CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8785 from Security-Onion-Solutions/fix/elasticsearch_component_templates_fleet_main

Browse Source 
Add additional component templates for Fleet and fix references for Elastic Agent index templates in defaults.yaml
This commit is contained in:
weslambert
2022-09-20 17:02:02 -04:00
committed by GitHub
parent f0ddfecd42 46dd4c2749
commit e35c77be62
3 changed files with 169 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
salt/elasticsearch/defaults.yaml
View File

@@ -80,8 +80,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.apm_server@package"
- "so-logs-elastic_agent.apm_server@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -114,8 +114,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.auditbeat@package"
- "so-logs-elastic_agent.auditbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -148,8 +148,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.cloudbeat@package"
- "so-logs-elastic_agent.cloudbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -182,8 +182,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.endpoint_security@package"
- "so-logs-elastic_agent.endpoint_security@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -216,8 +216,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.filebeat@package"
- "so-logs-elastic_agent.filebeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -250,8 +250,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.fleet_server@package"
- "so-logs-elastic_agent.fleet_server@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -284,8 +284,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.heartbeat@package"
- "so-logs-elastic_agent.heartbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -318,8 +318,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent@package"
- "so-logs-elastic_agent@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -352,8 +352,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.metricbeat@package"
- "so-logs-elastic_agent.metricbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -386,8 +386,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.osquerybeat@package"
- "so-logs-elastic_agent.osquerybeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:
@@ -420,8 +420,8 @@ elasticsearch:
composed_of:
- "so-logs-elastic_agent.packetbeat@package"
- "so-logs-elastic_agent.packetbeat@custom"
- ".fleet_globals-1"
- ".fleet_agent_id_verification-1"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 500
_meta:
package:

74
salt/elasticsearch/templates/component/elastic-agent/so-fleet_agent_id_verification-1.json Normal file
View File

@@ -0,0 +1,74 @@
{
"component_templates": [
{
"name": "so-fleet_agent_id_verification-1",
"component_template": {
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
},
"index": {
"final_pipeline": ".fleet_final_pipeline-1"
}
},
"mappings": {
"properties": {
"event": {
"properties": {
"agent_id_status": {
"ignore_above": 1024,
"type": "keyword"
},
"ingested": {
"format": "strict_date_time_no_millis||strict_date_optional_time||epoch_millis",
"type": "date"
}
}
}
}
}
},
"_meta": {
"managed_by": "fleet",
"managed": true
}
}
}
]
}

73
salt/elasticsearch/templates/component/elastic-agent/so-fleet_globals-1.json Normal file
View File

@@ -0,0 +1,73 @@
{
"component_templates": [
{
"name": "so-fleet_globals-1",
"component_template": {
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
"mappings": {
"_meta": {
"managed_by": "security_onion",
"managed": true
},
"dynamic_templates": [
{
"strings_as_keyword": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string"
}
}
],
"date_detection": false
}
},
"_meta": {
"managed_by": "security_onion",
"managed": true
}
}
}
]
}