CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-11 19:52:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

Pull ES Creds at Runtime

Browse Source
This commit is contained in:
Josh Brower
2021-11-02 08:57:11 -04:00
parent f8b62b63f9
commit b756c0cd38
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/common/tools/sbin/so-import-evtx
View File

@@ -41,13 +41,16 @@ function evtx2es() {
EVTX=$1 EVTX=$1
HASH=$2 HASH=$2
ES_PW=$(lookup_pillar "auth:users:so_elastic_user:pass" "elasticsearch")
ES_USER=$(lookup_pillar "auth:users:so_elastic_user:user" "elasticsearch")
docker run --rm \ docker run --rm \
-v "$EVTX:/tmp/$RUNID.evtx" \ -v "$EVTX:/tmp/$RUNID.evtx" \
--entrypoint evtx2es \ --entrypoint evtx2es \
{{ MANAGER }}:5000/{{ IMAGEREPO }}/so-pcaptools:{{ VERSION }} \ {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-pcaptools:{{ VERSION }} \
--host {{ MANAGERIP }} --scheme https \ --host {{ MANAGERIP }} --scheme https \
--index so-beats-$INDEX_DATE --pipeline import.wel \ --index so-beats-$INDEX_DATE --pipeline import.wel \
--login {{ES_USER}} --pwd {{ES_PW}} \ --login $ES_USER --pwd $ES_PW \
"/tmp/$RUNID.evtx" 1>/dev/null 2>/dev/null "/tmp/$RUNID.evtx" 1>/dev/null 2>/dev/null
docker run --rm \ docker run --rm \