CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add Anomali, Cybersixgill, Snort, and ThreatQuotient

Browse Source
This commit is contained in:
weslambert
2023-12-13 11:03:25 -05:00
committed by GitHub
parent b0a69d30c9
commit cdac2bfa16
1 changed files with 176 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

176
salt/elasticsearch/defaults.yaml
View File

@@ -6737,6 +6737,50 @@ elasticsearch:
set_priority:
priority: 50
min_age: 30d
so-logs-snort_x_log:
index_sorting: False
index_template:
index_patterns:
- "logs-snort.log-*"
template:
settings:
index:
lifecycle:
name: so-logs-snort.log-logs
number_of_replicas: 0
composed_of:
- "logs-snort.log@package"
- "logs-snort.log@custom"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 501
data_stream:
hidden: false
allow_custom_routing: false
policy:
phases:
cold:
actions:
set_priority:
priority: 0
min_age: 30d
delete:
actions:
delete: {}
min_age: 365d
hot:
actions:
rollover:
max_age: 30d
max_primary_shard_size: 50gb
set_priority:
priority: 100
min_age: 0ms
warm:
actions:
set_priority:
priority: 50
min_age: 30d
so-logs-snyk_x_audit:
index_sorting: false
index_template:
@@ -7622,6 +7666,94 @@ elasticsearch:
set_priority:
priority: 50
min_age: 30d
so-logs-ti_anomali_x_threatstream:
index_sorting: False
index_template:
index_patterns:
- "logs-ti_anomali.threatstream-*"
template:
settings:
index:
lifecycle:
name: so-logs-ti_anomali.threatstream-logs
number_of_replicas: 0
composed_of:
- "logs-ti_anomali.threatstream@package"
- "logs-ti_anomali.threatstream@custom"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 501
data_stream:
hidden: false
allow_custom_routing: false
policy:
phases:
cold:
actions:
set_priority:
priority: 0
min_age: 30d
delete:
actions:
delete: {}
min_age: 365d
hot:
actions:
rollover:
max_age: 30d
max_primary_shard_size: 50gb
set_priority:
priority: 100
min_age: 0ms
warm:
actions:
set_priority:
priority: 50
min_age: 30d
so-logs-ti_cybersixgill_x_threat:
index_sorting: False
index_template:
index_patterns:
- "logs-ti_cybersixgill.threat-*"
template:
settings:
index:
lifecycle:
name: so-logs-ti_cybersixgill.threat-logs
number_of_replicas: 0
composed_of:
- "logs-ti_cybersixgill.threat@package"
- "logs-ti_cybersixgill.threat@custom"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 501
data_stream:
hidden: false
allow_custom_routing: false
policy:
phases:
cold:
actions:
set_priority:
priority: 0
min_age: 30d
delete:
actions:
delete: {}
min_age: 365d
hot:
actions:
rollover:
max_age: 30d
max_primary_shard_size: 50gb
set_priority:
priority: 100
min_age: 0ms
warm:
actions:
set_priority:
priority: 50
min_age: 30d
so-logs-ti_misp_x_threat:
index_sorting: false
index_template:
@@ -7842,6 +7974,50 @@ elasticsearch:
set_priority:
priority: 50
min_age: 30d
so-logs-ti_threatq_x_threat:
index_sorting: False
index_template:
index_patterns:
- "logs-ti_threatq.threat-*"
template:
settings:
index:
lifecycle:
name: so-logs-ti_threatq.threat-logs
number_of_replicas: 0
composed_of:
- "logs-ti_threatq.threat@package"
- "logs-ti_threatq.threat@custom"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 501
data_stream:
hidden: false
allow_custom_routing: false
policy:
phases:
cold:
actions:
set_priority:
priority: 0
min_age: 30d
delete:
actions:
delete: {}
min_age: 365d
hot:
actions:
rollover:
max_age: 30d
max_primary_shard_size: 50gb
set_priority:
priority: 100
min_age: 0ms
warm:
actions:
set_priority:
priority: 50
min_age: 30d
so-logs-vsphere_x_log:
index_sorting: False
index_template: