CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' into foxtrot

Browse Source
This commit is contained in:
William Wernert
2021-10-25 10:50:25 -04:00
parent 38b16a507b d5d970672d
commit dca30146ab
2 changed files with 162 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

157
salt/elasticsearch/templates/so/so-endgame-template.json.jinja
View File

@@ -26,23 +26,48 @@
"properties": { "properties": {
"ephemeral_id": { "ephemeral_id": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"id": { "id": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"name": { "name": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"type": { "type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"version": { "version": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
} }
} }
}, },
@@ -597,7 +622,12 @@
"properties": { "properties": {
"version": { "version": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
} }
} }
}, },
@@ -683,18 +713,33 @@
}, },
"category": { "category": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"code": { "code": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
}, },
"created": { "created": {
"type": "date" "type": "date",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"dataset": { "dataset": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"duration": { "duration": {
"type": "long" "type": "long"
@@ -711,7 +756,12 @@
"type": "keyword" "type": "keyword"
}, },
"ingested": { "ingested": {
"type": "date" "type": "date",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"kind": { "kind": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -719,7 +769,12 @@
}, },
"module": { "module": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"original": { "original": {
"doc_values": false, "doc_values": false,
@@ -729,7 +784,12 @@
}, },
"outcome": { "outcome": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"provider": { "provider": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -756,11 +816,21 @@
}, },
"timezone": { "timezone": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"type": { "type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"url": { "url": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -1006,7 +1076,12 @@
}, },
"name": { "name": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"os": { "os": {
"properties": { "properties": {
@@ -1139,11 +1214,21 @@
}, },
"method": { "method": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"referrer": { "referrer": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
} }
} }
}, },
@@ -1187,7 +1272,12 @@
"properties": { "properties": {
"level": { "level": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"logger": { "logger": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -2149,7 +2239,12 @@
}, },
"name": { "name": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"node": { "node": {
"properties": { "properties": {
@@ -2165,7 +2260,12 @@
}, },
"type": { "type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"version": { "version": {
"ignore_above": 1024, "ignore_above": 1024,
@@ -2177,7 +2277,12 @@
"properties": { "properties": {
"address": { "address": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"as": { "as": {
"properties": { "properties": {
@@ -2333,7 +2438,12 @@
}, },
"tags": { "tags": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword",
"fields": {
"keyword": {
"type": "keyword"
}
}
}, },
"threat": { "threat": {
"properties": { "properties": {
@@ -2684,6 +2794,9 @@
}, },
"original": { "original": {
"fields": { "fields": {
"keyword": {
"type": "keyword"
},
"text": { "text": {
"norms": false, "norms": false,
"type": "text" "type": "text"

28
salt/soc/init.sls
View File

@@ -80,6 +80,10 @@ soccustomroles:
- mode: 600 - mode: 600
- template: jinja - template: jinja
socusersroles:
file.exists:
- name: /opt/so/conf/soc/soc_users_roles
# we dont want this added too early in setup, so we add the onlyif to verify 'startup_states: highstate' # we dont want this added too early in setup, so we add the onlyif to verify 'startup_states: highstate'
# is in the minion config. That line is added before the final highstate during setup # is in the minion config. That line is added before the final highstate during setup
sosyncusers: sosyncusers:
@@ -95,13 +99,13 @@ so-soc:
- name: so-soc - name: so-soc
- binds: - binds:
- /nsm/soc/jobs:/opt/sensoroni/jobs:rw - /nsm/soc/jobs:/opt/sensoroni/jobs:rw
- /opt/so/log/soc/:/opt/sensoroni/logs/:rw
- /opt/so/conf/soc/soc.json:/opt/sensoroni/sensoroni.json:ro - /opt/so/conf/soc/soc.json:/opt/sensoroni/sensoroni.json:ro
- /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro - /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro
- /opt/so/conf/soc/banner.md:/opt/sensoroni/html/login/banner.md:ro - /opt/so/conf/soc/banner.md:/opt/sensoroni/html/login/banner.md:ro
- /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro - /opt/so/conf/soc/custom.js:/opt/sensoroni/html/js/custom.js:ro
- /opt/so/conf/soc/custom_roles:/opt/sensoroni/rbac/custom_roles:ro - /opt/so/conf/soc/custom_roles:/opt/sensoroni/rbac/custom_roles:ro
- /opt/so/conf/soc/soc_users_roles:/opt/sensoroni/rbac/users_roles:rw - /opt/so/conf/soc/soc_users_roles:/opt/sensoroni/rbac/users_roles:rw
- /opt/so/log/soc/:/opt/sensoroni/logs/:rw
{%- if salt['pillar.get']('nodestab', {}) %} {%- if salt['pillar.get']('nodestab', {}) %}
- extra_hosts: - extra_hosts:
{%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %} {%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
@@ -112,6 +116,15 @@ so-soc:
- 0.0.0.0:9822:9822 - 0.0.0.0:9822:9822
- watch: - watch:
- file: /opt/so/conf/soc/* - file: /opt/so/conf/soc/*
- require:
- file: socdatadir
- file: soclogdir
- file: socconfig
- file: socmotd
- file: socbanner
- file: soccustom
- file: soccustomroles
- file: socusersroles
append_so-soc_so-status.conf: append_so-soc_so-status.conf:
file.append: file.append:
@@ -154,6 +167,14 @@ kratossync:
- file_mode: 600 - file_mode: 600
- template: jinja - template: jinja
kratos_schema:
file.exists:
- name: /opt/so/conf/kratos/schema.json
kratos_yaml:
file.exists:
- name: /opt/so/conf/kratos/kratos.yaml
so-kratos: so-kratos:
docker_container.running: docker_container.running:
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-kratos:{{ VERSION }} - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-kratos:{{ VERSION }}
@@ -169,6 +190,11 @@ so-kratos:
- 0.0.0.0:4434:4434 - 0.0.0.0:4434:4434
- watch: - watch:
- file: /opt/so/conf/kratos - file: /opt/so/conf/kratos
- require:
- file: kratos_schema
- file: kratos_yaml
- file: kratoslogdir
- file: kratosdir
append_so-kratos_so-status.conf: append_so-kratos_so-status.conf:
file.append: file.append: