CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

rename node pillar to elasticsearch

Browse Source
This commit is contained in:
Mike Reeves
2020-07-07 10:42:12 -04:00
parent e2c9184b29
commit c59096d9bd
35 changed files with 45 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/common/tools/sbin/so-elasticsearch-indices-rw
View File

@@ -15,7 +15,7 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
IP={{ salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('master:mainint', salt['pillar.get']('node:mainint', salt['pillar.get']('host:mainint')))))[0] }} IP={{ salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('master:mainint', salt['pillar.get']('elasticsearch:mainint', salt['pillar.get']('host:mainint')))))[0] }}
ESPORT=9200 ESPORT=9200
THEHIVEESPORT=9400 THEHIVEESPORT=9400

2
salt/curator/files/action/close.yml
View File

@@ -1,5 +1,5 @@
{%- if grains['role'] in ['so-node', 'so-searchnode', 'so-heavynode'] %} {%- if grains['role'] in ['so-node', 'so-searchnode', 'so-heavynode'] %}
{%- set cur_close_days = salt['pillar.get']('node:cur_close_days', '') -%} {%- set cur_close_days = salt['pillar.get']('elasticsearch:cur_close_days', '') -%}
{%- elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %} {%- elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %}
{%- set cur_close_days = salt['pillar.get']('master:cur_close_days', '') -%} {%- set cur_close_days = salt['pillar.get']('master:cur_close_days', '') -%}
{%- endif -%} {%- endif -%}

2
salt/curator/files/action/delete.yml
View File

@@ -1,5 +1,5 @@
{%- if grains['role'] in ['so-node', 'so-searchnode', 'so-heavynode'] %} {%- if grains['role'] in ['so-node', 'so-searchnode', 'so-heavynode'] %}
{%- set log_size_limit = salt['pillar.get']('node:log_size_limit', '') -%} {%- set log_size_limit = salt['pillar.get']('elasticsearch:log_size_limit', '') -%}
{%- elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %} {%- elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %}
{%- set log_size_limit = salt['pillar.get']('master:log_size_limit', '') -%} {%- set log_size_limit = salt['pillar.get']('master:log_size_limit', '') -%}
{%- endif %} {%- endif %}

6
salt/curator/files/bin/so-curator-closed-delete-delete
View File

@@ -2,9 +2,9 @@
#!/bin/bash #!/bin/bash
{%- if grains['role'] in ['so-node', 'so-searchnode', 'so-heavynode'] %} {%- if grains['role'] in ['so-node', 'so-searchnode', 'so-heavynode'] %}
{%- set ELASTICSEARCH_HOST = salt['pillar.get']('node:mainip', '') -%} {%- set ELASTICSEARCH_HOST = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set ELASTICSEARCH_PORT = salt['pillar.get']('node:es_port', '') -%} {%- set ELASTICSEARCH_PORT = salt['pillar.get']('elasticsearch:es_port', '') -%}
{%- set LOG_SIZE_LIMIT = salt['pillar.get']('node:log_size_limit', '') -%} {%- set LOG_SIZE_LIMIT = salt['pillar.get']('elasticsearch:log_size_limit', '') -%}
{%- elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %} {%- elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %}
{%- set ELASTICSEARCH_HOST = salt['pillar.get']('master:mainip', '') -%} {%- set ELASTICSEARCH_HOST = salt['pillar.get']('master:mainip', '') -%}
{%- set ELASTICSEARCH_PORT = salt['pillar.get']('master:es_port', '') -%} {%- set ELASTICSEARCH_PORT = salt['pillar.get']('master:es_port', '') -%}

2
salt/curator/files/curator.yml
View File

@@ -1,5 +1,5 @@
{% if grains['role'] in ['so-node', 'so-heavynode'] %} {% if grains['role'] in ['so-node', 'so-heavynode'] %}
{%- set elasticsearch = salt['pillar.get']('node:mainip', '') -%} {%- set elasticsearch = salt['pillar.get']('elasticsearch:mainip', '') -%}
{% elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %} {% elif grains['role'] in ['so-eval', 'so-mastersearch', 'so-standalone'] %}
{%- set elasticsearch = salt['pillar.get']('master:mainip', '') -%} {%- set elasticsearch = salt['pillar.get']('master:mainip', '') -%}
{%- endif %} {%- endif %}

