CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-25 22:17:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove references to kafkanode

Browse Source 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
This commit is contained in:
reyesj2
2024-04-11 15:32:00 -04:00
parent d3bd56b131
commit af53dcda1b
20 changed files with 17 additions and 218 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/allowed_states.map.jinja
+3 -11
View File
@@ -188,16 +188,8 @@
'telegraf',
'firewall',
'schedule',
'docker_clean'
],
'so-kafkanode': [
'kafka',
'logstash',
'ssl',
'telegraf',
'firewall',
'schedule',
'docker_clean'
'docker_clean',
'kafka'
],
'so-desktop': [
'ssl',
@@ -214,7 +206,7 @@
{% do allowed_states.append('strelka') %}
{% endif %}
{% if grains.role in ['so-eval', 'so-manager', 'so-standalone', 'so-searchnode', 'so-managersearch', 'so-heavynode', 'so-import', 'so-kafkanode'] %}
{% if grains.role in ['so-eval', 'so-manager', 'so-standalone', 'so-searchnode', 'so-managersearch', 'so-heavynode', 'so-import'] %}
{% do allowed_states.append('elasticsearch') %}
{% endif %}
salt/firewall/containers.map.jinja
+1 -5
View File
@@ -81,11 +81,7 @@
{% set NODE_CONTAINERS = [
'so-logstash',
'so-redis',
] %}
{% elif GLOBALS.role == 'so-kafkanode' %}
{% set NODE_CONTAINERS = [
'so-logstash',
'so-kafka',
'so-kafka'
] %}
{% elif GLOBALS.role == 'so-idh' %}
salt/firewall/defaults.yaml
+3 -89
View File
@@ -19,7 +19,6 @@ firewall:
manager: []
managersearch: []
receiver: []
kafkanode: []
searchnode: []
self: []
sensor: []
@@ -443,15 +442,6 @@ firewall:
- elastic_agent_data
- elastic_agent_update
- sensoroni
kafkanode:
portgroups:
- yum
- docker_registry
- influxdb
- elastic_agent_control
- elastic_agent_data
- elastic_agent_update
- sensoroni
analyst:
portgroups:
- nginx
@@ -530,9 +520,6 @@ firewall:
receiver:
portgroups:
- salt_manager
kafkanode:
portgroups:
- salt_manager
desktop:
portgroups:
- salt_manager
@@ -647,15 +634,6 @@ firewall:
- elastic_agent_data
- elastic_agent_update
- sensoroni
kafkanode:
portgroups:
- yum
- docker_registry
- influxdb
- elastic_agent_control
- elastic_agent_data
- elastic_agent_update
- sensoroni
analyst:
portgroups:
- nginx
@@ -1305,14 +1283,17 @@ firewall:
- beats_5044
- beats_5644
- elastic_agent_data
- kafka
searchnode:
portgroups:
- redis
- beats_5644
- kafka
managersearch:
portgroups:
- redis
- beats_5644
- kafka
self:
portgroups:
- redis
@@ -1383,73 +1364,6 @@ firewall:
portgroups: []
customhostgroup9:
portgroups: []
kafkanode:
chain:
DOCKER-USER:
hostgroups:
searchnode:
portgroups:
- kafka
kafkanode:
portgroups:
- kafka
customhostgroup0:
portgroups: []
customhostgroup1:
portgroups: []
customhostgroup2:
portgroups: []
customhostgroup3:
portgroups: []
customhostgroup4:
portgroups: []
customhostgroup5:
portgroups: []
customhostgroup6:
portgroups: []
customhostgroup7:
portgroups: []
customhostgroup8:
portgroups: []
customhostgroup9:
portgroups: []
INPUT:
hostgroups:
anywhere:
portgroups:
- ssh
dockernet:
portgroups:
- all
localhost:
portgroups:
- all
self:
portgroups:
- syslog
syslog:
portgroups:
- syslog
customhostgroup0:
portgroups: []
customhostgroup1:
portgroups: []
customhostgroup2:
portgroups: []
