From 59852841ffe9628b3833002de7d2b67dda8bd8b0 Mon Sep 17 00:00:00 2001 From: weslambert Date: Fri, 15 Oct 2021 13:29:50 -0400 Subject: [PATCH 1/3] Add keyword subfield for event.module --- .../templates/so/so-endgame-template.json.jinja | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/salt/elasticsearch/templates/so/so-endgame-template.json.jinja b/salt/elasticsearch/templates/so/so-endgame-template.json.jinja index 824558e8f..e39a2fcf9 100644 --- a/salt/elasticsearch/templates/so/so-endgame-template.json.jinja +++ b/salt/elasticsearch/templates/so/so-endgame-template.json.jinja @@ -719,7 +719,12 @@ }, "module": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "original": { "doc_values": false, From 928aed27c5ab7c4d8a2bd17d563c57269c067f2d Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 20 Oct 2021 17:04:02 -0400 Subject: [PATCH 2/3] require files before starting soc or kratos --- salt/soc/init.sls | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/salt/soc/init.sls b/salt/soc/init.sls index 1fbfe5de2..46449b15d 100644 --- a/salt/soc/init.sls +++ b/salt/soc/init.sls @@ -80,6 +80,10 @@ soccustomroles: - mode: 600 - template: jinja +socusersroles: + file.exists: + - name: /opt/so/conf/soc/soc_users_roles + # we dont want this added too early in setup, so we add the onlyif to verify 'startup_states: highstate' # is in the minion config. That line is added before the final highstate during setup sosyncusers: @@ -95,13 +99,13 @@ so-soc: - name: so-soc - binds: - /nsm/soc/jobs:/opt/sensoroni/jobs:rw + - /opt/so/log/soc/:/opt/sensoroni/logs/:rw - /opt/so/conf/soc/soc.json:/opt/sensoroni/sensoroni.json:ro - /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro - /opt/so/conf/soc/banner.md:/opt/sensoroni/html/login/banner.md:ro - /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro - /opt/so/conf/soc/custom_roles:/opt/sensoroni/rbac/custom_roles:ro - /opt/so/conf/soc/soc_users_roles:/opt/sensoroni/rbac/users_roles:rw - - /opt/so/log/soc/:/opt/sensoroni/logs/:rw {%- if salt['pillar.get']('nodestab', {}) %} - extra_hosts: {%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %} @@ -112,6 +116,15 @@ so-soc: - 0.0.0.0:9822:9822 - watch: - file: /opt/so/conf/soc/* + - require: + - file: socdatadir + - file: soclogdir + - file: socconfig + - file: socmotd + - file: socbanner + - file: soccustom + - file: soccustomroles + - file: socusersroles append_so-soc_so-status.conf: file.append: @@ -154,6 +167,14 @@ kratossync: - file_mode: 600 - template: jinja +kratos_schema: + file.exists: + - name: /opt/so/conf/kratos/schema.json + +kratos_yaml: + file.exists: + - name: /opt/so/conf/kratos/kratos.yaml + so-kratos: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-kratos:{{ VERSION }} @@ -169,6 +190,11 @@ so-kratos: - 0.0.0.0:4434:4434 - watch: - file: /opt/so/conf/kratos + - require: + - file: kratos_schema + - file: kratos_yaml + - file: kratoslogdir + - file: kratosdir append_so-kratos_so-status.conf: file.append: From 77ee1db44ceb5a76f0c7c3487469c18bf86e61e5 Mon Sep 17 00:00:00 2001 From: weslambert Date: Thu, 21 Oct 2021 12:56:03 -0400 Subject: [PATCH 3/3] Add .keyword subfield for conflict fields --- .../so/so-endgame-template.json.jinja | 150 +++++++++++++++--- 1 file changed, 129 insertions(+), 21 deletions(-) diff --git a/salt/elasticsearch/templates/so/so-endgame-template.json.jinja b/salt/elasticsearch/templates/so/so-endgame-template.json.jinja index e39a2fcf9..6d2b89b27 100644 --- a/salt/elasticsearch/templates/so/so-endgame-template.json.jinja +++ b/salt/elasticsearch/templates/so/so-endgame-template.json.jinja @@ -26,23 +26,48 @@ "properties": { "ephemeral_id": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "id": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "name": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "type": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "version": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } } } }, @@ -597,7 +622,12 @@ "properties": { "version": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } } } }, @@ -683,18 +713,33 @@ }, "category": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "code": { "ignore_above": 1024, "type": "keyword" }, "created": { - "type": "date" + "type": "date", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "dataset": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "duration": { "type": "long" @@ -711,7 +756,12 @@ "type": "keyword" }, "ingested": { - "type": "date" + "type": "date", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "kind": { "ignore_above": 1024, @@ -734,7 +784,12 @@ }, "outcome": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "provider": { "ignore_above": 1024, @@ -761,11 +816,21 @@ }, "timezone": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "type": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "url": { "ignore_above": 1024, @@ -1011,7 +1076,12 @@ }, "name": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "os": { "properties": { @@ -1144,11 +1214,21 @@ }, "method": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "referrer": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } } } }, @@ -1192,7 +1272,12 @@ "properties": { "level": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "logger": { "ignore_above": 1024, @@ -2154,7 +2239,12 @@ }, "name": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "node": { "properties": { @@ -2170,7 +2260,12 @@ }, "type": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "version": { "ignore_above": 1024, @@ -2182,7 +2277,12 @@ "properties": { "address": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "as": { "properties": { @@ -2338,7 +2438,12 @@ }, "tags": { "ignore_above": 1024, - "type": "keyword" + "type": "keyword", + "fields": { + "keyword": { + "type": "keyword" + } + } }, "threat": { "properties": { @@ -2689,6 +2794,9 @@ }, "original": { "fields": { + "keyword": { + "type": "keyword" + }, "text": { "norms": false, "type": "text"