { "[osquery][columns]" => "[osquery][columns][data]" }
+     remove_field => ["[osquery][columns][data]"]
+        }
+
+  }
+}

salt/logstash/files/dynamic/9100_output_osquery.conf

@@ -0,0 +1,19 @@
+{%- if grains['role'] == 'so-eval' -%}
+{%- set ES = salt['pillar.get']('master:mainip', '') -%}
+{%- else %}
+{%- set ES = salt['pillar.get']('node:mainip', '') -%}
+{%- endif %}
+# Author: Josh Brower
+# Last Update: 12/29/2018
+# Output to ES for osquery tagged logs
+
+
+output {
+  if "osquery" in [tags] {
+    elasticsearch {
+      hosts => "{{ ES }}"
+      index => "logstash-osquery-%{+YYYY.MM.dd}"
+      template => "/logstash-template.json"
+    }
+  }
+}

salt/top.sls

@@ -30,6 +30,7 @@ base:
     - bro
     - curator
     - elastalert
+    - redis
     - fleet
     - wazuh
     - filebeat

salt/wazuh/files/agent/ossec.conf

@@ -18,7 +18,11 @@
       <port>1514</port>
       <protocol>udp</protocol>
     </server>
+{%- if grains['os'] == 'Ubuntu' %}
     <config-profile>ubuntu, ubuntu16, ubuntu16.04</config-profile>
+{%- else %}
+    <config-profile>centos, centos7</config-profile>
+{%- endif %}
     <notify_time>10</notify_time>
     <time-reconnect>60</time-reconnect>
     <auto_restart>yes</auto_restart>