CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make case module dynamic

Browse Source
This commit is contained in:
Jason Ertel
2021-12-07 11:51:02 -05:00
parent 892899b7f9
commit b73eb76c94
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
salt/soc/files/soc/soc.json
View File

@@ -27,6 +27,8 @@
{%- set ES_PASS = '' %}
{%- endif %}
{%- set ES_INDEX_PATTERNS = salt['pillar.get']('soc:es_index_patterns', '*:so-*') %}
{%- set CASE_MODULE = salt['pillar.get']('soc:case_module', 'soc') %}
{%- set GENERIC_CASE_CONFIG = salt['pillar.get']('soc:generic_case_config', '') %}
{
"logFilename": "/opt/sensoroni/logs/sensoroni-server.log",
"server": {
@@ -57,9 +59,10 @@
{%- endif %}
"username": "{{ ES_USER }}",
"password": "{{ ES_PASS }}",
"index": "{{ ES_INDEX_PATTERNS }}",
"index": "{{ ES_INDEX_PATTERNS }}",
"cacheMs": {{ ES_FIELDCAPS_CACHE }},
"verifyCert": false,
"casesEnabled": {{ 'true' if CASEMODULE == 'soc' else 'false' }},
"timeoutMs": {{ API_TIMEOUT }}
},
"influxdb": {
@@ -77,12 +80,22 @@
"refreshIntervalMs": 30000,
"offlineThresholdMs": 900000
},
{% if THEHIVEKEY != '' %}
{% if CASEMODULE == 'thehive' and THEHIVEKEY != '' %}
"thehive": {
"hostUrl": "http://{{ MANAGERIP }}:9000/thehive",
"key": "{{ THEHIVEKEY }}",
"verifyCert": false
},
{% elif CASEMODULE == 'elasticcases' %}
"elasticcases": {
"hostUrl": "https://{{ MANAGERIP }}:5601",
"username": "{{ ES_USER }}",
"password": "{{ ES_PASS }}",
},
{% elif CASEMODULE == 'generichttp' %}
"generichttp": {
{{ GENERIC_CASE_CONFIG }}
},
{% endif %}
"statickeyauth": {
"anonymousCidr": "{{ DNET }}/24",
@@ -139,7 +152,8 @@
"relativeTimeUnit": 30,
"mostRecentlyUsedLimit": 5,
"ackEnabled": false,
"escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }},
"escalateEnabled": true,
"escalateRelatedEventsEnabled": {{ 'true' if CASEMODULE == 'soc' else 'false' }},
"eventFields": {{ hunt_eventfields | json }},
"queryBaseFilter": "",
"queryToggleFilters": [],
@@ -159,7 +173,8 @@
"relativeTimeUnit": 30,
"mostRecentlyUsedLimit": 5,
"ackEnabled": true,
"escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }},
"escalateEnabled": true,
"escalateRelatedEventsEnabled": {{ 'true' if CASEMODULE == 'soc' else 'false' }},
"eventFields": {{ alerts_eventfields | json }},
"queryBaseFilter": "event.dataset:alert",
"queryToggleFilters": [