CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add barracuda and imperva integrations

Browse Source
This commit is contained in:
Wes
2024-09-11 19:41:38 +00:00
parent fbf0a9652a
commit f2bb54d993
2 changed files with 94 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticfleet/defaults.yaml
View File

@@ -36,6 +36,7 @@ elasticfleet:
- aws
- azure
- barracuda
- barracuda_cloudgen_firewall
- carbonblack_edr
- cef
- checkpoint
@@ -66,6 +67,7 @@ elasticfleet:
- http_endpoint
- httpjson
- iis
- imperva_cloud_waf
- journald
- juniper
- juniper_srx

92
salt/elasticsearch/defaults.yaml
View File

@@ -2366,6 +2366,52 @@ elasticsearch:
set_priority:
priority: 50
min_age: 30d
so-logs-barracuda_cloudgen_firewall_x_log:
index_sorting: False
index_template:
ignore_missing_component_templates:
- logs-barracuda_cloudgen_firewall.log@custom
index_patterns:
- "logs-barracuda_cloudgen_firewall.log-*"
template:
settings:
index:
lifecycle:
name: so-logs-barracuda_cloudgen_firewall.log-logs
number_of_replicas: 0
composed_of:
- "logs-barracuda_cloudgen_firewall.log@package"
- "logs-barracuda_cloudgen_firewall.log@custom"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 501
data_stream:
hidden: false
allow_custom_routing: false
policy:
phases:
cold:
actions:
set_priority:
priority: 0
min_age: 30d
delete:
actions:
delete: {}
min_age: 365d
hot:
actions:
rollover:
max_age: 30d
max_primary_shard_size: 50gb
set_priority:
priority: 100
min_age: 0ms
warm:
actions:
set_priority:
priority: 50
min_age: 30d
so-logs-carbonblack_edr_x_log:
index_sorting: false
index_template:
@@ -6556,6 +6602,52 @@ elasticsearch:
set_priority:
priority: 50
min_age: 30d
so-logs-imperva_cloud_waf_x_event:
index_sorting: False
index_template:
ignore_missing_component_templates:
- logs-imperva_cloud_waf.event@custom
index_patterns:
- "logs-imperva_cloud_waf.event-*"
template:
settings:
index:
lifecycle:
name: so-logs-imperva_cloud_waf.event-logs
number_of_replicas: 0
composed_of:
- "logs-imperva_cloud_waf.event@package"
- "logs-imperva_cloud_waf.event@custom"
- "so-fleet_globals-1"
- "so-fleet_agent_id_verification-1"
priority: 501
data_stream:
hidden: false
allow_custom_routing: false
policy:
phases:
cold:
actions:
set_priority:
priority: 0
min_age: 30d
delete:
actions:
delete: {}
min_age: 365d
hot:
actions:
rollover:
max_age: 30d
max_primary_shard_size: 50gb
set_priority:
priority: 100
min_age: 0ms
warm:
actions:
set_priority:
priority: 50
min_age: 30d
so-logs-juniper_srx_x_log:
index_sorting: false
index_template: