CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

handle the docker port bindings for filebeat modules

Browse Source
This commit is contained in:
m0duspwnens
2021-05-10 18:08:47 -04:00
parent 01a121e029
commit efc028d0a5
3 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/filebeat/init.sls
View File

@@ -20,6 +20,8 @@
{% set LOCALHOSTIP = salt['grains.get']('ip_interfaces').get(MAININT)[0] %}
{% set MANAGER = salt['grains.get']('master') %}
{% set MANAGERIP = salt['pillar.get']('global:managerip', '') %}
{% from 'filebeat/map.jinja' import THIRDPARTY with context %}
filebeatetcdir:
file.directory:
- name: /opt/so/conf/filebeat/etc
@@ -98,6 +100,13 @@ so-filebeat:
- 0.0.0.0:514:514/udp
- 0.0.0.0:514:514/tcp
- 0.0.0.0:5066:5066/tcp
{% for module in THIRDPARTY.modules.keys() %}
{% for submodule in THIRDPARTY.modules[module] %}
{% if THIRDPARTY.modules[module][submodule].enabled %}
- {{ THIRDPARTY.modules[module][submodule].get("var.syslog_host", "0.0.0.0") }}:{{ THIRDPARTY.modules[module][submodule]["var.syslog_port"] }}:{{ THIRDPARTY.modules[module][submodule]["var.syslog_port"] }}/{{ THIRDPARTY.modules[module][submodule]["var.input"] }}
{% endif %}
{% endfor %}
{% endfor %}
- watch:
- file: /opt/so/conf/filebeat/etc/filebeat.yml

2
salt/filebeat/map.jinja Normal file
View File

@@ -0,0 +1,2 @@
{% import_yaml 'filebeat/thirdpartydefaults.yaml' as TPDEFAULTS %}
{% set THIRDPARTY = salt['pillar.get']('filebeat:third_party_filebeat', default=TPDEFAULTS.third_party_filebeat, merge=True) %}

2
salt/filebeat/thirdpartydefaults.yml
View File

@@ -1,4 +1,4 @@
thirtd_party_filebeat:
third_party_filebeat:
modules:
fortinet:
firewall: