CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-17 06:22:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

so-import-evtx - final fixes

Browse Source
This commit is contained in:
Josh Brower
2021-09-15 14:06:08 -04:00
parent 0b0d508585
commit ac417867ed
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
salt/common/tools/sbin/so-import-evtx
View File

@@ -43,18 +43,19 @@ function evtx2es() {
docker run --rm \ docker run --rm \
-v "$EVTX:/tmp/$RUNID.evtx" \ -v "$EVTX:/tmp/$RUNID.evtx" \
so-evtx2es02 \ --entrypoint evtx2es \
{{ MANAGER }}:5000/{{ IMAGEREPO }}/so-pcaptools:{{ VERSION }} \
--host {{ MANAGERIP }} --scheme https \ --host {{ MANAGERIP }} --scheme https \
--index so-beats-$INDEX_DATE --pipeline import.wel \ --index so-beats-$INDEX_DATE --pipeline import.wel \
--login {{ES_USER}} --pwd {{ES_PW}} "/tmp/$RUNID.evtx" 1>/dev/null 2>/dev/null --login {{ES_USER}} --pwd {{ES_PW}} \
"/tmp/$RUNID.evtx" 1>/dev/null 2>/dev/null
docker run --rm \ docker run --rm \
-v "$EVTX:/tmp/import.evtx" \ -v "$EVTX:/tmp/import.evtx" \
-v "/nsm/import/evtx-end_newest:/tmp/newest" \ -v "/nsm/import/evtx-end_newest:/tmp/newest" \
-v "/nsm/import/evtx-start_oldest:/tmp/oldest" \ -v "/nsm/import/evtx-start_oldest:/tmp/oldest" \
--entrypoint '/calculate_timestamp.sh' \ --entrypoint '/evtx_calc_timestamps.sh' \
so-evtx2es02 {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-pcaptools:{{ VERSION }}
} }
# if no parameters supplied, display usage # if no parameters supplied, display usage
@@ -109,7 +110,7 @@ for EVTX in "$@"; do
mkdir -p $EVTX_DIR mkdir -p $EVTX_DIR
# import evtx and write them to import ingest pipeline # import evtx and write them to import ingest pipeline
echo "- importing logs with evtx2es" echo "- importing logs to Elasticsearch..."
evtx2es "${EVTX}" $HASH evtx2es "${EVTX}" $HASH
# compare $START to $START_OLDEST # compare $START to $START_OLDEST