mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-19 15:33:06 +01:00
Fixup Elastic Fleet
This commit is contained in:
@@ -198,7 +198,7 @@
|
||||
'logstash',
|
||||
'healthcheck',
|
||||
'schedule',
|
||||
'elastic-fleet',
|
||||
'elasticfleet',
|
||||
'docker_clean'
|
||||
],
|
||||
'so-receiver': [
|
||||
|
||||
@@ -24,7 +24,6 @@ mkdir -p /opt/so/conf/elastic-fleet/certs
|
||||
cp /etc/ssl/certs/intca.crt /opt/so/conf/elastic-fleet/certs
|
||||
cp /etc/pki/elasticfleet* /opt/so/conf/elastic-fleet/certs
|
||||
|
||||
{% if grains.role in ['so-import', 'so-eval'] %}
|
||||
# Add SO-Manager Elasticsearch Ouput
|
||||
ESCACRT=$(openssl x509 -in /opt/so/conf/elastic-fleet/certs/intca.crt)
|
||||
JSON_STRING=$( jq -n \
|
||||
@@ -33,7 +32,7 @@ JSON_STRING=$( jq -n \
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -L -X POST "localhost:5601/api/fleet/outputs" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d "$JSON_STRING"
|
||||
printf "\n\n"
|
||||
|
||||
{% else %}
|
||||
{% if grains.role not in ['so-import', 'so-eval'] %}
|
||||
# Create Logstash Output payload
|
||||
LOGSTASHCRT=$(openssl x509 -in /opt/so/conf/elastic-fleet/certs/elasticfleet.crt)
|
||||
LOGSTASHKEY=$(openssl rsa -in /opt/so/conf/elastic-fleet/certs/elasticfleet.key)
|
||||
@@ -42,13 +41,13 @@ JSON_STRING=$( jq -n \
|
||||
--arg LOGSTASHCRT "$LOGSTASHCRT" \
|
||||
--arg LOGSTASHKEY "$LOGSTASHKEY" \
|
||||
--arg LOGSTASHCA "$LOGSTASHCA" \
|
||||
'{"name":"so-manager_logstash","id":"so-manager_logstash","type":"logstash","hosts":["{{ GLOBALS.manager_ip }}:5055"],"config_yaml":"","ssl":{"certificate": $LOGSTASHCRT,"key": $LOGSTASHKEY,"certificate_authorities":[ $LOGSTASHCA ]}}'
|
||||
'{"name":"so-manager_logstash","is_default":true,"is_default_monitoring":true,"id":"so-manager_logstash","type":"logstash","hosts":["{{ GLOBALS.manager_ip }}:5055"],"config_yaml":"","ssl":{"certificate": $LOGSTASHCRT,"key": $LOGSTASHKEY,"certificate_authorities":[ $LOGSTASHCA ]},"proxy_id":null}'
|
||||
)
|
||||
{%- endif %}
|
||||
|
||||
# Add SO-Manager Logstash Ouput
|
||||
curl -K /opt/so/conf/elasticsearch/curl.config -L -X POST "localhost:5601/api/fleet/outputs" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d "$JSON_STRING"
|
||||
printf "\n\n"
|
||||
{%- endif %}
|
||||
|
||||
# Add Elastic Fleet Integrations
|
||||
|
||||
|
||||
@@ -52,11 +52,8 @@ so-elastic-fleet:
|
||||
- sobridge:
|
||||
- ipv4_address: {{ DOCKER.containers['so-elastic-fleet'].ip }}
|
||||
- extra_hosts:
|
||||
{% if GLOBALS.is_manager %}
|
||||
- {{ GLOBALS.manager }}:{{ GLOBALS.manager_ip }}
|
||||
{% else %}
|
||||
- {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
|
||||
{% endif %}
|
||||
- port_bindings:
|
||||
{% for BINDING in DOCKER.containers['so-elastic-fleet'].port_bindings %}
|
||||
- {{ BINDING }}
|
||||
|
||||
@@ -346,7 +346,7 @@ base:
|
||||
- telegraf
|
||||
- firewall
|
||||
- logstash
|
||||
- elastic-fleet
|
||||
- elasticfleet
|
||||
- schedule
|
||||
- docker_clean
|
||||
|
||||
|
||||
Reference in New Issue
Block a user