CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Directly manage the Fleet Server integration config

Browse Source
This commit is contained in:
DefensiveDepth
2024-08-20 15:06:16 -04:00
parent ca209ed54c
commit e3ecc9d4be
2 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
salt/elasticfleet/files/integrations-dynamic/fleet-server/fleet-server.json Normal file
View File

@@ -0,0 +1,21 @@
{% from 'vars/globals.map.jinja' import GLOBALS %}
{
"package": {
"name": "fleet_server",
"version": ""
},
"name": "fleet_server-1",
"namespace": "default",
"policy_id": "FleetServer_{{ GLOBALS.hostname }}",
"vars": {},
"inputs": {
"fleet_server-fleet-server": {
"enabled": true,
"vars": {
"custom": "server.ssl.supported_protocols: [\"TLSv1.2\", \"TLSv1.3\"]\nserver.ssl.cipher_suites: [ \"ECDHE-RSA-AES-128-GCM-SHA256\", \"ECDHE-RSA-AES-256-GCM-SHA384\", \"ECDHE-RSA-AES-128-CBC-SHA\", \"ECDHE-RSA-AES-256-CBC-SHA\", \"RSA-AES-128-GCM-SHA256\", \"RSA-AES-256-GCM-SHA384\"]"
},
"streams": {}
}
}
}

5
salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-setup
View File

@@ -66,7 +66,10 @@ printf "\n\n"
# Create the Manager Fleet Server Host Agent Policy
# This has to be done while the Elasticsearch Output is set to the default Output
printf "Create Manager Fleet Server Policy...\n"
elastic_fleet_policy_create "FleetServer_{{ GLOBALS.hostname }}" "Fleet Server - {{ GLOBALS.hostname }}" "true" "120"
elastic_fleet_policy_create "FleetServer_{{ GLOBALS.hostname }}" "Fleet Server - {{ GLOBALS.hostname }}" "false" "120"
# Now that the Manager Fleet Server Policy is created, add the Fleet Server Integration to it
elastic_fleet_integration_create "@/opt/so/conf/elastic-fleet/integrations/fleet-server/fleet-server.json"
# Now we can create the Logstash Output and set it to to be the default Output
printf "\n\nCreate Logstash Output Config if node is not an Import or Eval install\n"