CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Directly manage the Fleet Server integration config

Browse Source
This commit is contained in:
DefensiveDepth
2024-08-20 15:06:16 -04:00
parent ca209ed54c
commit e3ecc9d4be
2 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
salt/elasticfleet/files/integrations-dynamic/fleet-server/fleet-server.json Normal file
View File

@@ -0,0 +1,21 @@
{% from 'vars/globals.map.jinja' import GLOBALS %}
{
"package": {
"name": "fleet_server",
"version": ""
},
"name": "fleet_server-1",
"namespace": "default",
"policy_id": "FleetServer_{{ GLOBALS.hostname }}",
"vars": {},
"inputs": {
"fleet_server-fleet-server": {
"enabled": true,
"vars": {
"custom": "server.ssl.supported_protocols: [\"TLSv1.2\", \"TLSv1.3\"]\nserver.ssl.cipher_suites: [ \"ECDHE-RSA-AES-128-GCM-SHA256\", \"ECDHE-RSA-AES-256-GCM-SHA384\", \"ECDHE-RSA-AES-128-CBC-SHA\", \"ECDHE-RSA-AES-256-CBC-SHA\", \"RSA-AES-128-GCM-SHA256\", \"RSA-AES-256-GCM-SHA384\"]"
},
"streams": {}
}
}
}

5
salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-setup
View File

@@ -66,7 +66,10 @@ printf "\n\n"
# Create the Manager Fleet Server Host Agent Policy # Create the Manager Fleet Server Host Agent Policy
# This has to be done while the Elasticsearch Output is set to the default Output # This has to be done while the Elasticsearch Output is set to the default Output
printf "Create Manager Fleet Server Policy...\n" printf "Create Manager Fleet Server Policy...\n"
elastic_fleet_policy_create "FleetServer_{{ GLOBALS.hostname }}" "Fleet Server - {{ GLOBALS.hostname }}" "true" "120" elastic_fleet_policy_create "FleetServer_{{ GLOBALS.hostname }}" "Fleet Server - {{ GLOBALS.hostname }}" "false" "120"
# Now that the Manager Fleet Server Policy is created, add the Fleet Server Integration to it
elastic_fleet_integration_create "@/opt/so/conf/elastic-fleet/integrations/fleet-server/fleet-server.json"
# Now we can create the Logstash Output and set it to to be the default Output # Now we can create the Logstash Output and set it to to be the default Output
printf "\n\nCreate Logstash Output Config if node is not an Import or Eval install\n" printf "\n\nCreate Logstash Output Config if node is not an Import or Eval install\n"