2
salt/elastalert/init.sls
View File

@@ -20,7 +20,7 @@
{% set esip = salt['pillar.get']('master:mainip', '') %} {% set esip = salt['pillar.get']('master:mainip', '') %}
{% set esport = salt['pillar.get']('master:es_port', '') %} {% set esport = salt['pillar.get']('master:es_port', '') %}
{% elif grains['role'] == 'so-node' %} {% elif grains['role'] == 'so-node' %}
{% set esalert = salt['pillar.get']('node:elastalert', '0') %} {% set esalert = salt['pillar.get']('elasticsearch:elastalert', '0') %}
{% endif %} {% endif %}
# Elastalert # Elastalert

2
salt/elasticsearch/files/elasticsearch.yml
View File

@@ -12,7 +12,7 @@ path.logs: /var/log/elasticsearch
action.destructive_requires_name: true action.destructive_requires_name: true
{%- else %} {%- else %}
{%- set esclustername = salt['grains.get']('host', '') %} {%- set esclustername = salt['grains.get']('host', '') %}
{%- set nodeip = salt['pillar.get']('node:mainip', '') -%} {%- set nodeip = salt['pillar.get']('elasticsearch:mainip', '') -%}
cluster.name: "{{ esclustername }}" cluster.name: "{{ esclustername }}"
network.host: 0.0.0.0 network.host: 0.0.0.0
discovery.zen.minimum_master_nodes: 1 discovery.zen.minimum_master_nodes: 1

4
salt/elasticsearch/init.sls
View File

@@ -26,8 +26,8 @@
{% set esclustername = salt['pillar.get']('master:esclustername', '') %} {% set esclustername = salt['pillar.get']('master:esclustername', '') %}
{% set esheap = salt['pillar.get']('master:esheap', '') %} {% set esheap = salt['pillar.get']('master:esheap', '') %}
{% elif grains['role'] in ['so-node','so-heavynode'] %} {% elif grains['role'] in ['so-node','so-heavynode'] %}
{% set esclustername = salt['pillar.get']('node:esclustername', '') %} {% set esclustername = salt['pillar.get']('elasticsearch:esclustername', '') %}
{% set esheap = salt['pillar.get']('node:esheap', '') %} {% set esheap = salt['pillar.get']('elasticsearch:esheap', '') %}
{% endif %} {% endif %}
vm.max_map_count: vm.max_map_count:

2
salt/firewall/hostgroups.yaml
View File

@@ -19,4 +19,4 @@ firewall:
ips: ips:
delete: delete:
insert: insert:
- {{ salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('master:mainint', salt['pillar.get']('node:mainint', salt['pillar.get']('host:mainint')))))[0] }} - {{ salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('master:mainint', salt['pillar.get']('elasticsearch:mainint', salt['pillar.get']('host:mainint')))))[0] }}

2
salt/logstash/pipelines/config/so/0900_input_redis.conf.jinja
View File

@@ -1,5 +1,5 @@
{%- if grains.role == 'so-heavynode' %} {%- if grains.role == 'so-heavynode' %}
{%- set MASTER = salt['pillar.get']('node:mainip', '') %} {%- set MASTER = salt['pillar.get']('elasticsearch:mainip', '') %}
{%- else %} {%- else %}
{%- set MASTER = salt['pillar.get']('static:masterip', '') %} {%- set MASTER = salt['pillar.get']('static:masterip', '') %}
{% endif -%} {% endif -%}

2
salt/logstash/pipelines/config/so/9000_output_zeek.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9001_output_switch.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9002_output_import.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Updated by: Doug Burks # Updated by: Doug Burks
# Last Update: 5/16/2017 # Last Update: 5/16/2017

