CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10655 from Security-Onion-Solutions/feature/supported_integrations

Browse Source 
Restructure Elasticsearch templates for supported integrations
This commit is contained in:
weslambert
2023-06-26 09:43:10 -04:00
committed by GitHub
parent 77c58e665e 05b84327b8
commit c2efd7ef64
8 changed files with 918 additions and 3337 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
setup/so-functions
View File

@@ -1149,45 +1149,7 @@ elasticsearch_pillar() {
" query:"\
" bool:"\
" max_clause_count: 3500"\
" index_settings:"\ > $elasticsearch_pillar_file
for INDEX in aws azure barracuda beats bluecoat cef checkpoint cisco cyberark cylance elasticsearch endgame f5 firewall fortinet gcp google_workspace imperva infoblox juniper kibana logstash microsoft misp netflow netscout o365 okta osquery proofpoint radware redis snort snyk sonicwall sophos strelka syslog tomcat zeek zscaler
do
printf '%s\n'\
" so-$INDEX:"\
" warm: 7"\
" close: 30"\
" delete: 365"\
" index_sorting: False"\
" index_template:"\
" template:"\
" settings:"\
" index:"\
" mapping:"\
" total_fields:"\
" limit: 5000"\
" refresh_interval: 30s"\
" number_of_shards: 1"\
" number_of_replicas: 0" >> $elasticsearch_pillar_file
done
for INDEX in import
do
printf '%s\n'\
" so-$INDEX:"\
" warm: 7"\
" close: 73000"\
" delete: 73001"\
" index_sorting: False"\
" index_template:"\
" template:"\
" settings:"\
" index:"\
" mapping:"\
" total_fields:"\
" limit: 5000"\
" refresh_interval: 30s"\
" number_of_shards: 1"\
" number_of_replicas: 0" >> $elasticsearch_pillar_file
done
" index_settings: {}" > $elasticsearch_pillar_file
}
es_heapsize() {