customhostgroup3:
portgroups: []
customhostgroup4:
portgroups: []
customhostgroup5:
portgroups: []
customhostgroup6:
portgroups: []
customhostgroup7:
portgroups: []
customhostgroup8:
portgroups: []
customhostgroup9:
portgroups: []
idh:
chain:
DOCKER-USER:
salt/firewall/soc_firewall.yaml
-62
View File
@@ -34,7 +34,6 @@ firewall:
heavynode: *hostgroupsettings
idh: *hostgroupsettings
import: *hostgroupsettings
kafkanode: *hostgroupsettings
localhost: *ROhostgroupsettingsadv
manager: *hostgroupsettings
managersearch: *hostgroupsettings
@@ -361,8 +360,6 @@ firewall:
portgroups: *portgroupsdocker
endgame:
portgroups: *portgroupsdocker
kafkanode:
portgroups: *portgroupsdocker
analyst:
portgroups: *portgroupsdocker
desktop:
@@ -454,8 +451,6 @@ firewall:
portgroups: *portgroupsdocker
syslog:
portgroups: *portgroupsdocker
kafkanode:
portgroups: *portgroupsdocker
analyst:
portgroups: *portgroupsdocker
desktop:
@@ -940,63 +935,6 @@ firewall:
portgroups: *portgroupshost
customhostgroup9:
portgroups: *portgroupshost
kafkanode:
chain:
DOCKER-USER:
hostgroups:
searchnode:
portgroups: *portgroupsdocker
kafkanode:
portgroups: *portgroupsdocker
customhostgroup0:
portgroups: *portgroupsdocker
customhostgroup1:
portgroups: *portgroupsdocker
customhostgroup2:
portgroups: *portgroupsdocker
customhostgroup3:
portgroups: *portgroupsdocker
customhostgroup4:
portgroups: *portgroupsdocker
customhostgroup5:
portgroups: *portgroupsdocker
customhostgroup6:
portgroups: *portgroupsdocker
customhostgroup7:
portgroups: *portgroupsdocker
customhostgroup8:
portgroups: *portgroupsdocker
customhostgroup9:
portgroups: *portgroupsdocker
INPUT:
hostgroups:
anywhere:
portgroups: *portgroupshost
dockernet:
portgroups: *portgroupshost
localhost:
portgroups: *portgroupshost
customhostgroup0:
portgroups: *portgroupshost
customhostgroup1:
portgroups: *portgroupshost
customhostgroup2:
portgroups: *portgroupshost
customhostgroup3:
portgroups: *portgroupshost
customhostgroup4:
portgroups: *portgroupshost
customhostgroup5:
portgroups: *portgroupshost
customhostgroup6:
portgroups: *portgroupshost
customhostgroup7:
portgroups: *portgroupshost
customhostgroup8:
portgroups: *portgroupshost
customhostgroup9:
portgroups: *portgroupshost
idh:
chain:
DOCKER-USER:
salt/kafka/enabled.sls
+1 -1
View File
@@ -7,7 +7,7 @@
{% if sls.split('.')[0] in allowed_states %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from 'docker/docker.map.jinja' import DOCKER %}
{% set KAFKANODES = salt['pillar.get']('kafka:nodes', {}) %}
{% set KAFKANODES = salt['pillar.get']('kafka:nodes', {}) %}
include:
- kafka.sostatus
salt/logstash/config.sls
+1 -1
View File
@@ -12,7 +12,7 @@
include:
- ssl
{% if GLOBALS.role not in ['so-receiver','so-fleet', 'so-kafkanode'] %}
{% if GLOBALS.role not in ['so-receiver','so-fleet'] %}
- elasticsearch
{% endif %}
salt/logstash/defaults.yaml
-4
View File
@@ -19,8 +19,6 @@ logstash:
- search
fleet:
- fleet
kafkanode:
- kafkanode
defined_pipelines:
fleet:
- so/0012_input_elastic_agent.conf.jinja
@@ -39,8 +37,6 @@ logstash:
- so/0900_input_redis.conf.jinja
- so/9805_output_elastic_agent.conf.jinja
- so/9900_output_endgame.conf.jinja
kafkanode:
- so/0899_output_kafka.conf.jinja
custom0: []
