CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-01-06 16:23:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

changes for 'generic' integrations with no compoent templates assigned. Default to using the logs-filestream.generic@package componet template

Browse Source
This commit is contained in:
reyesj2
2025-07-08 15:23:46 -05:00
parent 4bf2c931e9
commit d4f0cbcb67
3 changed files with 81 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-optional-integrations-load
View File

@@ -19,6 +19,7 @@ BULK_INSTALL_PACKAGE_LIST=/tmp/esfleet_bulk_install.json
BULK_INSTALL_PACKAGE_TMP=/tmp/esfleet_bulk_install_tmp.json
BULK_INSTALL_OUTPUT=/opt/so/state/esfleet_bulk_install_results.json
PACKAGE_COMPONENTS=/opt/so/state/esfleet_package_components.json
COMPONENT_TEMPLATES=/opt/so/state/esfleet_component_templates.txt
PENDING_UPDATE=false
@@ -155,6 +156,9 @@ if [[ -f $STATE_FILE_SUCCESS ]]; then
# Write out file for generating index/component/ilm templates
latest_installed_package_list=$(elastic_fleet_installed_packages)
echo $latest_installed_package_list | jq '[.items[] | {name: .name, es_index_patterns: .dataStreams}]' > $PACKAGE_COMPONENTS
# Refresh installed component template list
latest_component_templates_list=$(so-elasticsearch-query _component_template | jq '.component_templates[] | .name' | jq -s '.')
echo $latest_component_templates_list > $COMPONENT_TEMPLATES
else
# This is the installation of add-on integrations and upgrade of existing integrations. Exiting without error, next highstate will attempt to re-run.