2
salt/logstash/pipelines/config/so/9004_output_flow.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9026_output_dhcp.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9029_output_esxi.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9030_output_greensql.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9031_output_iis.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9032_output_mcafee.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9033_output_snort.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9034_output_syslog.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
filter { filter {

2
salt/logstash/pipelines/config/so/9100_output_osquery.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Josh Brower # Author: Josh Brower
# Last Update: 12/29/2018 # Last Update: 12/29/2018

2
salt/logstash/pipelines/config/so/9200_output_firewall.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9300_output_windows.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9301_output_dns_windows.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9400_output_suricata.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
output { output {

2
salt/logstash/pipelines/config/so/9600_output_ossec.conf.jinja
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] == 'so-eval' -%} {%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics

2
salt/mysql/init.sls
View File

@@ -2,7 +2,7 @@
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') %} {%- set MASTERIP = salt['pillar.get']('static:masterip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.2.2') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.2.2') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% set MAINIP = salt['pillar.get']('node:mainip') %} {% set MAINIP = salt['pillar.get']('elasticsearch:mainip') %}
{% set FLEETARCH = salt['grains.get']('role') %} {% set FLEETARCH = salt['grains.get']('role') %}
{% if FLEETARCH == "so-fleet" %} {% if FLEETARCH == "so-fleet" %}

2
salt/playbook/init.sls
View File

@@ -1,7 +1,7 @@
{% set MASTERIP = salt['pillar.get']('master:mainip', '') %} {% set MASTERIP = salt['pillar.get']('master:mainip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.2.2') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.2.2') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% set MAINIP = salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('master:mainint', salt['pillar.get']('node:mainint', salt['pillar.get']('host:mainint')))))[0] %} {% set MAINIP = salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('master:mainint', salt['pillar.get']('elasticsearch:mainint', salt['pillar.get']('host:mainint')))))[0] %}
{%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%} {%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%}
{%- set PLAYBOOKPASS = salt['pillar.get']('secrets:playbook', None) -%} {%- set PLAYBOOKPASS = salt['pillar.get']('secrets:playbook', None) -%}

2
salt/telegraf/etc/telegraf.conf
View File

@@ -14,7 +14,7 @@
# for numbers and booleans they should be plain (ie, $INT_VAR, $BOOL_VAR) # for numbers and booleans they should be plain (ie, $INT_VAR, $BOOL_VAR)
{%- set MASTER = grains['master'] %} {%- set MASTER = grains['master'] %}
{% set NODEIP = salt['pillar.get']('node:mainip', '') %} {% set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
{% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %} {% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
{% set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %} {% set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %}

2
salt/wazuh/files/agent/ossec.conf
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] in ['so-master', 'so-eval', 'so-mastersearch', 'so-standalone'] %} {%- if grains['role'] in ['so-master', 'so-eval', 'so-mastersearch', 'so-standalone'] %}
{%- set ip = salt['pillar.get']('static:masterip', '') %} {%- set ip = salt['pillar.get']('static:masterip', '') %}
{%- elif grains['role'] == 'so-node' or grains['role'] == 'so-heavynode' %} {%- elif grains['role'] == 'so-node' or grains['role'] == 'so-heavynode' %}
{%- set ip = salt['pillar.get']('node:mainip', '') %} {%- set ip = salt['pillar.get']('elasticsearch:mainip', '') %}
{%- elif grains['role'] == 'so-sensor' %} {%- elif grains['role'] == 'so-sensor' %}
{%- set ip = salt['pillar.get']('sensor:mainip', '') %} {%- set ip = salt['pillar.get']('sensor:mainip', '') %}
{%- endif %} {%- endif %}

