CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Filebeat Module - Add Suricata Logs

Browse Source
This commit is contained in:
Mike Reeves
2018-09-26 13:56:36 -04:00
parent 51f7c3434e
commit f38c0a6b4c
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/filebeat/etc/filebeat.yml
View File

@@ -296,6 +296,7 @@ filebeat.prospectors:
# Make sure not file is defined twice as this can lead to unexpected behaviour. # Make sure not file is defined twice as this can lead to unexpected behaviour.
paths: paths:
- /nsm/bro/spool/*.log - /nsm/bro/spool/*.log
- /suricata/eve.json
#- c:\programdata\elasticsearch\logs\* #- c:\programdata\elasticsearch\logs\*
# Configure the file encoding for reading files with international characters # Configure the file encoding for reading files with international characters

1
salt/filebeat/init.sls
View File

@@ -58,6 +58,7 @@ so-filebeat:
- /opt/so/log/filebeat:/var/log/filebeat:rw - /opt/so/log/filebeat:/var/log/filebeat:rw
- /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro - /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
- /nsm/bro/spool/manager:/nsm/bro/spool:ro - /nsm/bro/spool/manager:/nsm/bro/spool:ro
- /opt/so/log/suricata:/suricata:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro - /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
- /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro - /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro
- /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro - /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro