mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
enable/disable zeek in ui
This commit is contained in:
m0duspwnens
@@ -1,28 +1,14 @@
|
||||
{% from 'vars/sensor.map.jinja' import ROLE_GLOBALS %}
|
||||
{% import_yaml 'zeek/defaults.yaml' as zeek_defaults with context %}
|
||||
{% set ZEEKMERGED = salt['pillar.get']('zeek', zeek_defaults.zeek, merge=True) %}
|
||||
{% import_yaml 'zeek/defaults.yaml' as ZEEKDEFAULTS with context %}
|
||||
{% set ZEEKMERGED = salt['pillar.get']('zeek', ZEEKDEFAULTS.zeek, merge=True) %}
|
||||
{% do ZEEKMERGED.config.node.update({'interface': ROLE_GLOBALS.sensor.interface}) %}
|
||||
|
||||
{# we have to add the @ sign for the config since we remove it from defaults for the UI #}
|
||||
{% if ZEEKMERGED.config.local.load is defined %}
|
||||
{% set LOCALLOAD = ZEEKMERGED.config.local.pop('load') %}
|
||||
{% do ZEEKMERGED.config.local.update({'@load': LOCALLOAD}) %}
|
||||
{% endif %}
|
||||
|
||||
{% if ZEEKMERGED.config.local['load-sigs'] is defined %}
|
||||
{% set LOCALLOADSIGS = ZEEKMERGED.config.local.pop('load-sigs') %}
|
||||
{% do ZEEKMERGED.config.local.update({'@load-sigs': LOCALLOADSIGS}) %}
|
||||
{% endif %}
|
||||
|
||||
{% set ZEEKOPTIONS = {} %}
|
||||
{% set ENABLED = salt['pillar.get']('zeek:enabled', True) %}
|
||||
|
||||
# don't start the docker container if it is an import node or disabled via pillar
|
||||
{% if grains.id.split('_')|last == 'import' or not ENABLED %}
|
||||
{% do ZEEKOPTIONS.update({'start': False}) %}
|
||||
{% do ZEEKOPTIONS.update({'pl_cron_state': 'absent'}) %}
|
||||
{% do ZEEKOPTIONS.update({'status': 'absent'}) %}
|
||||
{% else %}
|
||||
{% do ZEEKOPTIONS.update({'start': True}) %}
|
||||
{% do ZEEKOPTIONS.update({'pl_cron_state': 'present'}) %}
|
||||
{% do ZEEKOPTIONS.update({'status': 'running'}) %}
|
||||
{% endif %}
|
||||
|
||||
197
salt/zeek/config.sls
Normal file
197
salt/zeek/config.sls
Normal file
@@ -0,0 +1,197 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
{% from "zeek/config.map.jinja" import ZEEKMERGED %}
|
||||
|
||||
{% from 'bpf/zeek.map.jinja' import ZEEKBPF %}
|
||||
|
||||
{% set BPF_STATUS = 0 %}
|
||||
|
||||
# Add Zeek group
|
||||
zeekgroup:
|
||||
group.present:
|
||||
- name: zeek
|
||||
- gid: 937
|
||||
|
||||
# Add Zeek User
|
||||
zeek:
|
||||
user.present:
|
||||
- uid: 937
|
||||
- gid: 937
|
||||
- home: /home/zeek
|
||||
|
||||
# Create some directories
|
||||
zeekpolicydir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/zeek/policy
|
||||
- user: 937
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
# Zeek Log Directory
|
||||
zeeklogdir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/logs
|
||||
- user: 937
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
# Zeek Spool Directory
|
||||
zeekspooldir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/spool/manager
|
||||
- user: 937
|
||||
- makedirs: True
|
||||
|
||||
# Zeek extracted
|
||||
zeekextractdir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/extracted
|
||||
- user: 937
|
||||
- group: 939
|
||||
- mode: 770
|
||||
- makedirs: True
|
||||
|
||||
zeekextractcompletedir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/extracted/complete
|
||||
- user: 937
|
||||
- group: 939
|
||||
- mode: 770
|
||||
- makedirs: True
|
||||
|
||||
# Sync the policies
|
||||
zeekpolicysync:
|
||||
file.recurse:
|
||||
- name: /opt/so/conf/zeek/policy
|
||||
- source: salt://zeek/policy
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
FILE_EXTRACTION: {{ ZEEKMERGED.file_extraction }}
|
||||
|
||||
# Ensure the zeek spool tree (and state.db) ownership is correct
|
||||
zeekspoolownership:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/spool
|
||||
- user: 937
|
||||
zeekstatedbownership:
|
||||
file.managed:
|
||||
- name: /nsm/zeek/spool/state.db
|
||||
- user: 937
|
||||
- replace: False
|
||||
- create: False
|
||||
|
||||
zeek_sbin:
|
||||
file.recurse:
|
||||
- name: /usr/sbin
|
||||
- source: salt://zeek/tools/sbin
|
||||
- user: 939
|
||||
- group: 939
|
||||
- file_mode: 755
|
||||
|
||||
#zeek_sbin_jinja:
|
||||
# file.recurse:
|
||||
# - name: /usr/sbin
|
||||
# - source: salt://zeek/tools/sbin_jinja
|
||||
# - user: 939
|
||||
# - group: 939
|
||||
# - file_mode: 755
|
||||
# - template: jinja
|
||||
|
||||
# Sync Intel
|
||||
zeekintelloadsync:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/policy/intel/__load__.zeek
|
||||
- source: salt://zeek/policy/intel/__load__.zeek
|
||||
- user: 937
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
zeekctlcfg:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/zeekctl.cfg
|
||||
- source: salt://zeek/files/zeekctl.cfg.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
ZEEKCTL: {{ ZEEKMERGED.config.zeekctl | tojson }}
|
||||
|
||||
# Sync node.cfg
|
||||
nodecfg:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/node.cfg
|
||||
- source: salt://zeek/files/node.cfg.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
NODE: {{ ZEEKMERGED.config.node }}
|
||||
|
||||
networkscfg:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/networks.cfg
|
||||
- source: salt://zeek/files/networks.cfg.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
NETWORKS: {{ ZEEKMERGED.config.networks }}
|
||||
|
||||
plcronscript:
|
||||
file.managed:
|
||||
- name: /usr/local/bin/packetloss.sh
|
||||
- source: salt://zeek/cron/packetloss.sh
|
||||
- mode: 755
|
||||
|
||||
# BPF compilation and configuration
|
||||
{% if ZEEKBPF %}
|
||||
{% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + ZEEKBPF|join(" "),cwd='/root') %}
|
||||
{% if BPF_CALC['stderr'] == "" %}
|
||||
{% set BPF_STATUS = 1 %}
|
||||
{% else %}
|
||||
zeekbpfcompilationfailure:
|
||||
test.configurable_test_state:
|
||||
- changes: False
|
||||
- result: False
|
||||
- comment: "BPF Syntax Error - Discarding Specified BPF"
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
zeekbpf:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/bpf
|
||||
- user: 940
|
||||
- group: 940
|
||||
{% if BPF_STATUS %}
|
||||
- contents: {{ ZEEKBPF }}
|
||||
{% else %}
|
||||
- contents:
|
||||
- "ip or not ip"
|
||||
{% endif %}
|
||||
|
||||
localzeek:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/local.zeek
|
||||
- source: salt://zeek/files/local.zeek.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
LOCAL: {{ ZEEKMERGED.config.local | tojson }}
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,4 +1,5 @@
|
||||
zeek:
|
||||
enabled: True
|
||||
config:
|
||||
node:
|
||||
lb_procs: 0
|
||||
|
||||
28
salt/zeek/disabled.sls
Normal file
28
salt/zeek/disabled.sls
Normal file
@@ -0,0 +1,28 @@
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- zeek.sostatus
|
||||
|
||||
so-zeek:
|
||||
docker_container.absent:
|
||||
- force: True
|
||||
|
||||
so-zeek_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-zeek$
|
||||
|
||||
zeekpacketlosscron:
|
||||
cron.absent:
|
||||
- name: /usr/local/bin/packetloss.sh
|
||||
- identifier: zeekpacketlosscron
|
||||
- user: root
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
65
salt/zeek/enabled.sls
Normal file
65
salt/zeek/enabled.sls
Normal file
@@ -0,0 +1,65 @@
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- zeek.config
|
||||
- zeek.sostatus
|
||||
|
||||
so-zeek:
|
||||
docker_container.running:
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-zeek:{{ GLOBALS.so_version }}
|
||||
- start: True
|
||||
- privileged: True
|
||||
- ulimits:
|
||||
- core=0
|
||||
- nofile=1048576:1048576
|
||||
- binds:
|
||||
- /nsm/zeek/logs:/nsm/zeek/logs:rw
|
||||
- /nsm/zeek/spool:/nsm/zeek/spool:rw
|
||||
- /nsm/zeek/extracted:/nsm/zeek/extracted:rw
|
||||
- /opt/so/conf/zeek/local.zeek:/opt/zeek/share/zeek/site/local.zeek:ro
|
||||
- /opt/so/conf/zeek/node.cfg:/opt/zeek/etc/node.cfg:ro
|
||||
- /opt/so/conf/zeek/networks.cfg:/opt/zeek/etc/networks.cfg:ro
|
||||
- /opt/so/conf/zeek/zeekctl.cfg:/opt/zeek/etc/zeekctl.cfg:ro
|
||||
- /opt/so/conf/zeek/policy/securityonion:/opt/zeek/share/zeek/policy/securityonion:ro
|
||||
- /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro
|
||||
- /opt/so/conf/zeek/policy/cve-2020-0601:/opt/zeek/share/zeek/policy/cve-2020-0601:ro
|
||||
- /opt/so/conf/zeek/policy/intel:/opt/zeek/share/zeek/policy/intel:rw
|
||||
- /opt/so/conf/zeek/bpf:/opt/zeek/etc/bpf:ro
|
||||
- network_mode: host
|
||||
- watch:
|
||||
- file: /opt/so/conf/zeek/local.zeek
|
||||
- file: /opt/so/conf/zeek/node.cfg
|
||||
- file: /opt/so/conf/zeek/networks.cfg
|
||||
- file: /opt/so/conf/zeek/zeekctl.cfg
|
||||
- file: /opt/so/conf/zeek/policy
|
||||
- file: /opt/so/conf/zeek/bpf
|
||||
- require:
|
||||
- file: localzeek
|
||||
- file: nodecfg
|
||||
- file: zeekctlcfg
|
||||
- file: zeekbpf
|
||||
|
||||
delete_so-zeek_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-zeek$
|
||||
|
||||
zeekpacketlosscron:
|
||||
cron.present:
|
||||
- name: /usr/local/bin/packetloss.sh
|
||||
- identifier: zeekpacketlosscron
|
||||
- user: root
|
||||
- minute: '*/10'
|
||||
- hour: '*'
|
||||
- daymonth: '*'
|
||||
- month: '*'
|
||||
- dayweek: '*'
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,283 +1,12 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
{% from 'zeek/config.map.jinja' import ZEEKMERGED %}
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls in allowed_states %}
|
||||
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS with context %}
|
||||
{% from "zeek/config.map.jinja" import ZEEKOPTIONS with context %}
|
||||
{% from "zeek/config.map.jinja" import ZEEKMERGED with context %}
|
||||
|
||||
{% from 'bpf/zeek.map.jinja' import ZEEKBPF %}
|
||||
|
||||
{% set BPF_STATUS = 0 %}
|
||||
|
||||
# Zeek Salt State
|
||||
|
||||
# Add Zeek group
|
||||
zeekgroup:
|
||||
group.present:
|
||||
- name: zeek
|
||||
- gid: 937
|
||||
|
||||
# Add Zeek User
|
||||
zeek:
|
||||
user.present:
|
||||
- uid: 937
|
||||
- gid: 937
|
||||
- home: /home/zeek
|
||||
|
||||
# Create some directories
|
||||
zeekpolicydir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/zeek/policy
|
||||
- user: 937
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
# Zeek Log Directory
|
||||
zeeklogdir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/logs
|
||||
- user: 937
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
# Zeek Spool Directory
|
||||
zeekspooldir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/spool/manager
|
||||
- user: 937
|
||||
- makedirs: True
|
||||
|
||||
# Zeek extracted
|
||||
zeekextractdir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/extracted
|
||||
- user: 937
|
||||
- group: 939
|
||||
- mode: 770
|
||||
- makedirs: True
|
||||
|
||||
zeekextractcompletedir:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/extracted/complete
|
||||
- user: 937
|
||||
- group: 939
|
||||
- mode: 770
|
||||
- makedirs: True
|
||||
|
||||
# Sync the policies
|
||||
zeekpolicysync:
|
||||
file.recurse:
|
||||
- name: /opt/so/conf/zeek/policy
|
||||
- source: salt://zeek/policy
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
FILE_EXTRACTION: {{ ZEEKMERGED.file_extraction }}
|
||||
|
||||
# Ensure the zeek spool tree (and state.db) ownership is correct
|
||||
zeekspoolownership:
|
||||
file.directory:
|
||||
- name: /nsm/zeek/spool
|
||||
- user: 937
|
||||
zeekstatedbownership:
|
||||
file.managed:
|
||||
- name: /nsm/zeek/spool/state.db
|
||||
- user: 937
|
||||
- replace: False
|
||||
- create: False
|
||||
|
||||
zeek_sbin:
|
||||
file.recurse:
|
||||
- name: /usr/sbin
|
||||
- source: salt://zeek/tools/sbin
|
||||
- user: 939
|
||||
- group: 939
|
||||
- file_mode: 755
|
||||
|
||||
#zeek_sbin_jinja:
|
||||
# file.recurse:
|
||||
# - name: /usr/sbin
|
||||
# - source: salt://zeek/tools/sbin_jinja
|
||||
# - user: 939
|
||||
# - group: 939
|
||||
# - file_mode: 755
|
||||
# - template: jinja
|
||||
|
||||
# Sync Intel
|
||||
zeekintelloadsync:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/policy/intel/__load__.zeek
|
||||
- source: salt://zeek/policy/intel/__load__.zeek
|
||||
- user: 937
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
zeekctlcfg:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/zeekctl.cfg
|
||||
- source: salt://zeek/files/zeekctl.cfg.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
ZEEKCTL: {{ ZEEKMERGED.config.zeekctl | tojson }}
|
||||
|
||||
# Sync node.cfg
|
||||
nodecfg:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/node.cfg
|
||||
- source: salt://zeek/files/node.cfg.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
NODE: {{ ZEEKMERGED.config.node }}
|
||||
|
||||
networkscfg:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/networks.cfg
|
||||
- source: salt://zeek/files/networks.cfg.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
NETWORKS: {{ ZEEKMERGED.config.networks }}
|
||||
|
||||
#zeekcleanscript:
|
||||
# file.managed:
|
||||
# - name: /usr/local/bin/zeek_clean
|
||||
# - source: salt://zeek/cron/zeek_clean
|
||||
# - mode: 755
|
||||
|
||||
#/usr/local/bin/zeek_clean:
|
||||
# cron.present:
|
||||
# - user: root
|
||||
# - minute: '*'
|
||||
# - hour: '*'
|
||||
# - daymonth: '*'
|
||||
# - month: '*'
|
||||
# - dayweek: '*'
|
||||
|
||||
plcronscript:
|
||||
file.managed:
|
||||
- name: /usr/local/bin/packetloss.sh
|
||||
- source: salt://zeek/cron/packetloss.sh
|
||||
- mode: 755
|
||||
|
||||
zeekpacketlosscron:
|
||||
cron.{{ZEEKOPTIONS.pl_cron_state}}:
|
||||
- name: /usr/local/bin/packetloss.sh
|
||||
- user: root
|
||||
- minute: '*/10'
|
||||
- hour: '*'
|
||||
- daymonth: '*'
|
||||
- month: '*'
|
||||
- dayweek: '*'
|
||||
|
||||
# BPF compilation and configuration
|
||||
{% if ZEEKBPF %}
|
||||
{% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', GLOBALS.sensor.interface + ' ' + ZEEKBPF|join(" "),cwd='/root') %}
|
||||
{% if BPF_CALC['stderr'] == "" %}
|
||||
{% set BPF_STATUS = 1 %}
|
||||
{% else %}
|
||||
zeekbpfcompilationfailure:
|
||||
test.configurable_test_state:
|
||||
- changes: False
|
||||
- result: False
|
||||
- comment: "BPF Syntax Error - Discarding Specified BPF"
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
zeekbpf:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/bpf
|
||||
- user: 940
|
||||
- group: 940
|
||||
{% if BPF_STATUS %}
|
||||
- contents: {{ ZEEKBPF }}
|
||||
include:
|
||||
{% if ZEEKMERGED.enabled and GLOBALS.role != 'so-import'%}
|
||||
- zeek.enabled
|
||||
{% elif GLOBALS.role == 'so-import' %}
|
||||
- zeek.config
|
||||
- zeek.disabled
|
||||
{% else %}
|
||||
- contents:
|
||||
- "ip or not ip"
|
||||
{% endif %}
|
||||
|
||||
|
||||
localzeek:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/zeek/local.zeek
|
||||
- source: salt://zeek/files/local.zeek.jinja
|
||||
- user: 937
|
||||
- group: 939
|
||||
- template: jinja
|
||||
- defaults:
|
||||
LOCAL: {{ ZEEKMERGED.config.local | tojson }}
|
||||
|
||||
so-zeek:
|
||||
docker_container.{{ ZEEKOPTIONS.status }}:
|
||||
{% if ZEEKOPTIONS.status == 'running' %}
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-zeek:{{ GLOBALS.so_version }}
|
||||
- start: {{ ZEEKOPTIONS.start }}
|
||||
- privileged: True
|
||||
- ulimits:
|
||||
- core=0
|
||||
- nofile=1048576:1048576
|
||||
- binds:
|
||||
- /nsm/zeek/logs:/nsm/zeek/logs:rw
|
||||
- /nsm/zeek/spool:/nsm/zeek/spool:rw
|
||||
- /nsm/zeek/extracted:/nsm/zeek/extracted:rw
|
||||
- /opt/so/conf/zeek/local.zeek:/opt/zeek/share/zeek/site/local.zeek:ro
|
||||
- /opt/so/conf/zeek/node.cfg:/opt/zeek/etc/node.cfg:ro
|
||||
- /opt/so/conf/zeek/networks.cfg:/opt/zeek/etc/networks.cfg:ro
|
||||
- /opt/so/conf/zeek/zeekctl.cfg:/opt/zeek/etc/zeekctl.cfg:ro
|
||||
- /opt/so/conf/zeek/policy/securityonion:/opt/zeek/share/zeek/policy/securityonion:ro
|
||||
- /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro
|
||||
- /opt/so/conf/zeek/policy/cve-2020-0601:/opt/zeek/share/zeek/policy/cve-2020-0601:ro
|
||||
- /opt/so/conf/zeek/policy/intel:/opt/zeek/share/zeek/policy/intel:rw
|
||||
- /opt/so/conf/zeek/bpf:/opt/zeek/etc/bpf:ro
|
||||
- network_mode: host
|
||||
- watch:
|
||||
- file: /opt/so/conf/zeek/local.zeek
|
||||
- file: /opt/so/conf/zeek/node.cfg
|
||||
- file: /opt/so/conf/zeek/networks.cfg
|
||||
- file: /opt/so/conf/zeek/zeekctl.cfg
|
||||
- file: /opt/so/conf/zeek/policy
|
||||
- file: /opt/so/conf/zeek/bpf
|
||||
- require:
|
||||
- file: localzeek
|
||||
- file: nodecfg
|
||||
- file: zeekctlcfg
|
||||
- file: zeekbpf
|
||||
{% else %} {# if Zeek isn't enabled, then stop and remove the container #}
|
||||
- force: True
|
||||
{% endif %}
|
||||
|
||||
append_so-zeek_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-zeek
|
||||
- unless: grep -q so-zeek /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% if not ZEEKOPTIONS.start %}
|
||||
so-zeek_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-zeek$
|
||||
{% else %}
|
||||
delete_so-zeek_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-zeek$
|
||||
{% endif %}
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
- zeek.disabled
|
||||
{% endif %}
|
||||
|
||||
16
salt/zeek/sostatus.sls
Normal file
16
salt/zeek/sostatus.sls
Normal file
@@ -0,0 +1,16 @@
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
append_so-zeek_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-zeek
|
||||
- unless: grep -q so-zeek /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
Reference in New Issue
Block a user