mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-08 22:01:50 +02:00
Remove Strelka container infrastructure
Removes all Strelka container salt states and infrastructure references, replaced by the native fileanalyze module in sensoroni. Removed: - salt/strelka/ directory (all container states, configs, tools) - Docker container definitions for 6 Strelka containers - Firewall rules for strelka_frontend - Container references in containers.map.jinja - top.sls and allowed_states references to strelka/strelka.manager - so-minion add_strelka_to_minion() function and call sites - so-deny strelka_frontend entry - Logstash strelka bind mount - Logrotate strelka config - Telegraf strelka file monitoring - so-sensor-clean strelka cleanup - so-image-common strelka container images Kept (still needed): - Elasticsearch index/ingest pipeline (ingests fileanalyze output) - Elastic agent/fleet log collection config - SOC strelkaengine (YARA rule management) - Kibana saved objects (dashboards)
This commit is contained in:
Mike Reeves
@@ -41,8 +41,7 @@
|
||||
'suricata',
|
||||
'healthcheck',
|
||||
'tcpreplay',
|
||||
'zeek',
|
||||
'strelka'
|
||||
'zeek'
|
||||
] %}
|
||||
|
||||
{% set kafka_states = [
|
||||
@@ -84,26 +83,26 @@
|
||||
),
|
||||
'so-import': (
|
||||
manager_states +
|
||||
sensor_states | reject('equalto', 'strelka') | reject('equalto', 'healthcheck') | list +
|
||||
['elasticsearch', 'elasticsearch.auth', 'kibana', 'kibana.secrets', 'logstash.ssl', 'strelka.manager']
|
||||
sensor_states | reject('equalto', 'healthcheck') | list +
|
||||
['elasticsearch', 'elasticsearch.auth', 'kibana', 'kibana.secrets', 'logstash.ssl']
|
||||
),
|
||||
'so-manager': (
|
||||
manager_states +
|
||||
['salt.cloud', 'libvirt.packages', 'libvirt.ssh.users', 'strelka.manager'] +
|
||||
['salt.cloud', 'libvirt.packages', 'libvirt.ssh.users'] +
|
||||
stig_states +
|
||||
kafka_states +
|
||||
elastic_stack_states
|
||||
),
|
||||
'so-managerhype': (
|
||||
manager_states +
|
||||
['salt.cloud', 'strelka.manager', 'hypervisor', 'libvirt'] +
|
||||
['salt.cloud', 'hypervisor', 'libvirt'] +
|
||||
stig_states +
|
||||
kafka_states +
|
||||
elastic_stack_states
|
||||
),
|
||||
'so-managersearch': (
|
||||
manager_states +
|
||||
['salt.cloud', 'libvirt.packages', 'libvirt.ssh.users', 'strelka.manager'] +
|
||||
['salt.cloud', 'libvirt.packages', 'libvirt.ssh.users'] +
|
||||
stig_states +
|
||||
kafka_states +
|
||||
elastic_stack_states
|
||||
|
||||
@@ -57,8 +57,6 @@ container_list() {
|
||||
"so-pcaptools"
|
||||
"so-redis"
|
||||
"so-soc"
|
||||
"so-strelka-backend"
|
||||
"so-strelka-manager"
|
||||
"so-suricata"
|
||||
"so-telegraf"
|
||||
"so-zeek"
|
||||
|
||||
@@ -42,21 +42,6 @@ clean() {
|
||||
# done
|
||||
#fi
|
||||
|
||||
## Clean up Zeek extracted files processed by Strelka
|
||||
STRELKA_FILES='/nsm/strelka/processed'
|
||||
OLDEST_STRELKA=$(find $STRELKA_FILES -type f -printf '%T+ %p\n' | sort -n | head -n 1)
|
||||
if [ -z "$OLDEST_STRELKA" -o "$OLDEST_STRELKA" == ".." -o "$OLDEST_STRELKA" == "." ]; then
|
||||
echo "$(date) - No old files available to clean up in $STRELKA_FILES" >>$LOG
|
||||
else
|
||||
OLDEST_STRELKA_DATE=$(echo $OLDEST_STRELKA | awk '{print $1}' | cut -d+ -f1)
|
||||
OLDEST_STRELKA_FILE=$(echo $OLDEST_STRELKA | awk '{print $2}')
|
||||
echo "$(date) - Removing extracted files for $OLDEST_STRELKA_DATE" >>$LOG
|
||||
find $STRELKA_FILES -type f -printf '%T+ %p\n' | grep $OLDEST_STRELKA_DATE | awk '{print $2}' | while read FILE; do
|
||||
echo "$(date) - Removing file: $FILE" >>$LOG
|
||||
rm -f "$FILE"
|
||||
done
|
||||
fi
|
||||
|
||||
## Clean up Suricata log files
|
||||
SURICATA_LOGS='/nsm/suricata'
|
||||
OLDEST_SURICATA=$(find $SURICATA_LOGS -type f -printf '%T+ %p\n' | sort -n | head -n 1)
|
||||
|
||||
@@ -134,48 +134,6 @@ docker:
|
||||
extra_hosts: []
|
||||
extra_env: []
|
||||
ulimits: []
|
||||
'so-strelka-backend':
|
||||
final_octet: 36
|
||||
custom_bind_mounts: []
|
||||
extra_hosts: []
|
||||
extra_env: []
|
||||
ulimits: []
|
||||
'so-strelka-filestream':
|
||||
final_octet: 37
|
||||
custom_bind_mounts: []
|
||||
extra_hosts: []
|
||||
extra_env: []
|
||||
ulimits: []
|
||||
'so-strelka-frontend':
|
||||
final_octet: 38
|
||||
port_bindings:
|
||||
- 0.0.0.0:57314:57314
|
||||
custom_bind_mounts: []
|
||||
extra_hosts: []
|
||||
extra_env: []
|
||||
ulimits: []
|
||||
'so-strelka-manager':
|
||||
final_octet: 39
|
||||
custom_bind_mounts: []
|
||||
extra_hosts: []
|
||||
extra_env: []
|
||||
ulimits: []
|
||||
'so-strelka-gatekeeper':
|
||||
final_octet: 40
|
||||
port_bindings:
|
||||
- 0.0.0.0:6381:6379
|
||||
custom_bind_mounts: []
|
||||
extra_hosts: []
|
||||
extra_env: []
|
||||
ulimits: []
|
||||
'so-strelka-coordinator':
|
||||
final_octet: 41
|
||||
port_bindings:
|
||||
- 0.0.0.0:6380:6379
|
||||
custom_bind_mounts: []
|
||||
extra_hosts: []
|
||||
extra_env: []
|
||||
ulimits: []
|
||||
'so-elastalert':
|
||||
final_octet: 42
|
||||
custom_bind_mounts: []
|
||||
|
||||
@@ -89,12 +89,6 @@ docker:
|
||||
so-redis: *dockerOptions
|
||||
so-sensoroni: *dockerOptions
|
||||
so-soc: *dockerOptions
|
||||
so-strelka-backend: *dockerOptions
|
||||
so-strelka-filestream: *dockerOptions
|
||||
so-strelka-frontend: *dockerOptions
|
||||
so-strelka-manager: *dockerOptions
|
||||
so-strelka-gatekeeper: *dockerOptions
|
||||
so-strelka-coordinator: *dockerOptions
|
||||
so-elastalert: *dockerOptions
|
||||
so-elastic-fleet-package-registry: *dockerOptions
|
||||
so-idh: *dockerOptions
|
||||
|
||||
@@ -13,12 +13,6 @@
|
||||
'so-nginx',
|
||||
'so-redis',
|
||||
'so-soc',
|
||||
'so-strelka-coordinator',
|
||||
'so-strelka-gatekeeper',
|
||||
'so-strelka-frontend',
|
||||
'so-strelka-backend',
|
||||
'so-strelka-manager',
|
||||
'so-strelka-filestream'
|
||||
] %}
|
||||
|
||||
{% elif GLOBALS.role in ['so-manager', 'so-standalone','so-managersearch', 'so-managerhype'] %}
|
||||
@@ -36,12 +30,6 @@
|
||||
'so-nginx',
|
||||
'so-redis',
|
||||
'so-soc',
|
||||
'so-strelka-coordinator',
|
||||
'so-strelka-gatekeeper',
|
||||
'so-strelka-frontend',
|
||||
'so-strelka-backend',
|
||||
'so-strelka-manager',
|
||||
'so-strelka-filestream'
|
||||
] %}
|
||||
|
||||
{% elif GLOBALS.role == 'so-searchnode' %}
|
||||
@@ -58,12 +46,6 @@
|
||||
'so-logstash',
|
||||
'so-nginx',
|
||||
'so-redis',
|
||||
'so-strelka-coordinator',
|
||||
'so-strelka-gatekeeper',
|
||||
'so-strelka-frontend',
|
||||
'so-strelka-backend',
|
||||
'so-strelka-manager',
|
||||
'so-strelka-filestream'
|
||||
] %}
|
||||
|
||||
{% elif GLOBALS.role == 'so-import' %}
|
||||
|
||||
@@ -27,7 +27,6 @@ firewall:
|
||||
self: []
|
||||
sensor: []
|
||||
standalone: []
|
||||
strelka_frontend: []
|
||||
syslog: []
|
||||
desktop: []
|
||||
customhostgroup0: []
|
||||
@@ -140,10 +139,6 @@ firewall:
|
||||
tcp:
|
||||
- 22
|
||||
udp: []
|
||||
strelka_frontend:
|
||||
tcp:
|
||||
- 57314
|
||||
udp: []
|
||||
syslog:
|
||||
tcp:
|
||||
- 514
|
||||
@@ -222,9 +217,6 @@ firewall:
|
||||
- elastic_agent_control
|
||||
- elastic_agent_data
|
||||
- elastic_agent_update
|
||||
strelka_frontend:
|
||||
portgroups:
|
||||
- strelka_frontend
|
||||
analyst:
|
||||
portgroups:
|
||||
- nginx
|
||||
@@ -1024,7 +1016,6 @@ firewall:
|
||||
- elastic_agent_data
|
||||
- elastic_agent_update
|
||||
- endgame
|
||||
- strelka_frontend
|
||||
- localrules
|
||||
fleet:
|
||||
portgroups:
|
||||
@@ -1113,9 +1104,6 @@ firewall:
|
||||
- external_suricata
|
||||
external_kafka:
|
||||
portgroups: []
|
||||
strelka_frontend:
|
||||
portgroups:
|
||||
- strelka_frontend
|
||||
desktop:
|
||||
portgroups:
|
||||
- docker_registry
|
||||
@@ -1309,9 +1297,6 @@ firewall:
|
||||
chain:
|
||||
DOCKER-USER:
|
||||
hostgroups:
|
||||
strelka_frontend:
|
||||
portgroups:
|
||||
- strelka_frontend
|
||||
customhostgroup0:
|
||||
portgroups: []
|
||||
customhostgroup1:
|
||||
@@ -1401,9 +1386,6 @@ firewall:
|
||||
- syslog
|
||||
- elasticsearch_node
|
||||
- elasticsearch_rest
|
||||
strelka_frontend:
|
||||
portgroups:
|
||||
- strelka_frontend
|
||||
syslog:
|
||||
portgroups:
|
||||
- syslog
|
||||
|
||||
@@ -47,7 +47,6 @@ firewall:
|
||||
self: *ROhostgroupsettingsadv
|
||||
sensor: *hostgroupsettings
|
||||
standalone: *hostgroupsettings
|
||||
strelka_frontend: *hostgroupsettings
|
||||
syslog: *hostgroupsettings
|
||||
desktop: *hostgroupsettings
|
||||
customhostgroup0: &customhostgroupsettings
|
||||
@@ -156,9 +155,6 @@ firewall:
|
||||
ssh:
|
||||
tcp: *tcpsettings
|
||||
udp: *udpsettings
|
||||
strelka_frontend:
|
||||
tcp: *tcpsettings
|
||||
udp: *udpsettings
|
||||
syslog:
|
||||
tcp: *tcpsettings
|
||||
udp: *udpsettings
|
||||
@@ -224,9 +220,7 @@ firewall:
|
||||
portgroups: *portgroupsdocker
|
||||
elastic_agent_endpoint:
|
||||
portgroups: *portgroupsdocker
|
||||
external_suricata:
|
||||
portgroups: *portgroupsdocker
|
||||
strelka_frontend:
|
||||
external_suricata:
|
||||
portgroups: *portgroupsdocker
|
||||
syslog:
|
||||
portgroups: *portgroupsdocker
|
||||
@@ -236,24 +230,24 @@ firewall:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup0:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup1:
|
||||
customhostgroup1:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup2:
|
||||
customhostgroup2:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup3:
|
||||
customhostgroup3:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup4:
|
||||
customhostgroup4:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup5:
|
||||
customhostgroup5:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup6:
|
||||
customhostgroup6:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup7:
|
||||
customhostgroup7:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup8:
|
||||
customhostgroup8:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup9:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup9:
|
||||
portgroups: *portgroupsdocker
|
||||
INPUT:
|
||||
hostgroups:
|
||||
anywhere:
|
||||
@@ -569,9 +563,7 @@ firewall:
|
||||
portgroups: *portgroupsdocker
|
||||
endgame:
|
||||
portgroups: *portgroupsdocker
|
||||
external_suricata:
|
||||
portgroups: *portgroupsdocker
|
||||
strelka_frontend:
|
||||
external_suricata:
|
||||
portgroups: *portgroupsdocker
|
||||
syslog:
|
||||
portgroups: *portgroupsdocker
|
||||
@@ -711,28 +703,26 @@ firewall:
|
||||
hostgroups:
|
||||
self:
|
||||
portgroups: *portgroupsdocker
|
||||
strelka_frontend:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup0:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup1:
|
||||
customhostgroup1:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup2:
|
||||
customhostgroup2:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup3:
|
||||
customhostgroup3:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup4:
|
||||
customhostgroup4:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup5:
|
||||
customhostgroup5:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup6:
|
||||
customhostgroup6:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup7:
|
||||
customhostgroup7:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup8:
|
||||
customhostgroup8:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup9:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup9:
|
||||
portgroups: *portgroupsdocker
|
||||
INPUT:
|
||||
hostgroups:
|
||||
anywhere:
|
||||
@@ -743,23 +733,23 @@ firewall:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup0:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup1:
|
||||
customhostgroup1:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup2:
|
||||
customhostgroup2:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup3:
|
||||
customhostgroup3:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup4:
|
||||
customhostgroup4:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup5:
|
||||
customhostgroup5:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup6:
|
||||
customhostgroup6:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup7:
|
||||
customhostgroup7:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup8:
|
||||
customhostgroup8:
|
||||
portgroups: *portgroupshost
|
||||
customhostgroup9:
|
||||
customhostgroup9:
|
||||
portgroups: *portgroupshost
|
||||
|
||||
heavynode:
|
||||
@@ -774,11 +764,9 @@ firewall:
|
||||
portgroups: *portgroupsdocker
|
||||
self:
|
||||
portgroups: *portgroupsdocker
|
||||
strelka_frontend:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup0:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup1:
|
||||
customhostgroup1:
|
||||
portgroups: *portgroupsdocker
|
||||
customhostgroup2:
|
||||
portgroups: *portgroupsdocker
|
||||
|
||||
@@ -231,16 +231,6 @@ logrotate:
|
||||
- dateext
|
||||
- dateyesterday
|
||||
- su root socore
|
||||
/nsm/strelka/log/strelka_x_log:
|
||||
- daily
|
||||
- rotate 14
|
||||
- missingok
|
||||
- copytruncate
|
||||
- compress
|
||||
- create
|
||||
- extension .log
|
||||
- dateext
|
||||
- dateyesterday
|
||||
/opt/so/log/sensor_clean_x_log:
|
||||
- daily
|
||||
- rotate 2
|
||||
|
||||
@@ -147,13 +147,6 @@ logrotate:
|
||||
multiline: True
|
||||
global: True
|
||||
forcedType: "[]string"
|
||||
"/nsm/strelka/log/strelka_x_log":
|
||||
description: List of logrotate options for this file.
|
||||
title: /nsm/strelka/log/strelka.log
|
||||
advanced: True
|
||||
multiline: True
|
||||
global: True
|
||||
forcedType: "[]string"
|
||||
"/opt/so/log/sensor_clean_x_log":
|
||||
description: List of logrotate options for this file.
|
||||
title: /opt/so/log/sensor_clean.log
|
||||
|
||||
@@ -89,7 +89,6 @@ so-logstash:
|
||||
- /nsm/zeek:/nsm/zeek:ro
|
||||
- /nsm/suricata:/suricata:ro
|
||||
- /opt/so/log/fleet/:/osquery/logs:ro
|
||||
- /opt/so/log/strelka:/strelka:ro
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-logstash'].custom_bind_mounts %}
|
||||
{% for BIND in DOCKERMERGED.containers['so-logstash'].custom_bind_mounts %}
|
||||
|
||||
@@ -23,7 +23,6 @@ VALID_ROLES = {
|
||||
'a': { 'role': 'analyst','desc': 'Analyst - 80/tcp, 443/tcp' },
|
||||
'b': { 'role': 'beats_endpoint', 'desc': 'Logstash Beat - 5044/tcp' },
|
||||
'e': { 'role': 'elasticsearch_rest', 'desc': 'Elasticsearch REST API - 9200/tcp' },
|
||||
'f': { 'role': 'strelka_frontend', 'desc': 'Strelka frontend - 57314/tcp' },
|
||||
's': { 'role': 'syslog', 'desc': 'Syslog device - 514/tcp/udp' },
|
||||
}
|
||||
|
||||
@@ -91,7 +90,6 @@ def main():
|
||||
group.add_argument('-a', dest='roles', action='append_const', const=VALID_ROLES['a']['role'], help="Analyst - 80/tcp, 443/tcp")
|
||||
group.add_argument('-b', dest='roles', action='append_const', const=VALID_ROLES['b']['role'], help="Logstash Beat - 5044/tcp")
|
||||
group.add_argument('-e', dest='roles', action='append_const', const=VALID_ROLES['e']['role'], help="Elasticsearch REST API - 9200/tcp")
|
||||
group.add_argument('-f', dest='roles', action='append_const', const=VALID_ROLES['f']['role'], help="Strelka frontend - 57314/tcp")
|
||||
group.add_argument('-s', dest='roles', action='append_const', const=VALID_ROLES['s']['role'], help="Syslog device - 514/tcp/udp")
|
||||
|
||||
ip_g = main_parser.add_argument_group(title='allow')
|
||||
|
||||
@@ -511,28 +511,6 @@ function add_redis_to_minion() {
|
||||
fi
|
||||
}
|
||||
|
||||
function add_strelka_to_minion() {
|
||||
printf '%s\n'\
|
||||
"strelka:"\
|
||||
" backend:"\
|
||||
" enabled: True"\
|
||||
" filestream:"\
|
||||
" enabled: True"\
|
||||
" frontend:"\
|
||||
" enabled: True"\
|
||||
" manager:"\
|
||||
" enabled: True"\
|
||||
" coordinator:"\
|
||||
" enabled: True"\
|
||||
" gatekeeper:"\
|
||||
" enabled: True"\
|
||||
" " >> $PILLARFILE
|
||||
if [ $? -ne 0 ]; then
|
||||
log "ERROR" "Failed to add strelka configuration to $PILLARFILE"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
function add_telegraf_to_minion() {
|
||||
printf '%s\n'\
|
||||
"telegraf:"\
|
||||
@@ -729,7 +707,6 @@ function createEVAL() {
|
||||
pcapspace || return 1
|
||||
add_elasticsearch_to_minion || return 1
|
||||
add_sensor_to_minion || return 1
|
||||
add_strelka_to_minion || return 1
|
||||
add_elastalert_to_minion || return 1
|
||||
add_kibana_to_minion || return 1
|
||||
add_telegraf_to_minion || return 1
|
||||
@@ -748,7 +725,6 @@ function createSTANDALONE() {
|
||||
add_elasticsearch_to_minion || return 1
|
||||
add_logstash_to_minion || return 1
|
||||
add_sensor_to_minion || return 1
|
||||
add_strelka_to_minion || return 1
|
||||
add_elastalert_to_minion || return 1
|
||||
add_kibana_to_minion || return 1
|
||||
add_redis_to_minion || return 1
|
||||
@@ -833,7 +809,6 @@ function createHEAVYNODE() {
|
||||
add_elasticsearch_to_minion || return 1
|
||||
add_elastic_agent_to_minion || return 1
|
||||
add_sensor_to_minion || return 1
|
||||
add_strelka_to_minion || return 1
|
||||
add_telegraf_to_minion || return 1
|
||||
}
|
||||
|
||||
@@ -844,7 +819,6 @@ function createSENSOR() {
|
||||
PCAP_PERCENTAGE=3
|
||||
pcapspace || return 1
|
||||
add_sensor_to_minion || return 1
|
||||
add_strelka_to_minion || return 1
|
||||
add_telegraf_to_minion || return 1
|
||||
}
|
||||
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
- strelka.config
|
||||
- strelka.backend.sostatus
|
||||
|
||||
backend_backend_config:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/backend/backend.yaml
|
||||
- source: salt://strelka/backend/files/backend.yaml.jinja
|
||||
- template: jinja
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
- defaults:
|
||||
BACKENDCONFIG: {{ STRELKAMERGED.backend.config.backend }}
|
||||
|
||||
backend_logging_config:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/backend/logging.yaml
|
||||
- source: salt://strelka/backend/files/logging.yaml.jinja
|
||||
- template: jinja
|
||||
- user: 939
|
||||
- group: 939
|
||||
- defaults:
|
||||
LOGGINGCONFIG: {{ STRELKAMERGED.backend.config.logging }}
|
||||
|
||||
backend_passwords:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/backend/passwords.dat
|
||||
- source: salt://strelka/backend/files/passwords.dat.jinja
|
||||
- template: jinja
|
||||
- user: 939
|
||||
- group: 939
|
||||
- defaults:
|
||||
PASSWORDS: {{ STRELKAMERGED.backend.config.passwords }}
|
||||
|
||||
backend_taste:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/backend/taste/taste.yara
|
||||
- source: salt://strelka/backend/files/taste/taste.yara
|
||||
- makedirs: True
|
||||
- user: 939
|
||||
- group: 939
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,27 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.backend.sostatus
|
||||
|
||||
so-strelka-backend:
|
||||
docker_container.absent:
|
||||
- force: True
|
||||
|
||||
so-strelka-backend_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-backend$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,69 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
include:
|
||||
- strelka.backend.config
|
||||
- strelka.backend.sostatus
|
||||
|
||||
strelka_backend:
|
||||
docker_container.running:
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-backend:{{ GLOBALS.so_version }}
|
||||
- binds:
|
||||
- /opt/so/conf/strelka/backend/:/etc/strelka/:ro
|
||||
- /opt/so/conf/strelka/rules/compiled/:/etc/yara/:ro
|
||||
{% if DOCKERMERGED.containers['so-strelka-backend'].custom_bind_mounts %}
|
||||
{% for BIND in DOCKERMERGED.containers['so-strelka-backend'].custom_bind_mounts %}
|
||||
- {{ BIND }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- name: so-strelka-backend
|
||||
- networks:
|
||||
- sobridge:
|
||||
- ipv4_address: {{ DOCKERMERGED.containers['so-strelka-backend'].ip }}
|
||||
- command: strelka-backend
|
||||
- extra_hosts:
|
||||
- {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
|
||||
{% if DOCKERMERGED.containers['so-strelka-backend'].extra_hosts %}
|
||||
{% for XTRAHOST in DOCKERMERGED.containers['so-strelka-backend'].extra_hosts %}
|
||||
- {{ XTRAHOST }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-backend'].extra_env %}
|
||||
- environment:
|
||||
{% for XTRAENV in DOCKERMERGED.containers['so-strelka-backend'].extra_env %}
|
||||
- {{ XTRAENV }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-backend'].ulimits %}
|
||||
- ulimits:
|
||||
{% for ULIMIT in DOCKERMERGED.containers['so-strelka-backend'].ulimits %}
|
||||
- {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- restart_policy: on-failure
|
||||
- watch:
|
||||
- file: strelkasensorcompiledrules
|
||||
- file: backend_backend_config
|
||||
- file: backend_logging_config
|
||||
- file: backend_passwords
|
||||
- file: backend_taste
|
||||
|
||||
delete_so-strelka-backend_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-backend$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1 +0,0 @@
|
||||
{{ BACKENDCONFIG | yaml(false) }}
|
||||
@@ -1 +0,0 @@
|
||||
{{ LOGGINGCONFIG | yaml(false) }}
|
||||
@@ -1 +0,0 @@
|
||||
{{ PASSWORDS | join('\n') }}
|
||||
@@ -1,748 +0,0 @@
|
||||
// Archive Files
|
||||
|
||||
rule _7zip_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
strings:
|
||||
$a = { 37 7A BC AF 27 1C }
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule arj_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
condition:
|
||||
uint16(0) == 0xEA60
|
||||
}
|
||||
|
||||
rule cab_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
strings:
|
||||
$a = { 4D 53 43 46 00 00 00 00 }
|
||||
condition:
|
||||
$a at 0 or
|
||||
( uint16(0) == 0x5A4D and $a )
|
||||
}
|
||||
|
||||
rule cpio_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
strings:
|
||||
$a = { 30 37 30 37 30 31 }
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule iso_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
strings:
|
||||
$a = { 43 44 30 30 31 }
|
||||
condition:
|
||||
$a at 0x8001 and $a at 0x8801 and $a at 0x9001
|
||||
}
|
||||
|
||||
rule mhtml_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
strings:
|
||||
$a = "MIME-Version: 1.0"
|
||||
$b = "This document is a Single File Web Page, also known as a Web Archive file"
|
||||
condition:
|
||||
$a at 0 and $b
|
||||
}
|
||||
|
||||
rule rar_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
condition:
|
||||
uint16(0) == 0x6152 and uint8(2) == 0x72 and uint16(3) == 0x1A21 and uint8(5) == 0x07
|
||||
}
|
||||
|
||||
rule tar_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
strings:
|
||||
$a = { 75 73 74 61 72 }
|
||||
condition:
|
||||
uint16(0) == 0x9D1F or
|
||||
uint16(0) == 0xA01F or
|
||||
$a at 257
|
||||
}
|
||||
|
||||
rule xar_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
condition:
|
||||
uint32(0) == 0x21726178
|
||||
}
|
||||
|
||||
rule zip_file
|
||||
{
|
||||
meta:
|
||||
type = "archive"
|
||||
condition:
|
||||
( uint32(0) == 0x04034B50 and not uint32(4) == 0x00060014 )
|
||||
}
|
||||
|
||||
// Audio Files
|
||||
|
||||
rule mp3_file
|
||||
{
|
||||
meta:
|
||||
type = "audio"
|
||||
condition:
|
||||
uint16(0) == 0x4449 and uint8(2) == 0x33
|
||||
}
|
||||
|
||||
// Certificate Files
|
||||
|
||||
rule pkcs7_file
|
||||
{
|
||||
meta:
|
||||
type = "certificate"
|
||||
strings:
|
||||
$a = "-----BEGIN PKCS7-----"
|
||||
condition:
|
||||
(uint16(0) == 0x8230 and uint16(4) == 0x0906) or
|
||||
uint32(0) == 0x09068030 or
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule x509_der_file
|
||||
{
|
||||
meta:
|
||||
type = "certificate"
|
||||
condition:
|
||||
uint16(0) == 0x8230 and ( uint16(4) == 0x8230 or uint16(4) == 0x8130 )
|
||||
}
|
||||
|
||||
rule x509_pem_file
|
||||
{
|
||||
meta:
|
||||
type = "certificate"
|
||||
strings:
|
||||
$a = "-----BEGIN CERTI"
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
// Compressed Files
|
||||
|
||||
rule bzip2_file
|
||||
{
|
||||
meta:
|
||||
type = "compressed"
|
||||
condition:
|
||||
uint16(0) == 0x5A42 and uint8(2) == 0x68
|
||||
}
|
||||
|
||||
rule gzip_file
|
||||
{
|
||||
meta:
|
||||
type = "compressed"
|
||||
condition:
|
||||
uint16(0) == 0x8B1F and uint8(2) == 0x08
|
||||
}
|
||||
|
||||
rule lzma_file
|
||||
{
|
||||
meta:
|
||||
type = "compressed"
|
||||
condition:
|
||||
uint16(0) == 0x005D and uint8(2) == 0x00
|
||||
}
|
||||
|
||||
rule xz_file
|
||||
{
|
||||
meta:
|
||||
type = "compressed"
|
||||
condition:
|
||||
uint32(0) == 0x587A37FD and uint16(4) == 0x005A
|
||||
}
|
||||
|
||||
// Document Files
|
||||
|
||||
rule doc_subheader_file
|
||||
{
|
||||
meta:
|
||||
type = "document"
|
||||
condition:
|
||||
uint32(0) == 0x00C1A5EC
|
||||
}
|
||||
|
||||
rule mso_file
|
||||
{
|
||||
meta:
|
||||
type = "document"
|
||||
strings:
|
||||
$a = { 3C 3F 6D 73 6F 2D 61 70 70 6C 69 63 61 74 69 6F 6E 20 } // <?mso-application
|
||||
$b = { 3C 3F 6D 73 6F 2D 63 6F 6E 74 65 6E 74 54 79 70 65 } // <?mso-contentType
|
||||
condition:
|
||||
$a at 0 or
|
||||
$b at 0
|
||||
}
|
||||
|
||||
rule olecf_file
|
||||
{
|
||||
meta:
|
||||
description = "Object Linking and Embedding (OLE) Compound File (CF)"
|
||||
type = "document"
|
||||
condition:
|
||||
uint32(0) == 0xE011CFD0 and uint32(4) == 0xE11AB1A1
|
||||
}
|
||||
|
||||
rule ooxml_file
|
||||
{
|
||||
meta:
|
||||
description = "Microsoft Office Open XML Format"
|
||||
type = "document"
|
||||
condition:
|
||||
uint32(0) == 0x04034B50 and uint32(4) == 0x00060014
|
||||
}
|
||||
|
||||
rule pdf_file
|
||||
{
|
||||
meta:
|
||||
description = "Portable Document Format"
|
||||
type = "document"
|
||||
condition:
|
||||
uint32(0) == 0x46445025
|
||||
}
|
||||
|
||||
rule poi_hpbf_file
|
||||
{
|
||||
meta:
|
||||
description = "https://poi.apache.org/components/hpbf/file-format.html"
|
||||
type = "document"
|
||||
strings:
|
||||
$a = { 43 48 4E 4B 49 4E 4B } // CHNKINK
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule rtf_file
|
||||
{
|
||||
meta:
|
||||
type = "document"
|
||||
condition:
|
||||
uint32(0) == 0x74725C7B
|
||||
}
|
||||
|
||||
rule vbframe_file
|
||||
{
|
||||
meta:
|
||||
type = "document"
|
||||
strings:
|
||||
$a = { 56 45 52 53 49 4F 4E 20 35 2E 30 30 0D 0A 42 65 67 69 6E } // VERSION 5.00\r\nBegin
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule wordml_file
|
||||
{
|
||||
meta:
|
||||
description = "Microsoft Office Word 2003 XML format"
|
||||
type = "document"
|
||||
strings:
|
||||
$a = { 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D } // <?xml version=
|
||||
$b = "http://schemas.microsoft.com/office/word/2003/wordml"
|
||||
condition:
|
||||
$a at 0 and $b
|
||||
}
|
||||
|
||||
rule xfdf_file
|
||||
{
|
||||
meta:
|
||||
description = "XML Forms Data Format"
|
||||
type = "document"
|
||||
strings:
|
||||
$a = { 3C 78 66 64 66 20 78 6D 6C 6E 73 3D } // <xfdf xmlns=
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
// Email Files
|
||||
|
||||
rule email_file
|
||||
{
|
||||
meta:
|
||||
type = "email"
|
||||
strings:
|
||||
$a = "\x0aReceived:" nocase fullword
|
||||
$b = "\x0AReturn-Path:" nocase fullword
|
||||
$c = "\x0aMessage-ID:" nocase fullword
|
||||
$d = "\x0aReply-To:" nocase fullword
|
||||
$e = "\x0aX-Mailer:" nocase fullword
|
||||
condition:
|
||||
$a in (0..2048) or
|
||||
$b in (0..2048) or
|
||||
$c in (0..2048) or
|
||||
$d in (0..2048) or
|
||||
$e in (0..2048)
|
||||
}
|
||||
|
||||
rule tnef_file
|
||||
{
|
||||
meta:
|
||||
description = "Transport Neutral Encapsulation Format"
|
||||
type = "email"
|
||||
condition:
|
||||
uint32(0) == 0x223E9F78
|
||||
}
|
||||
|
||||
// Encryption Files
|
||||
|
||||
rule pgp_file
|
||||
{
|
||||
meta:
|
||||
type = "encryption"
|
||||
strings:
|
||||
$a = { ?? ?? 2D 2D 2D 42 45 47 49 4E 20 50 47 50 20 50 55 42 4C 49 43 20 4B 45 59 20 42 4C 4F 43 4B 2D } // (.{2})(\x2D\x2D\x2DBEGIN PGP PUBLIC KEY BLOCK\x2D)
|
||||
$b = { ?? ?? 2D 2D 2D 42 45 47 49 4E 20 50 47 50 20 53 49 47 4E 41 54 55 52 45 2D } // (\x2D\x2D\x2D\x2D\x2DBEGIN PGP SIGNATURE\x2D)
|
||||
$c = { ?? ?? 2D 2D 2D 42 45 47 49 4E 20 50 47 50 20 4D 45 53 53 41 47 45 2D } // (\x2D\x2D\x2D\x2D\x2DBEGIN PGP MESSAGE\x2D)
|
||||
condition:
|
||||
$a at 0 or
|
||||
$b at 0 or
|
||||
$c at 0
|
||||
}
|
||||
|
||||
// Executable Files
|
||||
|
||||
rule elf_file
|
||||
{
|
||||
meta:
|
||||
description = "Executable and Linkable Format"
|
||||
type = "executable"
|
||||
condition:
|
||||
uint32(0) == 0x464C457F
|
||||
}
|
||||
|
||||
rule lnk_file
|
||||
{
|
||||
meta:
|
||||
description = "Windows Shortcut file"
|
||||
type = "executable"
|
||||
condition:
|
||||
uint32(0) == 0x0000004C
|
||||
}
|
||||
|
||||
rule macho_file
|
||||
{
|
||||
meta:
|
||||
description = "Mach object"
|
||||
type = "executable"
|
||||
condition:
|
||||
uint32(0) == 0xCEFAEDFE or
|
||||
uint32(0) == 0xCFFAEDFE or
|
||||
uint32(0) == 0xFEEDFACE or
|
||||
uint32(0) == 0xFEEDFACF
|
||||
}
|
||||
|
||||
rule mz_file
|
||||
{
|
||||
meta:
|
||||
description = "DOS MZ executable"
|
||||
type = "executable"
|
||||
condition:
|
||||
uint16(0) == 0x5A4D
|
||||
}
|
||||
|
||||
// Image Files
|
||||
|
||||
rule bmp_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
strings:
|
||||
$a = { 42 4D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ( 0C | 28 | 40 | 6C | 7C | 80 ) 00 } // BM
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule cmap_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
strings:
|
||||
$a = { 62 65 67 69 6E 63 6D 61 70 } // begincmap
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule gif_file
|
||||
{
|
||||
meta:
|
||||
description = "Graphics Interchange Format"
|
||||
type = "image"
|
||||
condition:
|
||||
uint32(0) == 0x38464947 and ( uint16(4) == 0x6137 or uint16(4) == 0x6139 )
|
||||
}
|
||||
|
||||
rule jpeg_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
condition:
|
||||
uint32(0) == 0xE0FFD8FF or
|
||||
uint32(0) == 0xE1FFD8FF or
|
||||
uint32(0) == 0xE2FFD8FF or
|
||||
uint32(0) == 0xE8FFD8FF
|
||||
}
|
||||
|
||||
rule postscript_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
strings:
|
||||
$a = { 25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 } // %!PS-Adobe-3.0
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule png_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
condition:
|
||||
uint32(0) == 0x474E5089
|
||||
}
|
||||
|
||||
rule psd_file
|
||||
{
|
||||
meta:
|
||||
description = "Photoshop Document"
|
||||
type = "image"
|
||||
condition:
|
||||
uint32(0) == 0x53504238
|
||||
}
|
||||
|
||||
rule psd_image_file
|
||||
{
|
||||
meta:
|
||||
description = "Photoshop Document image resource block"
|
||||
type = "image"
|
||||
condition:
|
||||
uint32(0) == 0x4D494238
|
||||
}
|
||||
|
||||
rule svg_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
strings:
|
||||
$a = { 3C 73 76 67 20 } // <svg
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule xicc_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
strings:
|
||||
$a = { 58 49 43 43 5F 50 52 4F 46 49 4C 45 } // XICC_PROFILE
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule xmp_file
|
||||
{
|
||||
meta:
|
||||
type = "image"
|
||||
strings:
|
||||
$a = { 3C 3F 78 70 61 63 6B 65 74 20 62 65 67 69 6E 3D } // <?xpacket begin=
|
||||
$b = { 3C 78 3A 78 6D 70 6D 65 74 61 20 78 6D 6C 6E 73 3A 78 3D } // <x:xmpmeta xmlns:x=
|
||||
condition:
|
||||
$a at 0 or $b at 0
|
||||
}
|
||||
|
||||
// Metadata Files
|
||||
|
||||
rule jar_manifest_file
|
||||
{
|
||||
meta:
|
||||
type = "metadata"
|
||||
condition:
|
||||
uint32(0) == 0x696E614D and uint32(4) == 0x74736566
|
||||
}
|
||||
|
||||
rule bplist_file
|
||||
{
|
||||
meta:
|
||||
description = "Binary Property List"
|
||||
type = "metadata"
|
||||
condition:
|
||||
uint32(0) == 0x696C7062 and uint32(4) == 0x30307473
|
||||
}
|
||||
|
||||
// Multimedia Files
|
||||
|
||||
rule fws_file
|
||||
{
|
||||
meta:
|
||||
type = "multimedia"
|
||||
condition:
|
||||
uint16(0) == 0x5746 and uint8(2) == 0x53
|
||||
}
|
||||
|
||||
rule cws_file
|
||||
{
|
||||
meta:
|
||||
description = "zlib compressed Flash file"
|
||||
type = "multimedia"
|
||||
condition:
|
||||
uint16(0) == 0x5743 and uint8(2) == 0x53
|
||||
}
|
||||
|
||||
|
||||
rule zws_file
|
||||
{
|
||||
meta:
|
||||
description = "LZMA compressed Flash file"
|
||||
type = "multimedia"
|
||||
condition:
|
||||
uint16(0) == 0x575A and uint8(2) == 0x53
|
||||
}
|
||||
|
||||
// Package Files
|
||||
|
||||
rule debian_package_file
|
||||
{
|
||||
meta:
|
||||
type = "package"
|
||||
strings:
|
||||
$a = { 21 3C 61 72 63 68 3E 0A 64 65 62 69 61 6E } // \x21\x3Carch\x3E\x0Adebian
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule rpm_file
|
||||
{
|
||||
meta:
|
||||
type = "package"
|
||||
condition:
|
||||
uint32(0) == 0x6D707264 or uint32(0) == 0xDBEEABED
|
||||
}
|
||||
|
||||
// Packer Files
|
||||
|
||||
rule upx_file
|
||||
{
|
||||
meta:
|
||||
description = "Ultimate Packer for Executables"
|
||||
type = "packer"
|
||||
strings:
|
||||
$a = {55505830000000}
|
||||
$b = {55505831000000}
|
||||
$c = "UPX!"