2
salt/wazuh/files/agent/wazuh-register-agent
View File

@@ -1,7 +1,7 @@
{%- if grains['role'] in ['so-master', 'so-eval', 'so-mastersearch', 'so-standalone'] %} {%- if grains['role'] in ['so-master', 'so-eval', 'so-mastersearch', 'so-standalone'] %}
{%- set ip = salt['pillar.get']('static:masterip', '') %} {%- set ip = salt['pillar.get']('static:masterip', '') %}
{%- elif grains['role'] == 'so-node' or grains['role'] == 'so-heavynode' %} {%- elif grains['role'] == 'so-node' or grains['role'] == 'so-heavynode' %}
{%- set ip = salt['pillar.get']('node:mainip', '') %} {%- set ip = salt['pillar.get']('elasticsearch:mainip', '') %}
{%- elif grains['role'] == 'so-sensor' %} {%- elif grains['role'] == 'so-sensor' %}
{%- set ip = salt['pillar.get']('sensor:mainip', '') %} {%- set ip = salt['pillar.get']('sensor:mainip', '') %}
{%- endif %} {%- endif %}

15
setup/so-functions
View File

@@ -1004,7 +1004,7 @@ master_static() {
" fleet_ip: N/A"\ " fleet_ip: N/A"\
" sensoronikey: $SENSORONIKEY"\ " sensoronikey: $SENSORONIKEY"\
" wazuh: $WAZUH"\ " wazuh: $WAZUH"\
" masterupdate: $MASTERUPDATES"\ " masterupdate: $MASTERUPDATES"\
"strelka:"\ "strelka:"\
" enabled: $STRELKA"\ " enabled: $STRELKA"\
" rules: $STRELKARULES"\ " rules: $STRELKARULES"\
@@ -1047,22 +1047,26 @@ network_setup() {
} >> "$setup_log" 2>&1 } >> "$setup_log" 2>&1
} }
node_pillar() { elasticsearch_pillar() {
local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls
# Create the node pillar # Create the node pillar
printf '%s\n'\ printf '%s\n'\
"node:"\ "elasticsearch:"\
" mainip: $MAINIP"\ " mainip: $MAINIP"\
" mainint: $MNIC"\ " mainint: $MNIC"\
" esheap: $NODE_ES_HEAP_SIZE"\ " esheap: $NODE_ES_HEAP_SIZE"\
" esclustername: {{ grains.host }}"\ " esclustername: {{ grains.host }}"\
" es_shard_count: $SHARDCOUNT"\
" node_type: $NODETYPE"\ " node_type: $NODETYPE"\
" es_port: $node_es_port"\ " es_port: $node_es_port"\
" log_size_limit: $log_size_limit"\ " log_size_limit: $log_size_limit"\
" cur_close_days: $CURCLOSEDAYS"\ " cur_close_days: $CURCLOSEDAYS"\
" route_type: hot"\
" index_settings:"\
" so-zeek:"\
" shards: 5"\
" replicas: 0"\
"" >> "$pillar_file" "" >> "$pillar_file"
if [ "$install_type" != 'EVAL' ] && [ "$install_type" != 'HELIXSENSOR' ] && [ "$install_type" != 'MASTERSEARCH' ] && [ "$install_type" != 'STANDALONE' ]; then if [ "$install_type" != 'EVAL' ] && [ "$install_type" != 'HELIXSENSOR' ] && [ "$install_type" != 'MASTERSEARCH' ] && [ "$install_type" != 'STANDALONE' ]; then
@@ -1563,9 +1567,6 @@ set_node_type() {
'SEARCHNODE' | 'EVAL' | 'MASTERSEARCH' | 'HEAVYNODE' | 'STANDALONE') 'SEARCHNODE' | 'EVAL' | 'MASTERSEARCH' | 'HEAVYNODE' | 'STANDALONE')
NODETYPE='search' NODETYPE='search'
;; ;;
'PARSINGNODE')
NODETYPE='parser'
;;
'HOTNODE') 'HOTNODE')
NODETYPE='hot' NODETYPE='hot'
;; ;;

2
setup/so-setup
View File

@@ -441,7 +441,7 @@ fi
set_node_type >> $setup_log 2>&1 set_node_type >> $setup_log 2>&1
set_progress_str 19 'Generating search node pillar' set_progress_str 19 'Generating search node pillar'
node_pillar >> $setup_log 2>&1 elasticsearch_pillar >> $setup_log 2>&1
fi fi
if [[ $is_minion ]]; then if [[ $is_minion ]]; then