CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-20 16:03:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Merge remote-tracking branch 'remotes/origin/dev' into issue/3933"

Browse Source 
This reverts commit 54eec92621, reversing
changes made to 7832e59629.
This commit is contained in:
m0duspwnens
2021-10-13 15:22:46 -04:00
parent 54eec92621
commit c8fb504ee0
11 changed files with 1 additions and 2992 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
salt/logstash/pipelines/config/so/0011_input_endgame.conf
View File

@@ -1,12 +0,0 @@
input {
http {
id => "endgame_data"
port => 3765
codec => es_bulk
ssl => true
ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"]
ssl_certificate => "/usr/share/logstash/filebeat.crt"
ssl_key => "/usr/share/logstash/filebeat.key"
ssl_verify_mode => "peer"
}
}

29
salt/logstash/pipelines/config/so/9900_output_endgame.conf.jinja
View File

@@ -1,29 +0,0 @@
{%- if grains['role'] == 'so-eval' -%}
{%- set ES = salt['pillar.get']('manager:mainip', '') -%}
{%- else %}
{%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- endif %}
{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
filter {
if [event][module] =~ "endgame" {
mutate {
remove_field => ["headers", "host"]
}
}
}
output {
if [event][module] =~ "endgame" {
elasticsearch {
id => "endgame_es_output"
hosts => "{{ ES }}"
{% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
user => "{{ ES_USER }}"
password => "{{ ES_PASS }}"
{% endif %}
index => "endgame-%{+YYYY.MM.dd}"
ssl => true
ssl_certificate_verification => false
}
}
}