Merge pull request #16058 from Security-Onion-Solutions/jertel/wip

toggle pg metrics

salt/soc/defaults.map.jinja

@@ -8,6 +8,7 @@
 {% from 'docker/docker.map.jinja' import DOCKERMERGED -%}
 {% set INFLUXDB_TOKEN = salt['pillar.get']('influxdb:token') %}
 {% import_text 'influxdb/metrics_link.txt' as METRICS_LINK %}
+{% from 'telegraf/map.jinja' import TELEGRAFMERGED %}
 
 {% for module, application_url in GLOBALS.application_urls.items() %}
 {%   do SOCDEFAULTS.soc.config.server.modules[module].update({'hostUrl': application_url}) %}
@@ -24,13 +25,22 @@
 
 {% do SOCDEFAULTS.soc.config.server.modules.elastic.update({'username': GLOBALS.elasticsearch.auth.users.so_elastic_user.user, 'password': GLOBALS.elasticsearch.auth.users.so_elastic_user.pass}) %}
 
-{% do SOCDEFAULTS.soc.config.server.modules.influxdb.update({'hostUrl': 'https://' ~ GLOBALS.influxdb_host ~ ':8086'}) %}
-{% do SOCDEFAULTS.soc.config.server.modules.influxdb.update({'token': INFLUXDB_TOKEN}) %}
-{% for tool in SOCDEFAULTS.soc.config.server.client.tools %}
-{%   if tool.name == "toolInfluxDb" and METRICS_LINK | length > 0 %}
-{%     do tool.update({'link': METRICS_LINK}) %}
-{%   endif %}
-{% endfor %}
+{% if TELEGRAFMERGED.output == 'POSTGRES' %}
+{%   for tool in SOCDEFAULTS.soc.config.server.client.tools %}
+{%     if tool.name == "toolInfluxDb" %}
+{%       do SOCDEFAULTS.soc.config.server.client.tools.remove(tool) %}
+{%     endif %}
+{%   endfor %}
+
+{% else %}
+{%   do SOCDEFAULTS.soc.config.server.modules.influxdb.update({'hostUrl': 'https://' ~ GLOBALS.influxdb_host ~ ':8086'}) %}
+{%   do SOCDEFAULTS.soc.config.server.modules.influxdb.update({'token': INFLUXDB_TOKEN}) %}
+{%   for tool in SOCDEFAULTS.soc.config.server.client.tools %}
+{%     if tool.name == "toolInfluxDb" and METRICS_LINK | length > 0 %}
+{%       do tool.update({'link': METRICS_LINK}) %}
+{%     endif %}
+{%   endfor %}
+{% endif %}
 
 {% do SOCDEFAULTS.soc.config.server.modules.statickeyauth.update({'anonymousCidr': DOCKERMERGED.range, 'apiKey': pillar.sensoroni.config.sensoronikey}) %}
 

salt/soc/merged.map.jinja

@@ -7,6 +7,11 @@
 {% from 'soc/defaults.map.jinja' import SOCDEFAULTS with context %}
 {% from 'elasticsearch/config.map.jinja' import ELASTICSEARCH_NODES %}
 {% from 'manager/map.jinja' import MANAGERMERGED %}
+{% from 'telegraf/map.jinja' import TELEGRAFMERGED %}
+{%- set PG_ENTRY = salt['pillar.get']('telegraf:postgres_creds:' ~ grains.id, {}) %}
+{%- set PG_USER = PG_ENTRY.get('user', '') %}
+{%- set PG_PASS = PG_ENTRY.get('pass', '') %}
+
 {% set DOCKER_EXTRA_HOSTS = ELASTICSEARCH_NODES %}
 {% do DOCKER_EXTRA_HOSTS.append({GLOBALS.influxdb_host:pillar.node_data[GLOBALS.influxdb_host].ip}) %}
 
@@ -75,6 +80,20 @@
 {%   do SOCMERGED.config.server.update({'airgapEnabled': false}) %}
 {% endif %}
 
+{# Define the postgresmetrics module if telegraf is setup to only use Postgres #}
+{% if TELEGRAFMERGED.output != 'INFLUXDB' and PG_USER and PG_PASS %}
+{%   do SOCMERGED.config.server.modules.update({
+        'postgresmetrics': {
+          'database': 'so_telegraf',
+          'host': GLOBALS.manager_ip,
+          'password': PG_PASS,
+          'port': 5432,
+          'sslMode': 'allow',
+          'user': PG_USER,
+        }
+      }) %}
+{%   do SOCMERGED.config.server.modules.pop('influxdb') %}
+{% endif %}
 
 {# Define the Detections custom ruleset that should always be present #}
 {% set CUSTOM_RULESET = {

salt/telegraf/soc_telegraf.yaml

@@ -5,7 +5,7 @@ telegraf:
     advanced: True
     helpLink: influxdb
   output:
-    description: Selects the backend(s) Telegraf writes metrics to. INFLUXDB keeps the current behavior; POSTGRES writes to the grid's Postgres instance; BOTH dual-writes for migration validation.
+    description: Selects the backend(s) Telegraf writes metrics to. INFLUXDB keeps the current behavior; POSTGRES writes to the grid's Postgres instance; BOTH dual-writes for migration validation. When set to BOTH, the grid screen's metrics are pulled from Postgres, and the InfluxDB tool link remains visible. When set to POSTGRES, the InfluxDB tool link is removed.
     options:
       - INFLUXDB
       - POSTGRES