From 7f464af5fa29bc038461aa4d807216b0e618c4a4 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 14 May 2020 13:39:19 -0400 Subject: [PATCH 1/2] run so-elasticsearch-pipelines only on changes - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/682 --- salt/elasticsearch/init.sls | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/salt/elasticsearch/init.sls b/salt/elasticsearch/init.sls index 35676ed6d..2cdff92c1 100644 --- a/salt/elasticsearch/init.sls +++ b/salt/elasticsearch/init.sls @@ -144,6 +144,10 @@ so-elasticsearch-pipelines-file: so-elasticsearch-pipelines: cmd.run: - name: /opt/so/conf/elasticsearch/so-elasticsearch-pipelines {{ esclustername }} + - onchanges: + - file: esingestconf + - file: esyml + - file: so-elasticsearch-pipelines-file {% if grains['role'] == 'so-master' or grains['role'] == "so-eval" or grains['role'] == "so-mastersearch" %} so-elasticsearch-templates: From 34d9882987a3083669e12b8db86b030912c2af7f Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Thu, 14 May 2020 13:47:01 -0400 Subject: [PATCH 2/2] fix Wazuh and Sysmon queries --- salt/soc/files/soc/soc.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index eb53c77ac..88eeed8ec 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -87,12 +87,12 @@ { "name": "Elastalerts", "description": "", "query": "_type:elastalert | groupby rule.name"}, { "name": "Alerts", "description": "Show all alerts grouped by alert source", "query": "event.dataset: alert | groupby event.module"}, { "name": "NIDS Alerts", "description": "Show all NIDS alerts grouped by alert name", "query": "event.category: network AND event.dataset: alert | groupby rule.name"}, - { "name": "OSSEC Alerts", "description": "", "query": "event_type:ossec AND alert | groupby rule.category"}, - { "name": "OSSEC Commands", "description": "", "query": "event_type:ossec AND alert | groupby process.command_line"}, - { "name": "OSSEC Processes", "description": "", "query": "event_type:ossec AND alert | groupby process.name"}, - { "name": "OSSEC Users", "description": "", "query": "event_type:ossec AND alert | groupby user.name"}, - { "name": "SYSMON", "description": "", "query": "event_type:sysmon | groupby event_id"}, - { "name": "SYSMON", "description": "", "query": "event_type:sysmon | groupby username"}, + { "name": "Wazuh/OSSEC Alerts", "description": "Show all Wazuh alerts grouped by category", "query": "event.module:ossec AND event.dataset:alert | groupby rule.category"}, + { "name": "Wazuh/OSSEC Commands", "description": "Show all Wazuh alerts grouped by command line", "query": "eevent.module:ossec AND event.dataset:alert | groupby process.command_line"}, + { "name": "Wazuh/OSSEC Processes", "description": "Show all Wazuh alerts grouped by process name", "query": "event.module:ossec AND event.dataset:alert | groupby process.name"}, + { "name": "Wazuh/OSSEC Users", "description": "Show all Wazuh alerts grouped by username", "query": "event.module:ossec AND event.dataset:alert | groupby user.name"}, + { "name": "Sysmon Events", "description": "Show all Sysmon logs grouped by event_id", "query": "event_type:sysmon | groupby event_id"}, + { "name": "Sysmon Usernames", "description": "Show all Sysmon logs grouped by username", "query": "event_type:sysmon | groupby username"}, { "name": "Zeek Notice", "description": "Show notices from Zeek", "query": "event.module:zeek AND event.dataset:notice | groupby notice.note,notice.message"}, { "name": "Connections", "description": "Connections grouped by IP and Port", "query": "event.module:zeek AND event.dataset:conn | groupby source.ip,destination.ip,network.protocol,destination.port"}, { "name": "Connections", "description": "Connections grouped by Service", "query": "event.module:zeek AND event.dataset:conn | groupby network.protocol,destination.port"},