CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #299 from Security-Onion-Solutions/fix/zeek-bpfv2

Browse Source 
Zeek - bpf fixup
This commit is contained in:
Josh Brower
2020-01-31 15:08:29 -05:00
committed by GitHub
parent f5efc68825 b5bf12f8c8
commit e07f5d30b7
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/zeek/init.sls
View File

@@ -2,6 +2,7 @@
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}
{% set BPF_ZEEK = salt['pillar.get']('zeek:bpf') %} {% set BPF_ZEEK = salt['pillar.get']('zeek:bpf') %}
{% set BPF_STATUS = 0 %} {% set BPF_STATUS = 0 %}
{% set INTERFACE = salt['pillar.get']('sensor:interface', 'bond0') %}
# Zeek Salt State # Zeek Salt State
# Add Zeek group # Add Zeek group
zeekgroup: zeekgroup:
@@ -94,7 +95,7 @@ plcronscript:
# BPF compilation and configuration # BPF compilation and configuration
{% if BPF_ZEEK %} {% if BPF_ZEEK %}
{% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', interface + ' ' + BPF_ZEEK|join(" ") ) %} {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', INTERFACE + ' ' + BPF_ZEEK|join(" ") ) %}
{% if BPF_CALC['stderr'] == "" %} {% if BPF_CALC['stderr'] == "" %}
{% set BPF_STATUS = 1 %} {% set BPF_STATUS = 1 %}
{% else %} {% else %}
@@ -140,8 +141,10 @@ so-zeek:
- /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro - /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro
- /opt/so/conf/zeek/policy/cve-2020-0601:/opt/zeek/share/zeek/policy/cve-2020-0601:ro - /opt/so/conf/zeek/policy/cve-2020-0601:/opt/zeek/share/zeek/policy/cve-2020-0601:ro
- /opt/so/conf/zeek/policy/intel:/opt/zeek/share/zeek/policy/intel:rw - /opt/so/conf/zeek/policy/intel:/opt/zeek/share/zeek/policy/intel:rw
- /opt/so/conf/zeek/bpf:/opt/zeek/etc/bpf:ro
- network_mode: host - network_mode: host
- watch: - watch:
- file: /opt/so/conf/zeek/local.zeek - file: /opt/so/conf/zeek/local.zeek
- file: /opt/so/conf/zeek/node.cfg - file: /opt/so/conf/zeek/node.cfg
- file: /opt/so/conf/zeek/policy - file: /opt/so/conf/zeek/policy
- file: /opt/so/conf/zeek/bpf

2
salt/zeek/policy/securityonion/bpfconf.zeek
View File

@@ -10,7 +10,7 @@ export {
## The file that is watched on disk for BPF filter changes. ## The file that is watched on disk for BPF filter changes.
## Two templated variables are available; "sensorname" and "interface". ## Two templated variables are available; "sensorname" and "interface".
## They can be used by surrounding the term by doubled curly braces. ## They can be used by surrounding the term by doubled curly braces.
const filename = "/opt/zeek/share/zeek/site/bpf" &redef; const filename = "/opt/zeek/etc/bpf" &redef;
redef enum Notice::Type += { redef enum Notice::Type += {
## Invalid filter notice. ## Invalid filter notice.