CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add event mappings and remove meta information for now

Browse Source
This commit is contained in:
Wes
2023-06-13 13:35:46 +00:00
parent 57268ba934
commit d0a6881c2c
1 changed files with 12 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
salt/elasticsearch/defaults.yaml
View File

@@ -296,7 +296,7 @@ elasticsearch:
- "logs-elastic_agent.apm_server@custom" - "logs-elastic_agent.apm_server@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1" - "so-fleet_agent_id_verification-1"
priority: 200 priority: 501
data_stream: data_stream:
hidden: false hidden: false
allow_custom_routing: false allow_custom_routing: false
@@ -350,7 +350,7 @@ elasticsearch:
- "logs-elastic_agent.auditbeat@custom" - "logs-elastic_agent.auditbeat@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1" - "so-fleet_agent_id_verification-1"
priority: 200 priority: 501
data_stream: data_stream:
hidden: false hidden: false
allow_custom_routing: false allow_custom_routing: false
@@ -404,7 +404,7 @@ elasticsearch:
- "logs-elastic_agent.cloudbeat@custom" - "logs-elastic_agent.cloudbeat@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1" - "so-fleet_agent_id_verification-1"
priority: 200 priority: 501
policy: policy:
phases: phases:
hot: hot:
@@ -455,7 +455,7 @@ elasticsearch:
- "logs-elastic_agent.endpoint_security@custom" - "logs-elastic_agent.endpoint_security@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1" - "so-fleet_agent_id_verification-1"
priority: 200 priority: 501
data_stream: data_stream:
hidden: false hidden: false
allow_custom_routing: false allow_custom_routing: false
@@ -498,13 +498,8 @@ elasticsearch:
sort: sort:
field: "@timestamp" field: "@timestamp"
order: desc order: desc
mappings:
_meta:
package:
name: elastic_agent
managed_by: security_onion
managed: true
composed_of: composed_of:
- "event-mappings"
- "logs-elastic_agent.filebeat@package" - "logs-elastic_agent.filebeat@package"
- "logs-elastic_agent.filebeat@custom" - "logs-elastic_agent.filebeat@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
@@ -546,19 +541,11 @@ elasticsearch:
settings: settings:
index: index:
number_of_replicas: 0 number_of_replicas: 0
mapping:
total_fields:
limit: 5000
sort: sort:
field: "@timestamp" field: "@timestamp"
order: desc order: desc
mappings:
_meta:
package:
name: elastic_agent
managed_by: security_onion
managed: true
composed_of: composed_of:
- "event-mappings"
- "logs-elastic_agent.fleet_server@package" - "logs-elastic_agent.fleet_server@package"
- "logs-elastic_agent.fleet_server@custom" - "logs-elastic_agent.fleet_server@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
@@ -617,7 +604,7 @@ elasticsearch:
- "logs-elastic_agent.heartbeat@custom" - "logs-elastic_agent.heartbeat@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1" - "so-fleet_agent_id_verification-1"
priority: 200 priority: 501
policy: policy:
phases: phases:
hot: hot:
@@ -664,11 +651,12 @@ elasticsearch:
managed_by: security_onion managed_by: security_onion
managed: true managed: true
composed_of: composed_of:
- "event-mappings"
- "logs-elastic_agent@package" - "logs-elastic_agent@package"
- "logs-elastic_agent@custom" - "logs-elastic_agent@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1" - "so-fleet_agent_id_verification-1"
priority: 200 priority: 501
data_stream: data_stream:
hidden: false hidden: false
allow_custom_routing: false allow_custom_routing: false
@@ -711,18 +699,13 @@ elasticsearch:
sort: sort:
field: "@timestamp" field: "@timestamp"
order: desc order: desc
mappings:
_meta:
package:
name: elastic_agent
managed_by: security_onion
managed: true
composed_of: composed_of:
- "event-mappings"
- "logs-elastic_agent.metricbeat@package" - "logs-elastic_agent.metricbeat@package"
- "logs-elastic_agent.metricbeat@custom" - "logs-elastic_agent.metricbeat@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1" - "so-fleet_agent_id_verification-1"
priority: 200 priority: 501
data_stream: data_stream:
hidden: false hidden: false
allow_custom_routing: false allow_custom_routing: false
@@ -765,13 +748,8 @@ elasticsearch:
sort: sort:
field: "@timestamp" field: "@timestamp"
order: desc order: desc
mappings:
_meta:
package:
name: elastic_agent
managed_by: security_onion
managed: true
composed_of: composed_of:
- "event-mappings"
- "logs-elastic_agent.osquerybeat@package" - "logs-elastic_agent.osquerybeat@package"
- "logs-elastic_agent.osquerybeat@custom" - "logs-elastic_agent.osquerybeat@custom"
- "so-fleet_globals-1" - "so-fleet_globals-1"