CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1417 from Security-Onion-Solutions/bugfix/local_zeeklogs

Browse Source 
Bugfix/local zeeklogs
This commit is contained in:
William Wernert
2020-09-29 08:58:02 -04:00
committed by GitHub
parent 60134829d5 f77305e22f
commit ebe00822f8
4 changed files with 54 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
setup/so-functions
View File

@@ -1119,8 +1119,6 @@ manager_pillar() {
" kratoskey: $KRATOSKEY"\
"" >> "$pillar_file"
printf '%s\n' '----' >> "$setup_log" 2>&1
cat "$pillar_file" >> "$setup_log" 2>&1
}
manager_global() {
@@ -1326,8 +1324,6 @@ elasticsearch_pillar() {
" lsheap: $NODE_LS_HEAP_SIZE"\
"" >> "$pillar_file"
printf '%s\n' '----' >> "$setup_log" 2>&1
cat "$pillar_file" >> "$setup_log" 2>&1
}
parse_install_username() {
@@ -1347,9 +1343,6 @@ patch_pillar() {
" splay: 300"\
"" >> "$pillar_file"
printf '%s\n' '----' >> "$setup_log" 2>&1
cat "$pillar_file" >> "$setup_log" 2>&1
}
patch_schedule_os_new() {
@@ -1372,8 +1365,6 @@ patch_schedule_os_new() {
done
done
printf '%s\n' '----' >> "$setup_log" 2>&1
cat "$OSPATCHSCHEDULE" >> "$setup_log" 2>&1
}
print_salt_state_apply() {
@@ -1746,8 +1737,6 @@ sensor_pillar() {
echo " hnsensor: $HNSENSOR" >> "$pillar_file"
fi
printf '%s\n' '----' >> "$setup_log" 2>&1
cat "$pillar_file" >> "$setup_log" 2>&1
}
set_default_log_size() {
@@ -2031,7 +2020,7 @@ es_heapsize() {
zeek_logs_enabled() {
echo "Enabling Zeek Logs" >> "$setup_log" 2>&1
local zeeklogs_pillar=./pillar/zeeklogs.sls
local zeeklogs_pillar=$local_salt_dir/pillar/zeeklogs.sls
printf '%s\n'\
"zeeklogs:"\
@@ -2043,44 +2032,44 @@ zeek_logs_enabled() {
done
elif [ "$install_type" == "EVAL" ] || [ "$install_type" == "IMPORT" ]; then
printf '%s\n'\
" - conn"\
" - dce_rpc"\
" - dhcp"\
" - dhcpv6"\
" - dnp3"\
" - dns"\
" - dpd"\
" - files"\
" - ftp"\
" - http"\
" - intel"\
" - irc"\
" - kerberos"\
" - modbus"\
" - mqtt"\
" - notice"\
" - ntlm"\
" - openvpn"\
" - pe"\
" - radius"\
" - rfb"\
" - rdp"\
" - signatures"\
" - sip"\
" - smb_files"\
" - smb_mapping"\
" - smtp"\
" - snmp"\
" - software"\
" - ssh"\
" - ssl"\
" - syslog"\
" - telnet"\
" - tunnel"\
" - weird"\
" - mysql"\
" - socks"\
" - x509" >> "$zeeklogs_pillar"
" - conn"\
" - dce_rpc"\
" - dhcp"\
" - dhcpv6"\
" - dnp3"\
" - dns"\
" - dpd"\
" - files"\
" - ftp"\
" - http"\
" - intel"\
" - irc"\
" - kerberos"\
" - modbus"\
" - mqtt"\
" - notice"\
" - ntlm"\
" - openvpn"\
" - pe"\
" - radius"\
" - rfb"\
" - rdp"\
" - signatures"\
" - sip"\
" - smb_files"\
" - smb_mapping"\
" - smtp"\
" - snmp"\
" - software"\
" - ssh"\
" - ssl"\
" - syslog"\
" - telnet"\
" - tunnel"\
" - weird"\
" - mysql"\
" - socks"\
" - x509" >> "$zeeklogs_pillar"
# Disable syslog log by default
else
printf '%s\n'\
@@ -2122,7 +2111,4 @@ zeek_logs_enabled() {
" - socks"\
" - x509" >> "$zeeklogs_pillar"
fi
printf '%s\n' '----' >> "$setup_log" 2>&1
cat "$zeeklogs_pillar" >> "$setup_log" 2>&1
}