CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 02:02:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make case module dynamic

Browse Source
This commit is contained in:
Jason Ertel
2021-12-07 11:51:02 -05:00
parent 892899b7f9
commit b73eb76c94
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
salt/soc/files/soc/soc.json
View File

@@ -27,6 +27,8 @@
{%- set ES_PASS = '' %} {%- set ES_PASS = '' %}
{%- endif %} {%- endif %}
{%- set ES_INDEX_PATTERNS = salt['pillar.get']('soc:es_index_patterns', '*:so-*') %} {%- set ES_INDEX_PATTERNS = salt['pillar.get']('soc:es_index_patterns', '*:so-*') %}
{%- set CASE_MODULE = salt['pillar.get']('soc:case_module', 'soc') %}
{%- set GENERIC_CASE_CONFIG = salt['pillar.get']('soc:generic_case_config', '') %}
{ {
"logFilename": "/opt/sensoroni/logs/sensoroni-server.log", "logFilename": "/opt/sensoroni/logs/sensoroni-server.log",
"server": { "server": {
@@ -60,6 +62,7 @@
"index": "{{ ES_INDEX_PATTERNS }}", "index": "{{ ES_INDEX_PATTERNS }}",
"cacheMs": {{ ES_FIELDCAPS_CACHE }}, "cacheMs": {{ ES_FIELDCAPS_CACHE }},
"verifyCert": false, "verifyCert": false,
"casesEnabled": {{ 'true' if CASEMODULE == 'soc' else 'false' }},
"timeoutMs": {{ API_TIMEOUT }} "timeoutMs": {{ API_TIMEOUT }}
}, },
"influxdb": { "influxdb": {
@@ -77,12 +80,22 @@
"refreshIntervalMs": 30000, "refreshIntervalMs": 30000,
"offlineThresholdMs": 900000 "offlineThresholdMs": 900000
}, },
{% if THEHIVEKEY != '' %} {% if CASEMODULE == 'thehive' and THEHIVEKEY != '' %}
"thehive": { "thehive": {
"hostUrl": "http://{{ MANAGERIP }}:9000/thehive", "hostUrl": "http://{{ MANAGERIP }}:9000/thehive",
"key": "{{ THEHIVEKEY }}", "key": "{{ THEHIVEKEY }}",
"verifyCert": false "verifyCert": false
}, },
{% elif CASEMODULE == 'elasticcases' %}
"elasticcases": {
"hostUrl": "https://{{ MANAGERIP }}:5601",
"username": "{{ ES_USER }}",
"password": "{{ ES_PASS }}",
},
{% elif CASEMODULE == 'generichttp' %}
"generichttp": {
{{ GENERIC_CASE_CONFIG }}
},
{% endif %} {% endif %}
"statickeyauth": { "statickeyauth": {
"anonymousCidr": "{{ DNET }}/24", "anonymousCidr": "{{ DNET }}/24",
@@ -139,7 +152,8 @@
"relativeTimeUnit": 30, "relativeTimeUnit": 30,
"mostRecentlyUsedLimit": 5, "mostRecentlyUsedLimit": 5,
"ackEnabled": false, "ackEnabled": false,
"escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }}, "escalateEnabled": true,
"escalateRelatedEventsEnabled": {{ 'true' if CASEMODULE == 'soc' else 'false' }},
"eventFields": {{ hunt_eventfields | json }}, "eventFields": {{ hunt_eventfields | json }},
"queryBaseFilter": "", "queryBaseFilter": "",
"queryToggleFilters": [], "queryToggleFilters": [],
@@ -159,7 +173,8 @@
"relativeTimeUnit": 30, "relativeTimeUnit": 30,
"mostRecentlyUsedLimit": 5, "mostRecentlyUsedLimit": 5,
"ackEnabled": true, "ackEnabled": true,
"escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }}, "escalateEnabled": true,
"escalateRelatedEventsEnabled": {{ 'true' if CASEMODULE == 'soc' else 'false' }},
"eventFields": {{ alerts_eventfields | json }}, "eventFields": {{ alerts_eventfields | json }},
"queryBaseFilter": "event.dataset:alert", "queryBaseFilter": "event.dataset:alert",
"queryToggleFilters": [ "queryToggleFilters": [