custom1: []
custom2: []
salt/logstash/enabled.sls
+1 -1
View File
@@ -75,7 +75,7 @@ so-logstash:
{% else %}
- /etc/pki/tls/certs/intca.crt:/usr/share/filebeat/ca.crt:ro
{% endif %}
{% if GLOBALS.role in ['so-manager', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode', 'so-searchnode', 'so-kafkanode' ] %}
{% if GLOBALS.role in ['so-manager', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode', 'so-searchnode' ] %}
- /opt/so/conf/ca/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:ro
- /opt/so/conf/ca/tls-ca-bundle.pem:/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem:ro
- /etc/pki/kafka-logstash.p12:/usr/share/logstash/kafka-logstash.p12:ro
salt/logstash/pipelines/config/so/0800_input_kafka.conf.jinja
+1 -3
View File
@@ -1,11 +1,9 @@
{% set kafka_brokers = salt['pillar.get']('logstash:nodes:kafkanode', {}) %}
{% set kafka_brokers = salt['pillar.get']('logstash:nodes:receiver', {}) %}
{% set kafka_on_mngr = salt ['pillar.get']('logstash:nodes:manager', {}) %}
{% set broker_ips = [] %}
{% for node, node_data in kafka_brokers.items() %}
{% do broker_ips.append(node_data['ip'] + ":9092") %}
{% endfor %}
{# For testing kafka stuff from manager not dedicated kafkanodes #}
{% for node, node_data in kafka_on_mngr.items() %}
{% do broker_ips.append(node_data['ip'] + ":9092") %}
{% endfor %}
salt/logstash/soc_logstash.yaml
-2
View File
@@ -16,7 +16,6 @@ logstash:
manager: *assigned_pipelines
managersearch: *assigned_pipelines
fleet: *assigned_pipelines
kafkanode: *assigned_pipelines
defined_pipelines:
receiver: &defined_pipelines
description: List of pipeline configurations assign to this group.
@@ -27,7 +26,6 @@ logstash:
fleet: *defined_pipelines
manager: *defined_pipelines
search: *defined_pipelines
kafkanode: *defined_pipelines
custom0: *defined_pipelines
custom1: *defined_pipelines
custom2: *defined_pipelines
salt/manager/tools/sbin/so-firewall-minion
-3
View File
@@ -79,9 +79,6 @@ fi
'RECEIVER')
so-firewall includehost receiver "$IP" --apply
;;
'KAFKANODE')
so-firewall includehost kafkanode "$IP" --apply
;;
'DESKTOP')
so-firewall includehost desktop "$IP" --apply
;;
salt/manager/tools/sbin/so-minion
-5
View File
@@ -565,11 +565,6 @@ function createRECEIVER() {
add_telegraf_to_minion
}
function createKAFKANODE() {
add_logstash_to_minion
# add_telegraf_to_minion
}
function createDESKTOP() {
add_desktop_to_minion
add_telegraf_to_minion
salt/ssl/init.sls
+1 -4
View File
@@ -664,10 +664,7 @@ elastickeyperms:
{%- endif %}
# Roles will need to be modified. Below is just for testing encrypted kafka pipelines
# Remove so-manager. Just inplace for testing
{% if grains['role'] in ['so-manager', 'so-kafkanode', 'so-searchnode'] %}
# Create a cert for Redis encryption
{% if grains['role'] in ['so-manager', 'so-searchnode', 'so-receiver'] %}
kafka_key:
x509.private_key_managed:
- name: /etc/pki/kafka.key
salt/top.sls
-9
View File
@@ -235,16 +235,7 @@ base:
- firewall
- logstash
- redis
- elasticfleet.install_agent_grid
'*_kafkanode and G@saltversion:{{saltversion}}':
- match: compound
- kafka
- logstash
- ssl
- telegraf
- firewall
- docker_clean
- elasticfleet.install_agent_grid
'*_idh and G@saltversion:{{saltversion}}':