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and
|
||||
$a in (0..1024) and
|
||||
$b in (0..1024) and
|
||||
$c in (0..1024)
|
||||
}
|
||||
|
||||
// Script Files
|
||||
|
||||
rule batch_file
|
||||
{
|
||||
meta:
|
||||
type = "script"
|
||||
strings:
|
||||
$a = { ( 45 | 65 ) ( 43 | 63 ) ( 48 | 68 ) ( 4F | 6F ) 20 ( 4F | 6F) ( 46 | 66 ) ( 46 | 66 ) } // [Ee][Cc][Hh][Oo] [Oo][Ff][Ff]
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule javascript_file
|
||||
{
|
||||
meta:
|
||||
type = "script"
|
||||
strings:
|
||||
$var = { 76 61 72 20 } // var
|
||||
$function1 = { 66 75 6E 63 74 69 6F 6E } // function
|
||||
$function2 = { 28 66 75 6E 63 74 69 6F 6E } // (function
|
||||
$function3 = { 66 75 6E 63 74 69 6F 6E [0-1] 28 } // function[0-1](
|
||||
$if = { 69 66 [0-1] 28 } // if[0-1](
|
||||
$misc1 = { 24 28 } // $(
|
||||
$misc2 = { 2F ( 2A | 2F ) } // \/(\/|\*)
|
||||
$jquery = { 6A 51 75 65 72 79 } // jQuery
|
||||
$try = { 74 72 79 [0-1] 7B } // try[0-1]{
|
||||
$catch = { 63 61 74 63 68 28 } // catch(
|
||||
$push = { 2E 70 75 73 68 28 } // .push(
|
||||
$array = { 6E 65 77 20 41 72 72 61 79 28 } // new Array(
|
||||
$document1 = { 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 } // document.create
|
||||
$document2 = { 64 6F 63 75 6D 65 6E 74 2E 77 72 69 74 65 } // document.write
|
||||
$window = { 77 69 6E 64 6F 77 ( 2E | 5B ) } // window[.\[]
|
||||
$define = { 64 65 66 69 6E 65 28 } // define(
|
||||
$eval = { 65 76 61 6C 28 } // eval(
|
||||
$unescape = { 75 6E 65 73 63 61 70 65 28 } // unescape(
|
||||
condition:
|
||||
$var at 0 or
|
||||
$function1 at 0 or
|
||||
$function2 at 0 or
|
||||
$if at 0 or
|
||||
$jquery at 0 or
|
||||
$function3 in (0..30) or
|
||||
$push in (0..30) or
|
||||
$array in (0..30) or
|
||||
( $try at 0 and $catch in (5..5000) ) or
|
||||
$document1 in (0..100) or
|
||||
$document2 in (0..100) or
|
||||
$window in (0..100) or
|
||||
$define in (0..100) or
|
||||
$eval in (0..100) or
|
||||
$unescape in (0..100) or
|
||||
( ( $misc1 at 0 or $misc2 at 0 ) and $var and $function1 and $if )
|
||||
}
|
||||
|
||||
rule vb_file
|
||||
{
|
||||
meta:
|
||||
type = "script"
|
||||
strings:
|
||||
$a = { 41 74 74 72 69 62 75 74 65 20 56 42 5F 4E 61 6D 65 20 3D } // Attribute VB_Name =
|
||||
$b = { 4F 70 74 69 6F 6E 20 45 78 70 6C 69 63 69 74 } // Option Explicit
|
||||
$c = { 44 69 6D 20 } // Dim
|
||||
$d = { 50 75 62 6C 69 63 20 53 75 62 20 } // Public Sub
|
||||
$e = { 50 72 69 76 61 74 65 20 53 75 62 20 } // Private Sub
|
||||
condition:
|
||||
$a at 0 or
|
||||
$b at 0 or
|
||||
$c at 0 or
|
||||
$d at 0 or
|
||||
$e at 0
|
||||
}
|
||||
|
||||
// Text Files
|
||||
|
||||
rule hta_file
|
||||
{
|
||||
meta:
|
||||
type = "text"
|
||||
strings:
|
||||
$a = { 3C 48 54 41 3A 41 50 50 4C 49 43 41 54 49 4F 4E 20 } // <HTA:APPLICATION
|
||||
condition:
|
||||
$a in (0..2000)
|
||||
}
|
||||
|
||||
rule html_file
|
||||
{
|
||||
meta:
|
||||
type = "text"
|
||||
strings:
|
||||
$a = { 3C 21 ( 64 | 44 ) ( 6F | 4F ) ( 63 |43 ) ( 74 | 54 ) ( 79 | 59 ) ( 70 | 50 ) ( 65 | 45 ) 20 ( 68 | 48 ) ( 74 | 54 ) ( 6D | 4D ) ( 6C | 4C ) } // <![Dd][Oo][Cc][Tt][Yy][Pp][Ee] [Hh][Tt][Mm][Ll]
|
||||
$b = { 3C ( 68 | 48 ) ( 74 | 54 ) ( 6D | 4D ) ( 6C | 4C ) } // <[Hh][Tt][Mm][Ll]
|
||||
$c = { 3C ( 62 | 42 ) ( 72 | 52 ) } // <br
|
||||
$d = { 3C ( 44 | 64 ) ( 49 | 69 ) ( 56 | 76 ) } // <[Dd][Ii][Vv]
|
||||
$e = { 3C ( 41 | 61 ) 20 ( 48 |68 ) ( 52 | 72 ) ( 45 | 65 ) ( 46 | 66 ) 3D } // <[Aa] [Hh][Rr][Ee][Ff]=
|
||||
$f = { 3C ( 48 | 68 ) ( 45 | 65 ) ( 41 | 61 ) ( 44 | 64 ) } // <[Hh][Ee][Aa][Dd]
|
||||
$g = { 3C ( 53 | 73 ) ( 43 | 63 ) ( 52 | 72 ) ( 49 | 69 ) ( 50 | 70 ) ( 54 | 74 ) } // <[Ss][Cc][Rr][Ii][Pp][Tt]
|
||||
$h = { 3C ( 53 | 73 ) ( 54 | 74 ) ( 59 | 79 ) ( 4C | 6C ) ( 45 | 65 ) } // <[Ss][Tt][Yy][Ll][Ee]
|
||||
$i = { 3C ( 54 | 74 ) ( 41 | 61 ) ( 42 | 62 ) ( 4C | 6C ) ( 45 | 65 ) } // <[Tt][Aa][Bb][Ll][Ee]
|
||||
$j = { 3C ( 50 | 70 ) } // <[Pp]
|
||||
$k = { 3C ( 49 | 69 ) ( 4D | 6D ) ( 47 | 67 ) } // <[Ii][Mm][Gg]
|
||||
$l = { 3C ( 53 | 73 ) ( 50 |70 ) ( 41 | 61 ) ( 4E | 6E ) } // <[Ss][Pp][Aa][Nn]
|
||||
$m = { 3C ( 48 | 68 ) ( 52 | 72 | 31 | 32 | 33 | 34 | 35 | 36 ) } // <[Hh][Rr] <[Hh][1-6]
|
||||
$n = { 3C ( 54 | 74) ( 49 | 69 ) ( 54 | 74 ) ( 4C | 6C ) ( 45 | 65 ) 3E } // <[Tt][Ii][Tt][Ll][Ee]>
|
||||
condition:
|
||||
$a at 0 or
|
||||
$b at 0 or
|
||||
$c at 0 or
|
||||
$d at 0 or
|
||||
$e at 0 or
|
||||
$f at 0 or
|
||||
$g at 0 or
|
||||
$h at 0 or
|
||||
$i at 0 or
|
||||
$j at 0 or
|
||||
$k at 0 or
|
||||
$l at 0 or
|
||||
$m at 0 or
|
||||
$n at 0
|
||||
}
|
||||
|
||||
rule json_file
|
||||
{
|
||||
meta:
|
||||
type = "text"
|
||||
strings:
|
||||
$a = { 7B [0-5] 22 }
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule php_file
|
||||
{
|
||||
meta:
|
||||
type = "text"
|
||||
strings:
|
||||
$a = { 3c 3f 70 68 70 }
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule soap_file
|
||||
{
|
||||
meta:
|
||||
description = "Simple Object Access Protocol"
|
||||
type = "text"
|
||||
strings:
|
||||
$a = { 3C 73 6F 61 70 65 6E 76 3A 45 6E 76 65 6C 6F 70 65 } // <soapenv:Envelope xmlns
|
||||
$b = { 3C 73 3A 45 6E 76 65 6C 6F 70 65 } // <s:Envelope
|
||||
condition:
|
||||
$a at 0 or
|
||||
$b at 0
|
||||
}
|
||||
|
||||
rule xml_file
|
||||
{
|
||||
meta:
|
||||
type = "text"
|
||||
strings:
|
||||
$a = { 3C 3F ( 58 | 78) ( 4D | 6D ) ( 4C | 6C ) 20 76 65 72 73 69 6F 6E 3D } // <?[Xx][Mm][Ll] version=
|
||||
$b = { 3C 3F 78 6D 6C 3F 3E } // <?xml?>
|
||||
$c = { 3C 73 74 79 6C 65 53 68 65 65 74 20 78 6D 6C 6E 73 3D } // <styleSheet xmlns=
|
||||
$d = { 3C 77 6F 72 6B 62 6F 6F 6B 20 78 6D 6C 6E 73 } // <workbook xmlns
|
||||
$e = { 3C 78 6D 6C 20 78 6D 6C 6E 73 } // <xml xmlns
|
||||
$f = { 3C 69 6E 74 20 78 6D 6C 6E 73 } // <int xmlns
|
||||
condition:
|
||||
$a at 0 or
|
||||
$b at 0 or
|
||||
$c at 0 or
|
||||
$d at 0 or
|
||||
$e at 0 or
|
||||
$f at 0
|
||||
}
|
||||
|
||||
// Video Files
|
||||
|
||||
rule avi_file
|
||||
{
|
||||
meta:
|
||||
type = "video"
|
||||
strings:
|
||||
$a = { 52 49 46 46 ?? ?? ?? ?? 41 56 49 20 4C 49 53 54 }
|
||||
condition:
|
||||
$a at 0
|
||||
}
|
||||
|
||||
rule wmv_file
|
||||
{
|
||||
meta:
|
||||
type = "video"
|
||||
condition:
|
||||
uint32(0) == 0x75B22630 and uint32(4) == 0x11CF668E and uint32(8) == 0xAA00D9A6 and uint32(12) == 0x6CCE6200
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
{% if STRELKAMERGED.backend.enabled %}
|
||||
- strelka.backend.enabled
|
||||
{% else %}
|
||||
- strelka.backend.disabled
|
||||
{% endif %}
|
||||
@@ -1,21 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
append_so-strelka-backend_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-strelka-backend
|
||||
- unless: grep -q so-strelka-backend /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,99 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
import argparse
|
||||
import glob
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import yara
|
||||
from datetime import datetime
|
||||
from concurrent.futures import ThreadPoolExecutor
|
||||
|
||||
def check_syntax(rule_file):
|
||||
try:
|
||||
# Testing if compilation throws a syntax error, don't save the result
|
||||
yara.compile(filepath=rule_file)
|
||||
return (True, rule_file, None)
|
||||
except yara.SyntaxError as e:
|
||||
# Return the error message for logging purposes
|
||||
return (False, rule_file, str(e))
|
||||
|
||||
def compile_yara_rules(rules_dir):
|
||||
compiled_dir = os.path.join(rules_dir, "compiled")
|
||||
compiled_rules_path = "/opt/so/saltstack/local/salt/strelka/rules/compiled/rules.compiled"
|
||||
rule_files = glob.glob(os.path.join(rules_dir, '**/*.yar'), recursive=True)
|
||||
files_to_compile = {}
|
||||
removed_count = 0
|
||||
success_count = 0
|
||||
|
||||
# Use ThreadPoolExecutor to parallelize syntax checks
|
||||
with ThreadPoolExecutor() as executor:
|
||||
results = executor.map(check_syntax, rule_files)
|
||||
|
||||
# Collect yara files and prepare for batch compilation
|
||||
ts = str(datetime.utcnow().isoformat())
|
||||
failure_ids = []
|
||||
success_ids = []
|
||||
for success, rule_file, error_message in results:
|
||||
rule_id = os.path.splitext(os.path.basename(rule_file))[0]
|
||||
if success:
|
||||
files_to_compile[os.path.basename(rule_file)] = rule_file
|
||||
success_count += 1
|
||||
success_ids.append(rule_id)
|
||||
else:
|
||||
failure_ids.append(rule_id)
|
||||
# Extract just the UUID from the rule file name
|
||||
log_entry = {
|
||||
"event_module": "soc",
|
||||
"event_dataset": "soc.detections",
|
||||
"log.level": "error",
|
||||
"error_message": error_message,
|
||||
"error_analysis": "Syntax Error",
|
||||
"detection_type": "YARA",
|
||||
"rule_uuid": rule_id,
|
||||
"error_type": "runtime_status"
|
||||
}
|
||||
with open('/opt/sensoroni/logs/detections_runtime-status_yara.log', 'a') as log_file:
|
||||
json.dump(log_entry, log_file)
|
||||
log_file.write('\n') # Ensure new entries start on new lines
|
||||
os.remove(rule_file)
|
||||
removed_count += 1
|
||||
|
||||
# Compile all remaining valid rules into a single file
|
||||
compiled_sha256=""
|
||||
if files_to_compile:
|
||||
compiled_rules = yara.compile(filepaths=files_to_compile)
|
||||
compiled_rules.save(compiled_rules_path)
|
||||
print(f"All remaining rules compiled and saved into {compiled_rules_path}")
|
||||
# Hash file
|
||||
with open(compiled_rules_path, 'rb') as hash_file:
|
||||
compiled_sha256=hashlib.sha256(hash_file.read()).hexdigest()
|
||||
# Remove the rules.compiled if there aren't any files to be compiled
|
||||
else:
|
||||
if os.path.exists(compiled_rules_path):
|
||||
os.remove(compiled_rules_path)
|
||||
|
||||
# Create compilation report
|
||||
compilation_report = {
|
||||
"timestamp": ts,
|
||||
"compiled_sha256": compiled_sha256,
|
||||
"failure": failure_ids,
|
||||
"success": success_ids
|
||||
}
|
||||
|
||||
# Write total
|
||||
with open('/opt/so/state/detections_yara_compilation-total.log', 'w+') as report_file:
|
||||
json.dump(compilation_report, report_file)
|
||||
|
||||
# Print summary of compilation results
|
||||
print(f"Summary: {success_count} rules compiled successfully, {removed_count} rules removed due to errors.")
|
||||
|
||||
if __name__ == "__main__":
|
||||
parser = argparse.ArgumentParser(description="Compile YARA rules from the specified directory")
|
||||
parser.add_argument("rules_dir", help="Directory containing YARA rules to compile")
|
||||
args = parser.parse_args()
|
||||
|
||||
compile_yara_rules(args.rules_dir)
|
||||
@@ -1,64 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
{% if GLOBALS.is_manager %}
|
||||
include:
|
||||
- strelka.manager
|
||||
{% endif %}
|
||||
|
||||
# Strelka config
|
||||
strelkasensorcompiledrules:
|
||||
file.recurse:
|
||||
- name: /opt/so/conf/strelka/rules/compiled/
|
||||
- source: salt://strelka/rules/compiled/
|
||||
- user: 939
|
||||
- group: 939
|
||||
- clean: True
|
||||
- makedirs: True
|
||||
|
||||
strelkadatadir:
|
||||
file.directory:
|
||||
- name: /nsm/strelka
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
strelkalogdir:
|
||||
file.directory:
|
||||
- name: /nsm/strelka/log
|
||||
- user: 939
|
||||
- group: 939
|
||||
|
||||
strelkagkredisdatadir:
|
||||
file.directory:
|
||||
- name: /nsm/strelka/gk-redis-data
|
||||
- user: 939
|
||||
- group: 939
|
||||
|
||||
strelkacoordredisdatadir:
|
||||
file.directory:
|
||||
- name: /nsm/strelka/coord-redis-data
|
||||
- user: 939
|
||||
- group: 939
|
||||
|
||||
strelka_sbin:
|
||||
file.recurse:
|
||||
- name: /usr/sbin
|
||||
- source: salt://strelka/tools/sbin
|
||||
- user: 939
|
||||
- group: 939
|
||||
- file_mode: 755
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,19 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.config
|
||||
- strelka.coordinator.sostatus
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,27 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.coordinator.sostatus
|
||||
|
||||
so-strelka-coordinator:
|
||||
docker_container.absent:
|
||||
- force: True
|
||||
|
||||
so-strelka-coordinator_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-coordinator$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,64 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
include:
|
||||
- strelka.coordinator.config
|
||||
- strelka.coordinator.sostatus
|
||||
|
||||
strelka_coordinator:
|
||||
docker_container.running:
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-redis:{{ GLOBALS.so_version }}
|
||||
- name: so-strelka-coordinator
|
||||
- networks:
|
||||
- sobridge:
|
||||
- ipv4_address: {{ DOCKERMERGED.containers['so-strelka-coordinator'].ip }}
|
||||
- entrypoint: redis-server --save "" --appendonly no
|
||||
- extra_hosts:
|
||||
- {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
|
||||
{% if DOCKERMERGED.containers['so-strelka-coordinator'].extra_hosts %}
|
||||
{% for XTRAHOST in DOCKERMERGED.containers['so-strelka-coordinator'].extra_hosts %}
|
||||
- {{ XTRAHOST }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- port_bindings:
|
||||
{% for BINDING in DOCKERMERGED.containers['so-strelka-coordinator'].port_bindings %}
|
||||
- {{ BINDING }}
|
||||
{% endfor %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-coordinator'].extra_env %}
|
||||
- environment:
|
||||
{% for XTRAENV in DOCKERMERGED.containers['so-strelka-coordinator'].extra_env %}
|
||||
- {{ XTRAENV }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- binds:
|
||||
- /nsm/strelka/coord-redis-data:/data:rw
|
||||
{% if DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %}
|
||||
{% for BIND in DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %}
|
||||
- {{ BIND }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-coordinator'].ulimits %}
|
||||
- ulimits:
|
||||
{% for ULIMIT in DOCKERMERGED.containers['so-strelka-coordinator'].ulimits %}
|
||||
- {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
delete_so-strelka-coordinator_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-coordinator$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,13 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
{% if STRELKAMERGED.coordinator.enabled %}
|
||||
- strelka.coordinator.enabled
|
||||
{% else %}
|
||||
- strelka.coordinator.disabled
|
||||
{% endif %}
|
||||
@@ -1,21 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
append_so-strelka-coordinator_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-strelka-coordinator
|
||||
- unless: grep -q so-strelka-coordinator /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,739 +0,0 @@
|
||||
strelka:
|
||||
backend:
|
||||
enabled: False
|
||||
config:
|
||||
backend:
|
||||
logging_cfg: '/etc/strelka/logging.yaml'
|
||||
limits:
|
||||
max_files: 0
|
||||
time_to_live: 0
|
||||
max_depth: 15
|
||||
distribution: 600
|
||||
scanner: 150
|
||||
coordinator:
|
||||
addr: 'HOST:6380'
|
||||
db: 0
|
||||
tasting:
|
||||
mime_db: '/usr/lib/file/magic.mgc'
|
||||
yara_rules: '/etc/strelka/taste/'
|
||||
scanners:
|
||||
'ScanBase64PE':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'base64_pe'
|
||||
priority: 5
|
||||
'ScanBatch':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/x-msdos-batch'
|
||||
- 'batch_file'
|
||||
priority: 5
|
||||
'ScanBmpEof':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/x-ms-bmp'
|
||||
- 'bmp_file'
|
||||
negative:
|
||||
source:
|
||||
- 'ScanTranscode'
|
||||
priority: 5
|
||||
'ScanBzip2':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-bzip2'
|
||||
- 'bzip2_file'
|
||||
priority: 5
|
||||
'ScanDmg':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'dmg_disk_image'
|
||||
- 'hfsplus_disk_image'
|
||||
priority: 5
|
||||
'ScanDocx':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
|
||||
priority: 5
|
||||
options:
|
||||
extract_text: False
|
||||
'ScanDonut':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'hacktool_win_shellcode_donut'
|
||||
priority: 5
|
||||
'ScanElf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-object'
|
||||
- 'application/x-executable'
|
||||
- 'application/x-sharedlib'
|
||||
- 'application/x-coredump'
|
||||
- 'elf_file'
|
||||
priority: 5
|
||||
'ScanEmail':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.ms-outlook'
|
||||
- 'message/rfc822'
|
||||
- 'email_file'
|
||||
priority: 5
|
||||
'ScanEncryptedDoc':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'encrypted_word_document'
|
||||
priority: 5
|
||||
options:
|
||||
max_length: 5
|
||||
scanner_timeout: 150
|
||||
log_pws: True
|
||||
password_file: "/etc/strelka/passwords.dat"
|
||||
'ScanEncryptedZip':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'encrypted_zip'
|
||||
priority: 5
|
||||
options:
|
||||
max_length: 5
|
||||
scanner_timeout: 150
|
||||
log_pws: True
|
||||
password_file: '/etc/strelka/passwords.dat'
|
||||
'ScanEntropy':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
'ScanExiftool':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/msword'
|
||||
- 'application/vnd.openxmlformats-officedocument'
|
||||
- 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
|
||||
- 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
|
||||
- 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
|
||||
- 'olecf_file'
|
||||
- 'ooxml_file'
|
||||
- 'audio/mpeg'
|
||||
- 'mp3_file'
|
||||
- 'mhtml_file'
|
||||
- 'application/pdf'
|
||||
- 'pdf_file'
|
||||
- 'text/rtf'
|
||||
- 'rtf_file'
|
||||
- 'wordml_file'
|
||||
- 'application/x-dosexec'
|
||||
- 'mz_file'
|
||||
- 'application/x-object'
|
||||
- 'application/x-executable'
|
||||
- 'application/x-sharedlib'
|
||||
- 'application/x-coredump'
|
||||
- 'elf_file'
|
||||
- 'lnk_file'
|
||||
- 'application/x-mach-binary'
|
||||
- 'macho_file'
|
||||
- 'image/gif'
|
||||
- 'gif_file'
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
- 'image/png'
|
||||
- 'png_file'
|
||||
- 'image/tiff'
|
||||
- 'type_is_tiff'
|
||||
- 'image/x-ms-bmp'
|
||||
- 'bmp_file'
|
||||
- 'application/x-shockwave-flash'
|
||||
- 'fws_file'
|
||||
- 'psd_file'
|
||||
- 'video/mp4'
|
||||
- 'video/quicktime'
|
||||
- 'video/x-msvideo'
|
||||
- 'avi_file'
|
||||
- 'video/x-ms-wmv'
|
||||
- 'wmv_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanFooter':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
options:
|
||||
length: 50
|
||||
encodings:
|
||||
- classic
|
||||
- backslash
|
||||
'ScanGif':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/gif'
|
||||
- 'gif_file'
|
||||
priority: 5
|
||||
'ScanGzip':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/gzip'
|
||||
- 'application/x-gzip'
|
||||
- 'gzip_file'
|
||||
priority: 5
|
||||
'ScanHash':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
'ScanHeader':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
options:
|
||||
length: 50
|
||||
'ScanHtml':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'hta_file'
|
||||
- 'text/html'
|
||||
- 'html_file'
|
||||
priority: 5
|
||||
options:
|
||||
max_hyperlinks: 50
|
||||
'ScanIqy':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'iqy_file'
|
||||
priority: 5
|
||||
'ScanIni':
|
||||
- positive:
|
||||
filename: '(\.([Cc][Ff][Gg]|[Ii][Nn][Ii])|PROJECT)$'
|
||||
flavors:
|
||||
- 'ini_file'
|
||||
priority: 5
|
||||
'ScanIso':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-iso9660-image'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 50
|
||||
'ScanJarManifest':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'jar_manifest_file'
|
||||
priority: 5
|
||||
'ScanJavascript':
|
||||
- negative:
|
||||
flavors:
|
||||
- 'text/html'
|
||||
- 'html_file'
|
||||
positive:
|
||||
flavors:
|
||||
- 'javascript_file'
|
||||
- 'text/javascript'
|
||||
priority: 5
|
||||
options:
|
||||
beautify: True
|
||||
'ScanJpeg':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
priority: 5
|
||||
'ScanJson':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/json'
|
||||
- 'json_file'
|
||||
priority: 5
|
||||
'ScanLibarchive':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.ms-cab-compressed'
|
||||
- 'cab_file'
|
||||
- 'application/x-7z-compressed'
|
||||
- '_7zip_file'
|
||||
- 'application/x-cpio'
|
||||
- 'cpio_file'
|
||||
- 'application/x-xar'
|
||||
- 'xar_file'
|
||||
- 'arj_file'
|
||||
- 'iso_file'
|
||||
- 'application/x-debian-package'
|
||||
- 'debian_package_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanLNK':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'lnk_file'
|
||||
priority: 5
|
||||
'ScanLsb':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/png'
|
||||
- 'png_file'
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
- 'image/x-ms-bmp'
|
||||
- 'bmp_file'
|
||||
- 'image/webp'
|
||||
negative:
|
||||
source:
|
||||
- 'ScanTranscode'
|
||||
priority: 5
|
||||
'ScanLzma':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-lzma'
|
||||
- 'lzma_file'
|
||||
- 'application/x-xz'
|
||||
- 'xz_file'
|
||||
priority: 5
|
||||
'ScanMacho':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-mach-binary'
|
||||
- 'macho_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanManifest':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'browser_manifest'
|
||||
priority: 5
|
||||
'ScanMsi':
|
||||
- positive:
|
||||
flavors:
|
||||
- "image/vnd.fpx"
|
||||
- "application/vnd.ms-msi"
|
||||
- "application/x-msi"
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
keys:
|
||||
- 'Author'
|
||||
- 'Characters'
|
||||
- 'Company'
|
||||
- 'CreateDate'
|
||||
- 'LastModifiedBy'
|
||||
- 'Lines'
|
||||
- 'ModifyDate'
|
||||
- 'Pages'
|
||||
- 'Paragraphs'
|
||||
- 'RevisionNumber'
|
||||
- 'Software'
|
||||
- 'Template'
|
||||
- 'Title'
|
||||
- 'TotalEditTime'
|
||||
- 'Words'
|
||||
'ScanOcr':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
- 'image/png'
|
||||
- 'png_file'
|
||||
- 'image/tiff'
|
||||
- 'type_is_tiff'
|
||||
- 'image/x-ms-bmp'
|
||||
- 'bmp_file'
|
||||
priority: 5
|
||||
options:
|
||||
extract_text: False
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanOle':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/CDFV2'
|
||||
- 'application/msword'
|
||||
- 'olecf_file'
|
||||
priority: 5
|
||||
'ScanOnenote':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/onenote'
|
||||
- 'application/msonenote'
|
||||
- 'onenote_file'
|
||||
priority: 5
|
||||
'ScanPdf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/pdf'
|
||||
- 'pdf_file'
|
||||
priority: 5
|
||||
options:
|
||||
extract_text: False
|
||||
limit: 2000
|
||||
'ScanPe':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-dosexec'
|
||||
- 'mz_file'
|
||||
priority: 5
|
||||
'ScanPgp':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/pgp-keys'
|
||||
- 'pgp_file'
|
||||
priority: 5
|
||||
'ScanPhp':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/x-php'
|
||||
- 'php_file'
|
||||
priority: 5
|
||||
'ScanPkcs7':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'pkcs7_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanPlist':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'bplist_file'
|
||||
- 'plist_file'
|
||||
priority: 5
|
||||
options:
|
||||
keys:
|
||||
- 'KeepAlive'
|
||||
- 'Label'
|
||||
- 'NetworkState'
|
||||
- 'Program'
|
||||
- 'ProgramArguments'
|
||||
- 'RunAtLoad'
|
||||
- 'StartInterval'
|
||||
'ScanPngEof':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/png'
|
||||
- 'png_file'
|
||||
negative:
|
||||
source:
|
||||
- 'ScanTranscode'
|
||||
priority: 5
|
||||
'ScanQr':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'image/jpeg'
|
||||
- 'jpeg_file'
|
||||
- 'image/png'
|
||||
- 'png_file'
|
||||
- 'image/tiff'
|
||||
- 'type_is_tiff'
|
||||
- 'image/x-ms-bmp'
|
||||
- 'bmp_file'
|
||||
- 'image/webp'
|
||||
priority: 5
|
||||
options:
|
||||
support_inverted: True
|
||||
'ScanRar':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-rar'
|
||||
- 'rar_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanRpm':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-rpm'
|
||||
- 'rpm_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanRtf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/rtf'
|
||||
- 'rtf_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanSevenZip':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-7z-compressed'
|
||||
- '_7zip_file'
|
||||
- "image/vnd.fpx"
|
||||
- "application/vnd.ms-msi"
|
||||
- "application/x-msi"
|
||||
priority: 5
|
||||
options:
|
||||
scanner_timeout: 150
|
||||
crack_pws: True
|
||||
log_pws: True
|
||||
'ScanSwf':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-shockwave-flash'
|
||||
- 'fws_file'
|
||||
- 'cws_file'
|
||||
- 'zws_file'
|
||||
priority: 5
|
||||
'ScanTar':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-tar'
|
||||
- 'tar_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanTnef':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/vnd.ms-tnef'
|
||||
- 'tnef_file'
|
||||
priority: 5
|
||||
'ScanUpx':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'upx_file'
|
||||
priority: 5
|
||||
options:
|
||||
tmp_directory: '/dev/shm/'
|
||||
'ScanUrl':
|
||||
- negative:
|
||||
flavors:
|
||||
- 'javascript_file'
|
||||
positive:
|
||||
flavors:
|
||||
- 'text/plain'
|
||||
priority: 5
|
||||
'ScanVb':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'vb_file'
|
||||
- 'vbscript'
|
||||
- 'hta_file'
|
||||
priority: 5
|
||||
'ScanVba':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'mhtml_file'
|
||||
- 'application/msword'
|
||||
- 'olecf_file'
|
||||
- 'wordml_file'
|
||||
priority: 5
|
||||
options:
|
||||
analyze_macros: True
|
||||
'ScanVhd':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/x-vhd'
|
||||
- 'vhd_file'
|
||||
- 'vhdx_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 100
|
||||
'ScanVsto':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'vsto_file'
|
||||
priority: 5
|
||||
'ScanX509':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'x509_der_file'
|
||||
priority: 5
|
||||
options:
|
||||
type: 'der'
|
||||
- positive:
|
||||
flavors:
|
||||
- 'x509_pem_file'
|
||||
priority: 5
|
||||
options:
|
||||
type: 'pem'
|
||||
'ScanXml':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/xml'
|
||||
- 'text/xml'
|
||||
- 'xml_file'
|
||||
- 'mso_file'
|
||||
- 'soap_file'
|
||||
priority: 5
|
||||
'ScanYara':
|
||||
- positive:
|
||||
flavors:
|
||||
- '*'
|
||||
priority: 5
|
||||
options:
|
||||
location: '/etc/yara/'
|
||||
compiled:
|
||||
enabled: True
|
||||
filename: "rules.compiled"
|
||||
store_offset: True
|
||||
offset_meta_key: "StrelkaHexDump"
|
||||
offset_padding: 32
|
||||
'ScanZip':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/java-archive'
|
||||
- 'application/zip'
|
||||
- 'zip_file'
|
||||
- 'application/vnd.openxmlformats-officedocument'
|
||||
- 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
|
||||
- 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
|
||||
- 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
|
||||
- 'ooxml_file'
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
password_file: '/etc/strelka/passwords.dat'
|
||||
'ScanZlib':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'application/zlib'
|
||||
- 'zlib_file'
|
||||
priority: 5
|
||||
logging:
|
||||
version: 1
|
||||
formatters:
|
||||
simple:
|
||||
format: '%(asctime)s - [%(levelname)s] %(name)s [%(module)s.%(funcName)s]: %(message)s'
|
||||
datefmt: '%Y-%m-%d %H:%M:%S'
|
||||
handlers:
|
||||
console:
|
||||
class: logging.StreamHandler
|
||||
formatter: simple
|
||||
stream: ext://sys.stdout
|
||||
root:
|
||||
level: DEBUG
|
||||
handlers: [console]
|
||||
loggers:
|
||||
OpenSSL:
|
||||
propagate: 0
|
||||
bs4:
|
||||
propagate: 0
|
||||
bz2:
|
||||
propagate: 0
|
||||
chardet:
|
||||
propagate: 0
|
||||
docx:
|
||||
propagate: 0
|
||||
elftools:
|
||||
propagate: 0
|
||||
email:
|
||||
propagate: 0
|
||||
entropy:
|
||||
propagate: 0
|
||||
esprima:
|
||||
propagate: 0
|
||||
gzip:
|
||||
propagate: 0
|
||||
hashlib:
|
||||
propagate: 0
|
||||
json:
|
||||
propagate: 0
|
||||
libarchive:
|
||||
propagate: 0
|
||||
lxml:
|
||||
propagate: 0
|
||||
lzma:
|
||||
propagate: 0
|
||||
macholibre:
|
||||
propagate: 0
|
||||
olefile:
|
||||
propagate: 0
|
||||
oletools:
|
||||
propagate: 0
|
||||
pdfminer:
|
||||
propagate: 0
|
||||
pefile:
|
||||
propagate: 0
|
||||
pgpdump:
|
||||
propagate: 0
|
||||
pygments:
|
||||
propagate: 0
|
||||
pylzma:
|
||||
propagate: 0
|
||||
rarfile:
|
||||
propagate: 0
|
||||
requests:
|
||||
propagate: 0
|
||||
rpmfile:
|
||||
propagate: 0
|
||||
ssdeep:
|
||||
propagate: 0
|
||||
tarfile:
|
||||
propagate: 0
|
||||
tnefparse:
|
||||
propagate: 0
|
||||
yara:
|
||||
propagate: 0
|
||||
zipfile:
|
||||
propagate: 0
|
||||
zlib:
|
||||
propagate: 0
|
||||
passwords:
|
||||
- infected
|
||||
- password
|
||||
filestream:
|
||||
enabled: False
|
||||
config:
|
||||
conn:
|
||||
server: 'HOST:57314'
|
||||
cert: ''
|
||||
timeout:
|
||||
dial: 5s
|
||||
file: 1m
|
||||
throughput:
|
||||
concurrency: 8
|
||||
chunk: 32768
|
||||
delay: 0s
|
||||
files:
|
||||
patterns:
|
||||
- '/nsm/strelka/unprocessed/*'
|
||||
delete: false
|
||||
gatekeeper: true
|
||||
processed: '/nsm/strelka/processed'
|
||||
response:
|
||||
report: 5s
|
||||
delta: 5s
|
||||
staging: '/nsm/strelka/staging'
|
||||
frontend:
|
||||
enabled: False
|
||||
config:
|
||||
server: ":57314"
|
||||
coordinator:
|
||||
addr: 'HOST:6380'
|
||||
db: 0
|
||||
gatekeeper:
|
||||
addr: 'HOST:6381'
|
||||
db: 0
|
||||
ttl: 1h
|
||||
response:
|
||||
log: "/var/log/strelka/strelka.log"
|
||||
broker:
|
||||
bootstrap: "PLACEHOLDER"
|
||||
protocol: "PLACEHOLDER"
|
||||
certlocation: "PLACEHOLDER"
|
||||
keylocation: "PLACEHOLDER"
|
||||
calocation: "PLACEHOLDER"
|
||||
topic: "PLACEHOLDER"
|
||||
s3redundancy: "PLACEHOLDER - This should be a boolean value"
|
||||
s3:
|
||||
accesskey: "PLACEHOLDER"
|
||||
secretkey: "PLACEHOLDER"
|
||||
bucketName: "PLACEHOLDER"
|
||||
region: "PLACEHOLDER"
|
||||
endpoint: "PLACEHOLDER"
|
||||
manager:
|
||||
enabled: False
|
||||
config:
|
||||
coordinator:
|
||||
addr: 'HOST:6380'
|
||||
db: 0
|
||||
coordinator:
|
||||
enabled: False
|
||||
gatekeeper:
|
||||
enabled: False
|
||||
rules:
|
||||
enabled: True
|
||||
filecheck:
|
||||
historypath: '/nsm/strelka/history/'
|
||||
strelkapath: '/nsm/strelka/unprocessed/'
|
||||
logfile: '/opt/so/log/strelka/filecheck.log'
|
||||
@@ -1,98 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
import os
|
||||
import shutil
|
||||
import time
|
||||
import hashlib
|
||||
import logging
|
||||
import yaml
|
||||
from watchdog.observers import Observer
|
||||
from watchdog.events import FileSystemEventHandler
|
||||
|
||||
with open("/opt/so/conf/strelka/filecheck.yaml", "r") as ymlfile:
|
||||
cfg = yaml.load(ymlfile, Loader=yaml.Loader)
|
||||
|
||||
extract_path = cfg["filecheck"]["extract_path"]
|
||||
historypath = cfg["filecheck"]["historypath"]
|
||||
strelkapath = cfg["filecheck"]["strelkapath"]
|
||||
logfile = cfg["filecheck"]["logfile"]
|
||||
recycle_secs = cfg["filecheck"].get("recycle_secs", 300)
|
||||
|
||||
logging.basicConfig(filename=logfile, filemode='w', format='%(asctime)s - %(message)s', datefmt='%d-%b-%y %H:%M:%S', level=logging.INFO)
|
||||
|
||||
def checkexisting():
|
||||
logging.info("Checking for existing files");
|
||||
for root, dirs, files in os.walk(extract_path):
|
||||
for file in files:
|
||||
try:
|
||||
path = os.path.join(root, file)
|
||||
filename = os.path.join(extract_path, path)
|
||||
checksum(filename)
|
||||
except Exception as err:
|
||||
logging.error("Failed to process file: " + file)
|
||||
|
||||
def checksum(filename):
|
||||
if os.path.isfile(filename) and "/tmp/" not in filename:
|
||||
with open(filename, 'rb') as afile:
|
||||
logging.info("Processing file: " + filename)
|
||||
shawnuff = hashlib.sha1()
|
||||
buf = afile.read(8192)
|
||||
while len(buf) > 0:
|
||||
shawnuff.update(buf)
|
||||
buf = afile.read(8192)
|
||||
hizash=shawnuff.hexdigest()
|
||||
process(filename, hizash)
|
||||
|
||||
def process(filename, hizash):
|
||||
if os.path.exists(historypath + hizash):
|
||||
logging.info(filename + " Already exists.. removing")
|
||||
os.remove(filename)
|
||||
else:
|
||||
# Write the file
|
||||
logging.info(filename + " is new. Creating a record and sending to Strelka")
|
||||
with open(os.path.join(historypath + hizash), 'w') as fp:
|
||||
pass
|
||||
head, tail = os.path.split(filename)
|
||||
|
||||
# Move the file
|
||||
shutil.move(filename, strelkapath + tail)
|
||||
|
||||
class CreatedEventHandler(FileSystemEventHandler):
|
||||
def on_created(self, event):
|
||||
logging.info("File create detected: " + event.src_path)
|
||||
checksum(event.src_path)
|
||||
|
||||
def on_moved(self, event):
|
||||
logging.info("File move detected: " + event.src_path + " -> " + event.dest_path)
|
||||
checksum(event.dest_path)
|
||||
|
||||
if __name__ == "__main__":
|
||||
logging.info("Starting filecheck")
|
||||
|
||||
event_handler =CreatedEventHandler()
|
||||
|
||||
shutdown = False
|
||||
while not shutdown:
|
||||
checkexisting()
|
||||
logging.info("Scheduling observer")
|
||||
observer = Observer()
|
||||
observer.schedule(event_handler, extract_path, recursive=True)
|
||||
observer.start()
|
||||
try:
|
||||
time.sleep(recycle_secs)
|
||||
except KeyboardInterrupt:
|
||||
logging.warn("User requested shutdown")
|
||||
shutdown = True
|
||||
|
||||
observer.stop()
|
||||
observer.join()
|
||||
|
||||
if not shutdown:
|
||||
logging.info("Recycling observer to pick up new subdirectories")
|
||||
|
||||
logging.info("Exiting filecheck")
|
||||
@@ -1,2 +0,0 @@
|
||||
filecheck:
|
||||
{{ FILECHECKCONFIG | yaml(false) | indent(width=2) }}
|
||||
@@ -1,165 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
{% from 'strelka/map.jinja' import filecheck_runas %}
|
||||
|
||||
include:
|
||||
- strelka.config
|
||||
- strelka.filestream.sostatus
|
||||
|
||||
strelkaprocessed:
|
||||
file.directory:
|
||||
- name: /nsm/strelka/processed
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
strelkastaging:
|
||||
file.directory:
|
||||
- name: /nsm/strelka/staging
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
strelkaunprocessed:
|
||||
file.directory:
|
||||
- name: /nsm/strelka/unprocessed
|
||||
- user: 939
|
||||
- group: 939
|
||||
- mode: 775
|
||||
- makedirs: True
|
||||
|
||||
filestream_config:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/filestream/filestream.yaml
|
||||
- source: salt://strelka/filestream/files/filestream.yaml.jinja
|
||||
- template: jinja
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
- defaults:
|
||||
FILESTREAMCONFIG: {{ STRELKAMERGED.filestream.config }}
|
||||
|
||||
# Filecheck Section
|
||||
remove_old_watchdog:
|
||||
pkg.removed:
|
||||
- name: python3-watchdog
|
||||
|
||||
install_watchdog:
|
||||
pkg.installed:
|
||||
- name: securityonion-python39-watchdog
|
||||
|
||||
filecheck_logdir:
|
||||
file.directory:
|
||||
- name: /opt/so/log/strelka
|
||||
- user: 939
|
||||
- group: 939
|
||||
- mode: 775
|
||||
- makedirs: True
|
||||
|
||||
filecheck_history:
|
||||
file.directory:
|
||||
- name: /nsm/strelka/history
|
||||
- user: 939
|
||||
- group: 939
|
||||
- mode: 775
|
||||
- makedirs: True
|
||||
|
||||
filecheck_conf:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/filecheck.yaml
|
||||
- source: salt://strelka/filecheck/filecheck.yaml.jinja
|
||||
- template: jinja
|
||||
- defaults:
|
||||
FILECHECKCONFIG: {{ STRELKAMERGED.filecheck }}
|
||||
|
||||
filecheck_script:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/filecheck
|
||||
- source: salt://strelka/filecheck/filecheck
|
||||
- user: 939
|
||||
- group: 939
|
||||
- mode: 755
|
||||
|
||||
filecheck.log:
|
||||
file.managed:
|
||||
- name: /opt/so/log/strelka/filecheck.log
|
||||
- user: {{ filecheck_runas }}
|
||||
- group: {{ filecheck_runas }}
|
||||
- replace: False
|
||||
|
||||
filecheck_stdout.log:
|
||||
file.managed:
|
||||
- name: /opt/so/log/strelka/filecheck_stdout.log
|
||||
- user: {{ filecheck_runas }}
|
||||
- group: {{ filecheck_runas }}
|
||||
- replace: False
|
||||
|
||||
{% if GLOBALS.md_engine == 'ZEEK' %}
|
||||
|
||||
remove_filecheck_run:
|
||||
cron.absent:
|
||||
- identifier: filecheck_run
|
||||
- user: socore
|
||||
|
||||
filecheck_run_socore:
|
||||
cron.present:
|
||||
- name: 'ps -ef | grep filecheck | grep -v grep > /dev/null 2>&1 || python3 /opt/so/conf/strelka/filecheck >> /opt/so/log/strelka/filecheck_stdout.log 2>&1 &'
|
||||
- identifier: filecheck_run_socore
|
||||
- user: socore
|
||||
|
||||
remove_filecheck_run_suricata:
|
||||
cron.absent:
|
||||
- identifier: filecheck_run_suricata
|
||||
- user: suricata
|
||||
|
||||
{% elif GLOBALS.md_engine == 'SURICATA'%}
|
||||
|
||||
remove_filecheck_run:
|
||||
cron.absent:
|
||||
- identifier: filecheck_run
|
||||
- user: suricata
|
||||
|
||||
filecheck_run_suricata:
|
||||
cron.present:
|
||||
- name: 'ps -ef | grep filecheck | grep -v grep > /dev/null 2>&1 || python3 /opt/so/conf/strelka/filecheck >> /opt/so/log/strelka/filecheck_stdout.log 2>&1 &'
|
||||
- identifier: filecheck_run_suricata
|
||||
- user: suricata
|
||||
|
||||
remove_filecheck_run_socore:
|
||||
cron.absent:
|
||||
- identifier: filecheck_run_socore
|
||||
- user: socore
|
||||
|
||||
{% endif %}
|
||||
|
||||
filecheck_restart:
|
||||
cmd.run:
|
||||
- name: pkill -f "python3 /opt/so/conf/strelka/filecheck"
|
||||
- hide_output: True
|
||||
- success_retcodes: [0,1]
|
||||
- onchanges:
|
||||
- file: filecheck_script
|
||||
- file: filecheck_conf
|
||||
- pkg: install_watchdog
|
||||
|
||||
filcheck_history_clean:
|
||||
cron.present:
|
||||
- name: '/usr/bin/find /nsm/strelka/history/ -type f -mtime +2 -exec rm {} + > /dev/null 2>&1'
|
||||
- identifier: filecheck_history_clean
|
||||
- minute: '33'
|
||||
# End Filecheck Section
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,27 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.filestream.sostatus
|
||||
|
||||
so-strelka-filestream:
|
||||
docker_container.absent:
|
||||
- force: True
|
||||
|
||||
so-strelka-filestream_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-filestream$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,64 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
include:
|
||||
- strelka.filestream.config
|
||||
- strelka.filestream.sostatus
|
||||
|
||||
strelka_filestream:
|
||||
docker_container.running:
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }}
|
||||
- binds:
|
||||
- /opt/so/conf/strelka/filestream/:/etc/strelka/:ro
|
||||
- /nsm/strelka:/nsm/strelka
|
||||
{% if DOCKERMERGED.containers['so-strelka-filestream'].custom_bind_mounts %}
|
||||
{% for BIND in DOCKERMERGED.containers['so-strelka-filestream'].custom_bind_mounts %}
|
||||
- {{ BIND }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- name: so-strelka-filestream
|
||||
- networks:
|
||||
- sobridge:
|
||||
- ipv4_address: {{ DOCKERMERGED.containers['so-strelka-filestream'].ip }}
|
||||
- command: strelka-filestream
|
||||
- extra_hosts:
|
||||
- {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
|
||||
{% if DOCKERMERGED.containers['so-strelka-filestream'].extra_hosts %}
|
||||
{% for XTRAHOST in DOCKERMERGED.containers['so-strelka-filestream'].extra_hosts %}
|
||||
- {{ XTRAHOST }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-filestream'].extra_env %}
|
||||
- environment:
|
||||
{% for XTRAENV in DOCKERMERGED.containers['so-strelka-filestream'].extra_env %}
|
||||
- {{ XTRAENV }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-filestream'].ulimits %}
|
||||
- ulimits:
|
||||
{% for ULIMIT in DOCKERMERGED.containers['so-strelka-filestream'].ulimits %}
