CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Logstash Module - Fix ES output logic

Browse Source
This commit is contained in:
Mike Reeves
2018-11-01 18:03:05 -04:00
parent 39677afa74
commit f2bfef58c8
18 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/logstash/files/dynamic/9000_output_bro.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -27,4 +28,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9001_output_switch.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -24,4 +25,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9002_output_import.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Updated by: Doug Burks # Updated by: Doug Burks
# Last Update: 5/16/2017 # Last Update: 5/16/2017
@@ -24,4 +25,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9004_output_flow.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -24,4 +25,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9026_output_dhcp.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -23,4 +24,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9029_output_esxi.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -22,4 +23,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9030_output_greensql.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -22,4 +23,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9031_output_iis.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -23,4 +24,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9032_output_mcafee.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -23,4 +24,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9033_output_snort.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -26,4 +27,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9034_output_syslog.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks # Updated by: Doug Burks
@@ -25,4 +26,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9200_output_firewall.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -26,4 +27,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9300_output_windows.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -24,4 +25,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9301_output_dns_windows.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -24,4 +25,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9400_output_suricata.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -24,4 +25,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9500_output_beats.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Wes Lambert # Author: Wes Lambert
# Last Update: 09/14/2018 # Last Update: 09/14/2018
filter { filter {
@@ -22,4 +23,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9600_output_ossec.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks # Updated by: Doug Burks
@@ -26,4 +27,3 @@ output {
} }
} }
} }
{%- endif %}

2
salt/logstash/files/dynamic/9998_output_test_data.conf
View File

@@ -2,6 +2,7 @@
{%- set ES = salt['pillar.get']('master:mainip', '') -%} {%- set ES = salt['pillar.get']('master:mainip', '') -%}
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -23,4 +24,3 @@ output {
} }
} }
} }
{%- endif %}