|
||||
- {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- watch:
|
||||
- file: filestream_config
|
||||
|
||||
delete_so-strelka-filestream_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-filestream$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1 +0,0 @@
|
||||
{{ FILESTREAMCONFIG | yaml(false) }}
|
||||
@@ -1,13 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
{% if STRELKAMERGED.filestream.enabled %}
|
||||
- strelka.filestream.enabled
|
||||
{% else %}
|
||||
- strelka.filestream.disabled
|
||||
{% endif %}
|
||||
@@ -1,21 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
append_so-strelka-filestream_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-strelka-filestream
|
||||
- unless: grep -q so-strelka-filestream /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,36 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
- strelka.config
|
||||
- strelka.frontend.sostatus
|
||||
|
||||
# Check to see if Strelka frontend port is available
|
||||
strelkaportavailable:
|
||||
cmd.run:
|
||||
- name: netstat -utanp | grep ":57314" | grep -qvE 'docker|TIME_WAIT' && PROCESS=$(netstat -utanp | grep ":57314" | uniq) && echo "Another process ($PROCESS) appears to be using port 57314. Please terminate this process, or reboot to ensure a clean state so that Strelka can start properly." && exit 1 || exit 0
|
||||
|
||||
frontend_config:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/frontend/frontend.yaml
|
||||
- source: salt://strelka/frontend/files/frontend.yaml.jinja
|
||||
- template: jinja
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
- defaults:
|
||||
FRONTENDCONFIG: {{ STRELKAMERGED.frontend.config }}
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,27 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.frontend.sostatus
|
||||
|
||||
so-strelka-frontend:
|
||||
docker_container.absent:
|
||||
- force: True
|
||||
|
||||
so-strelka-frontend_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-frontend$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,69 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
include:
|
||||
- strelka.frontend.config
|
||||
- strelka.frontend.sostatus
|
||||
|
||||
strelka_frontend:
|
||||
docker_container.running:
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }}
|
||||
- binds:
|
||||
- /opt/so/conf/strelka/frontend/:/etc/strelka/:ro
|
||||
- /nsm/strelka/log/:/var/log/strelka/:rw
|
||||
{% if DOCKERMERGED.containers['so-strelka-frontend'].custom_bind_mounts %}
|
||||
{% for BIND in DOCKERMERGED.containers['so-strelka-frontend'].custom_bind_mounts %}
|
||||
- {{ BIND }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- privileged: True
|
||||
- name: so-strelka-frontend
|
||||
- networks:
|
||||
- sobridge:
|
||||
- ipv4_address: {{ DOCKERMERGED.containers['so-strelka-frontend'].ip }}
|
||||
- command: strelka-frontend
|
||||
- extra_hosts:
|
||||
- {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
|
||||
{% if DOCKERMERGED.containers['so-strelka-frontend'].extra_hosts %}
|
||||
{% for XTRAHOST in DOCKERMERGED.containers['so-strelka-frontend'].extra_hosts %}
|
||||
- {{ XTRAHOST }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- port_bindings:
|
||||
{% for BINDING in DOCKERMERGED.containers['so-strelka-frontend'].port_bindings %}
|
||||
- {{ BINDING }}
|
||||
{% endfor %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-frontend'].extra_env %}
|
||||
- environment:
|
||||
{% for XTRAENV in DOCKERMERGED.containers['so-strelka-frontend'].extra_env %}
|
||||
- {{ XTRAENV }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-frontend'].ulimits %}
|
||||
- ulimits:
|
||||
{% for ULIMIT in DOCKERMERGED.containers['so-strelka-frontend'].ulimits %}
|
||||
- {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- watch:
|
||||
- file: frontend_config
|
||||
|
||||
delete_so-strelka-frontend_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-frontend$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1 +0,0 @@
|
||||
{{ FRONTENDCONFIG | yaml(false) }}
|
||||
@@ -1,13 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
{% if STRELKAMERGED.frontend.enabled %}
|
||||
- strelka.frontend.enabled
|
||||
{% else %}
|
||||
- strelka.frontend.disabled
|
||||
{% endif %}
|
||||
@@ -1,21 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
append_so-strelka-frontend_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-strelka-frontend
|
||||
- unless: grep -q so-strelka-frontend /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,19 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.config
|
||||
- strelka.gatekeeper.sostatus
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,27 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.gatekeeper.sostatus
|
||||
|
||||
so-strelka-gatekeeper:
|
||||
docker_container.absent:
|
||||
- force: True
|
||||
|
||||
so-strelka-gatekeeper_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-gatekeeper$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,65 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
include:
|
||||
- strelka.gatekeeper.config
|
||||
- strelka.gatekeeper.sostatus
|
||||
|
||||
strelka_gatekeeper:
|
||||
docker_container.running:
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-redis:{{ GLOBALS.so_version }}
|
||||
- name: so-strelka-gatekeeper
|
||||
- networks:
|
||||
- sobridge:
|
||||
- ipv4_address: {{ DOCKERMERGED.containers['so-strelka-gatekeeper'].ip }}
|
||||
- entrypoint: redis-server --save "" --appendonly no --maxmemory-policy allkeys-lru
|
||||
- extra_hosts:
|
||||
- {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
|
||||
{% if DOCKERMERGED.containers['so-strelka-gatekeeper'].extra_hosts %}
|
||||
{% for XTRAHOST in DOCKERMERGED.containers['so-strelka-gatekeeper'].extra_hosts %}
|
||||
- {{ XTRAHOST }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- port_bindings:
|
||||
{% for BINDING in DOCKERMERGED.containers['so-strelka-gatekeeper'].port_bindings %}
|
||||
- {{ BINDING }}
|
||||
{% endfor %}
|
||||
- binds:
|
||||
- /nsm/strelka/gk-redis-data:/data:rw
|
||||
{% if DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %}
|
||||
{% for BIND in DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %}
|
||||
- {{ BIND }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-gatekeeper'].extra_env %}
|
||||
- environment:
|
||||
{% for XTRAENV in DOCKERMERGED.containers['so-strelka-gatekeeper'].extra_env %}
|
||||
- {{ XTRAENV }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-gatekeeper'].ulimits %}
|
||||
- ulimits:
|
||||
{% for ULIMIT in DOCKERMERGED.containers['so-strelka-gatekeeper'].ulimits %}
|
||||
- {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
delete_so-strelka-gatekeeper_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-gatekeeper$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,13 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
{% if STRELKAMERGED.gatekeeper.enabled %}
|
||||
- strelka.gatekeeper.enabled
|
||||
{% else %}
|
||||
- strelka.gatekeeper.disabled
|
||||
{% endif %}
|
||||
@@ -1,21 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
append_so-strelka-gatekeeper_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-strelka-gatekeeper
|
||||
- unless: grep -q so-strelka-gatekeeper /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,43 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
{% if STRELKAMERGED.coordinator.enabled %}
|
||||
- strelka.coordinator.enabled
|
||||
{% else %}
|
||||
- strelka.coordinator.disabled
|
||||
{% endif %}
|
||||
|
||||
{% if STRELKAMERGED.gatekeeper.enabled %}
|
||||
- strelka.gatekeeper.enabled
|
||||
{% else %}
|
||||
- strelka.gatekeeper.disabled
|
||||
{% endif %}
|
||||
|
||||
{% if STRELKAMERGED.frontend.enabled %}
|
||||
- strelka.frontend.enabled
|
||||
{% else %}
|
||||
- strelka.frontend.disabled
|
||||
{% endif %}
|
||||
|
||||
{% if STRELKAMERGED.backend.enabled %}
|
||||
- strelka.backend.enabled
|
||||
{% else %}
|
||||
- strelka.backend.disabled
|
||||
{% endif %}
|
||||
|
||||
{% if STRELKAMERGED.manager.enabled %}
|
||||
- strelka.manager.enabled
|
||||
{% else %}
|
||||
- strelka.manager.disabled
|
||||
{% endif %}
|
||||
|
||||
{% if STRELKAMERGED.filestream.enabled %}
|
||||
- strelka.filestream.enabled
|
||||
{% else %}
|
||||
- strelka.filestream.disabled
|
||||
{% endif %}
|
||||
@@ -1,37 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{# if strelka.manager or strelka in allowed_states #}
|
||||
{% if sls in allowed_states or sls.split('.')[0] in allowed_states %}
|
||||
|
||||
# Strelka config
|
||||
strelkarulesdir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/strelka/rules
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
|
||||
strelkacompileyara:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/compile_yara.py
|
||||
- source: salt://strelka/compile_yara/compile_yara.py
|
||||
- user: 939
|
||||
- group: 939
|
||||
|
||||
strelkareposdir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/strelka/repos
|
||||
- user: 939
|
||||
- group: 939
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,31 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
- strelka.config
|
||||
- strelka.manager.sostatus
|
||||
|
||||
manager_config:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/strelka/manager/manager.yaml
|
||||
- source: salt://strelka/manager/files/manager.yaml.jinja
|
||||
- template: jinja
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
- defaults:
|
||||
MANAGERCONFIG: {{ STRELKAMERGED.manager.config }}
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,27 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
include:
|
||||
- strelka.manager.sostatus
|
||||
|
||||
so-strelka-manager:
|
||||
docker_container.absent:
|
||||
- force: True
|
||||
|
||||
so-strelka-manager_so-status.disabled:
|
||||
file.comment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-manager$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,63 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
include:
|
||||
- strelka.manager.config
|
||||
- strelka.manager.sostatus
|
||||
|
||||
strelka_manager:
|
||||
docker_container.running:
|
||||
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }}
|
||||
- binds:
|
||||
- /opt/so/conf/strelka/manager/:/etc/strelka/:ro
|
||||
{% if DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %}
|
||||
{% for BIND in DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %}
|
||||
- {{ BIND }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- name: so-strelka-manager
|
||||
- networks:
|
||||
- sobridge:
|
||||
- ipv4_address: {{ DOCKERMERGED.containers['so-strelka-manager'].ip }}
|
||||
- command: strelka-manager
|
||||
- extra_hosts:
|
||||
- {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
|
||||
{% if DOCKERMERGED.containers['so-strelka-manager'].extra_hosts %}
|
||||
{% for XTRAHOST in DOCKERMERGED.containers['so-strelka-manager'].extra_hosts %}
|
||||
- {{ XTRAHOST }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-manager'].extra_env %}
|
||||
- environment:
|
||||
{% for XTRAENV in DOCKERMERGED.containers['so-strelka-manager'].extra_env %}
|
||||
- {{ XTRAENV }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if DOCKERMERGED.containers['so-strelka-manager'].ulimits %}
|
||||
- ulimits:
|
||||
{% for ULIMIT in DOCKERMERGED.containers['so-strelka-manager'].ulimits %}
|
||||
- {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
- watch:
|
||||
- file: manager_config
|
||||
|
||||
delete_so-strelka-manager_so-status.disabled:
|
||||
file.uncomment:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- regex: ^so-strelka-manager$
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1 +0,0 @@
|
||||
{{ MANAGERCONFIG | yaml(false) }}
|
||||
@@ -1,13 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'strelka/map.jinja' import STRELKAMERGED %}
|
||||
|
||||
include:
|
||||
{% if STRELKAMERGED.manager.enabled %}
|
||||
- strelka.manager.enabled
|
||||
{% else %}
|
||||
- strelka.manager.disabled
|
||||
{% endif %}
|
||||
@@ -1,21 +0,0 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls.split('.')[0] in allowed_states %}
|
||||
|
||||
append_so-strelka-manager_so-status.conf:
|
||||
file.append:
|
||||
- name: /opt/so/conf/so-status/so-status.conf
|
||||
- text: so-strelka-manager
|
||||
- unless: grep -q so-strelka-manager /opt/so/conf/so-status/so-status.conf
|
||||
|
||||
{% else %}
|
||||
|
||||
{{sls}}_state_not_allowed:
|
||||
test.fail_without_changes:
|
||||
- name: {{sls}}_state_not_allowed
|
||||
|
||||
{% endif %}
|
||||
@@ -1,35 +0,0 @@
|
||||
{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
Elastic License 2.0. #}
|
||||
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
{% import_yaml 'strelka/defaults.yaml' as STRELKADEFAULTS %}
|
||||
{% set HOST = GLOBALS.hostname %}
|
||||
|
||||
{% set backend_coordinator_port = STRELKADEFAULTS.strelka.backend.config.backend.coordinator.addr.split(':')[1] %}
|
||||
{% do STRELKADEFAULTS.strelka.backend.config.backend.coordinator.update({'addr': HOST ~ ':' ~ backend_coordinator_port}) %}
|
||||
|
||||
{% set filestream_conn_port = STRELKADEFAULTS.strelka.filestream.config.conn.server.split(':')[1] %}
|
||||
{% do STRELKADEFAULTS.strelka.filestream.config.conn.update({'server': HOST ~ ':' ~ filestream_conn_port}) %}
|
||||
|
||||
{% set frontend_coordinator_port = STRELKADEFAULTS.strelka.frontend.config.coordinator.addr.split(':')[1] %}
|
||||
{% do STRELKADEFAULTS.strelka.frontend.config.coordinator.update({'addr': HOST ~ ':' ~ frontend_coordinator_port}) %}
|
||||
|
||||
{% set frontend_gatekeeper_port = STRELKADEFAULTS.strelka.frontend.config.gatekeeper.addr.split(':')[1] %}
|
||||
{% do STRELKADEFAULTS.strelka.frontend.config.gatekeeper.update({'addr': HOST ~ ':' ~ frontend_gatekeeper_port}) %}
|
||||
|
||||
{% set manager_coordinator_port = STRELKADEFAULTS.strelka.manager.config.coordinator.addr.split(':')[1] %}
|
||||
{% do STRELKADEFAULTS.strelka.manager.config.coordinator.update({'addr': HOST ~ ':' ~ manager_coordinator_port}) %}
|
||||
|
||||
{% if GLOBALS.md_engine == "SURICATA" %}
|
||||
{% set extract_path = '/nsm/suricata/extracted' %}
|
||||
{% set filecheck_runas = 'suricata' %}
|
||||
{% else %}
|
||||
{% set extract_path = '/nsm/zeek/extracted/complete' %}
|
||||
{% set filecheck_runas = 'socore' %}
|
||||
{% endif %}
|
||||
|
||||
{% do STRELKADEFAULTS.strelka.filecheck.update({'extract_path': extract_path}) %}
|
||||
|
||||
{% set STRELKAMERGED = salt['pillar.get']('strelka', STRELKADEFAULTS.strelka, merge=True) %}
|
||||
@@ -1,627 +0,0 @@
|
||||
strelka:
|
||||
backend:
|
||||
enabled:
|
||||
description: Enables or disables the Strelka file analysis process.
|
||||
forcedType: bool
|
||||
helpLink: strelka
|
||||
config:
|
||||
backend:
|
||||
logging_cfg:
|
||||
description: Path to the Python logging configuration.
|
||||
readonly: True
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
limits:
|
||||
max_files:
|
||||
description: Number of files the backend will process before shutting down.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
time_to_live:
|
||||
description: Amount of time (in seconds) that the backend will run before shutting down (0 to disable).
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
max_depth:
|
||||
description: Maximum depth that extracted files will be processed by the backend.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
distribution:
|
||||
description: Amount of time (in seconds) that a single file can be distributed to all scanners.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
scanner:
|
||||
description: Amount of time (in seconds) that a scanner can spend scanning a file (can be overridden per scanner).
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
coordinator:
|
||||
addr:
|
||||
description: Network address of the coordinator.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
db:
|
||||
description: Redis database of the coordinator.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
tasting:
|
||||
mime_db:
|
||||
description: Location of the MIME database used to taste files.
|
||||
readonly: True
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
yara_rules:
|
||||
description: Location of the directory of YARA files that contains rules used to taste files.
|
||||
readonly: True
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
scanners:
|
||||
'ScanBase64PE': &scannerOptions
|
||||
description: Configuration options for this scanner.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
forcedType: "[]{}"
|
||||
syntax: json
|
||||
'ScanBatch': *scannerOptions
|
||||
'ScanBmpEof': *scannerOptions
|
||||
'ScanBzip2': *scannerOptions
|
||||
'ScanDmg': *scannerOptions
|
||||
'ScanDocx': *scannerOptions
|
||||
'ScanDonut': *scannerOptions
|
||||
'ScanElf': *scannerOptions
|
||||
'ScanEmail': *scannerOptions
|
||||
'ScanEncryptedDoc': *scannerOptions
|
||||
'ScanEncryptedZip': *scannerOptions
|
||||
'ScanEntropy': *scannerOptions
|
||||
'ScanExiftool': *scannerOptions
|
||||
'ScanFooter': *scannerOptions
|
||||
'ScanGif': *scannerOptions
|
||||
'ScanGzip': *scannerOptions
|
||||
'ScanHash': *scannerOptions
|
||||
'ScanHeader': *scannerOptions
|
||||
'ScanHtml': *scannerOptions
|
||||
'ScanIni': *scannerOptions
|
||||
'ScanIqy': *scannerOptions
|
||||
'ScanIso': *scannerOptions
|
||||
'ScanJarManifest': *scannerOptions
|
||||
'ScanJavascript': *scannerOptions
|
||||
'ScanJpeg': *scannerOptions
|
||||
'ScanJson': *scannerOptions
|
||||
'ScanLibarchive': *scannerOptions
|
||||
'ScanLNK': *scannerOptions
|
||||
'ScanLsb': *scannerOptions
|
||||
'ScanLzma': *scannerOptions
|
||||
'ScanMacho': *scannerOptions
|
||||
'ScanManifest': *scannerOptions
|
||||
'ScanMsi': *scannerOptions
|
||||
'ScanOcr': *scannerOptions
|
||||
'ScanOle': *scannerOptions
|
||||
'ScanOnenote': *scannerOptions
|
||||
'ScanPdf': *scannerOptions
|
||||
'ScanPe': *scannerOptions
|
||||
'ScanPgp': *scannerOptions
|
||||
'ScanPhp': *scannerOptions
|
||||
'ScanPkcs7': *scannerOptions
|
||||
'ScanPlist': *scannerOptions
|
||||
'ScanPngEof': *scannerOptions
|
||||
'ScanQr': *scannerOptions
|
||||
'ScanRar': *scannerOptions
|
||||
'ScanRpm': *scannerOptions
|
||||
'ScanRtf': *scannerOptions
|
||||
'ScanRuby': *scannerOptions
|
||||
'ScanSevenZip': *scannerOptions
|
||||
'ScanSwf': *scannerOptions
|
||||
'ScanTar': *scannerOptions
|
||||
'ScanTnef': *scannerOptions
|
||||
'ScanUpx': *scannerOptions
|
||||
'ScanUrl': *scannerOptions
|
||||
'ScanVb': *scannerOptions
|
||||
'ScanVba': *scannerOptions
|
||||
'ScanVhd': *scannerOptions
|
||||
'ScanVsto': *scannerOptions
|
||||
'ScanX509': *scannerOptions
|
||||
'ScanXml': *scannerOptions
|
||||
'ScanYara': *scannerOptions
|
||||
'ScanZip': *scannerOptions
|
||||
'ScanZlib': *scannerOptions
|
||||
logging:
|
||||
version:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
formatters:
|
||||
simple:
|
||||
format:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
datefmt:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
handlers:
|
||||
console:
|
||||
class:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
formatter:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
stream:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
root:
|
||||
level:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
handlers:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
loggers:
|
||||
OpenSSL:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
bs4:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
bz2:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
chardet:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
docx:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
elftools:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
email:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
entropy:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
esprima:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
gzip:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
hashlib:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
json:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
libarchive:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
lxml:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
lzma:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
macholibre:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
olefile:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
oletools:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
pdfminer:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
pefile:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
pgpdump:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
pygments:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
pylzma:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
rarfile:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
requests:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
rpmfile:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
ssdeep:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
tarfile:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
tnefparse:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
yara:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
zipfile:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
zlib:
|
||||
propagate:
|
||||
description: This is an advanced option for Strelka logging.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
passwords:
|
||||
description: Passwords that will be stored in the password_file used in scanner options.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
multiline: True
|
||||
filestream:
|
||||
enabled:
|
||||
description: You can enable or disable Strelka filestream.
|
||||
forcedType: bool
|
||||
helpLink: strelka
|
||||
config:
|
||||
conn:
|
||||
server:
|
||||
description: Network address of the frontend server.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
cert:
|
||||
description: Local path to the frontend SSL server certificate.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
timeout:
|
||||
dial:
|
||||
description: Amount of time to wait for the client to dial the server.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
file:
|
||||
description: Amount of time to wait for an individual file to complete a scan.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
throughput:
|
||||
concurrency:
|
||||
description: Number of concurrent requests to make.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
chunk:
|
||||
description: Size of file chunks that will be sent to the frontend server.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
delay:
|
||||
description: Artificial sleep between the submission of each chunk.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
files:
|
||||
patterns:
|
||||
description: List of glob patterns that determine which files will be sent for scanning.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
delete:
|
||||
description: Boolean that determines if files should be deleted after being sent for scanning.
|
||||
forcedType: bool
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
gatekeeper:
|
||||
description: Boolean that determines if events should be pulled from the temporary event cache.
|
||||
forcedType: bool
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
processed:
|
||||
description: Directory where files will be moved after being submitted for scanning.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
response:
|
||||
report:
|
||||
description: Frequency at which the frontend reports the number of files processed.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
delta:
|
||||
description: Time value that determines how much time must pass since a file was last modified before it is sent for scanning.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
staging:
|
||||
description: Directory where files are staged before being sent to the cluster.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
frontend:
|
||||
enabled:
|
||||
description: You can enable or disable Strelka frontend.
|
||||
forcedType: bool
|
||||
helpLink: strelka
|
||||
config:
|
||||
server:
|
||||
description: Network address of the frontend server.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
coordinator:
|
||||
addr:
|
||||
description: Network address of the coordinator.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
db:
|
||||
description: Redis database of the coordinator.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
gatekeeper:
|
||||
addr:
|
||||
description: Network address of the gatekeeper.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
db:
|
||||
description: Redis database of the gatekeeper.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
ttl:
|
||||
description: Time-to-live for events added to the gatekeeper.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
response:
|
||||
log:
|
||||
description: Location where worker scan results are logged to.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
manager:
|
||||
enabled:
|
||||
description: You can enable or disable Strelka manager.
|
||||
forcedType: bool
|
||||
helpLink: strelka
|
||||
config:
|
||||
coordinator:
|
||||
addr:
|
||||
description: Network address of the coordinator.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
db:
|
||||
description: Redis database of the coordinator.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
coordinator:
|
||||
enabled:
|
||||
description: You can enable or disable Strelka coordinator.
|
||||
forcedType: bool
|
||||
helpLink: strelka
|
||||
gatekeeper:
|
||||
enabled:
|
||||
description: You can enable or disable Strelka gatekeeper.
|
||||
forcedType: bool
|
||||
helpLink: strelka
|
||||
rules:
|
||||
enabled:
|
||||
description: Boolean that determines if yara rules sync from the Salt manager to the backend nodes.
|
||||
forcedType: bool
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: False
|
||||
filecheck:
|
||||
historypath:
|
||||
description: The path for previously scanned files.
|
||||
readonly: True
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
strelkapath:
|
||||
description: The path for unprocessed files.
|
||||
readonly: True
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
logfile:
|
||||
description: The path for the filecheck log.
|
||||
readonly: False
|
||||
global: False
|
||||
helpLink: strelka
|
||||
advanced: True
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-stop strelka-filestream $1
|
||||
/usr/sbin/so-stop strelka-manager $1
|
||||
/usr/sbin/so-stop strelka-frontend $1
|
||||
/usr/sbin/so-stop strelka-backend $1
|
||||
/usr/sbin/so-stop strelka-gatekeeper $1
|
||||
/usr/sbin/so-stop strelka-coordinator $1
|
||||
/usr/sbin/so-start strelka $1
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-start strelka $1
|
||||
@@ -1,17 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
/usr/sbin/so-stop strelka-filestream $1
|
||||
/usr/sbin/so-stop strelka-manager $1
|
||||
/usr/sbin/so-stop strelka-frontend $1
|
||||
/usr/sbin/so-stop strelka-backend $1
|
||||
/usr/sbin/so-stop strelka-gatekeeper $1
|
||||
/usr/sbin/so-stop strelka-coordinator $1
|
||||
@@ -10,9 +10,6 @@
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
FILES=$(ls -1x /host/nsm/strelka/unprocessed | wc -l)
|
||||
echo "faffiles files=$FILES"
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -80,7 +80,6 @@ base:
|
||||
- kibana
|
||||
- suricata
|
||||
- zeek
|
||||
- strelka
|
||||
- elastalert
|
||||
- utility
|
||||
- elasticfleet
|
||||
@@ -109,7 +108,6 @@ base:
|
||||
- kibana
|
||||
- suricata
|
||||
- zeek
|
||||
- strelka
|
||||
- elastalert
|
||||
- utility
|
||||
- elasticfleet
|
||||
@@ -123,7 +121,6 @@ base:
|
||||
- registry
|
||||
- nginx
|
||||
- influxdb
|
||||
- strelka.manager
|
||||
- soc
|
||||
- kratos
|
||||
- hydra
|
||||
@@ -153,7 +150,6 @@ base:
|
||||
- registry
|
||||
- nginx
|
||||
- influxdb
|
||||
- strelka.manager
|
||||
- soc
|
||||
- kratos
|
||||
- hydra
|
||||
@@ -181,7 +177,6 @@ base:
|
||||
- manager
|
||||
- nginx
|
||||
- influxdb
|
||||
- strelka.manager
|
||||
- soc
|
||||
- kratos
|
||||
- hydra
|
||||
@@ -219,7 +214,6 @@ base:
|
||||
- suricata
|
||||
- healthcheck
|
||||
- zeek
|
||||
- strelka
|
||||
- elasticfleet.install_agent_grid
|
||||
- stig
|
||||
- pcap.cleanup
|
||||
@@ -234,7 +228,6 @@ base:
|
||||
- elasticsearch
|
||||
- logstash
|
||||
- redis
|
||||
- strelka
|
||||
- suricata
|
||||
- zeek
|
||||
- elasticfleet.install_agent_grid
|
||||
|
||||
Reference in New Issue
Block a user