mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Fix sensoroni Agent
This commit is contained in:
@@ -2,14 +2,10 @@
|
|||||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||||
# Elastic License 2.0.
|
# Elastic License 2.0.
|
||||||
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||||
{% if sls in allowed_states %}
|
{% if sls in allowed_states %}
|
||||||
|
|
||||||
{% set VERSION = salt['pillar.get']('global:soversion') %}
|
|
||||||
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
|
|
||||||
{% set MANAGER = salt['grains.get']('master') %}
|
|
||||||
{% set ENGINE = salt['pillar.get']('global:mdengine') %}
|
|
||||||
{% set proxy = salt['pillar.get']('manager:proxy') %}
|
{% set proxy = salt['pillar.get']('manager:proxy') %}
|
||||||
|
|
||||||
include:
|
include:
|
||||||
@@ -33,7 +29,7 @@ so-ruleupdatecron:
|
|||||||
|
|
||||||
so-idstools:
|
so-idstools:
|
||||||
docker_container.running:
|
docker_container.running:
|
||||||
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-idstools:{{ VERSION }}
|
- image: {{ GLOBALS.manager }}:5000/{{ GLOBALS.image_repo }}/so-idstools:{{ GLOBALS.so_version }}
|
||||||
- hostname: so-idstools
|
- hostname: so-idstools
|
||||||
- user: socore
|
- user: socore
|
||||||
{% if proxy %}
|
{% if proxy %}
|
||||||
|
|||||||
@@ -1,10 +1,7 @@
|
|||||||
{%- set URLBASE = salt['pillar.get']('global:url_base') %}
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||||
{%- set DESCRIPTION = salt['pillar.get']('sensoroni:node_description', '') %}
|
|
||||||
{%- set MODEL = salt['grains.get']('sosmodel', '') %}
|
|
||||||
{%- set ADDRESS = salt['pillar.get']('sensoroni:node_address') %}
|
|
||||||
{%- set ANALYZE_TIMEOUT_MS = salt['pillar.get']('sensoroni:analyze_timeout_ms', 900000) %}
|
{%- set ANALYZE_TIMEOUT_MS = salt['pillar.get']('sensoroni:analyze_timeout_ms', 900000) %}
|
||||||
{%- set ANALYZE_PARALLEL_LIMIT = salt['pillar.get']('sensoroni:analyze_parallel_limit', 5) %}
|
{%- set ANALYZE_PARALLEL_LIMIT = salt['pillar.get']('sensoroni:analyze_parallel_limit', 5) %}
|
||||||
{%- set SENSORONIKEY = salt['pillar.get']('sensoroni:sensoronikey', '') %}
|
|
||||||
{%- set CHECKININTERVALMS = salt['pillar.get']('sensoroni:node_checkin_interval_ms', 10000) %}
|
{%- set CHECKININTERVALMS = salt['pillar.get']('sensoroni:node_checkin_interval_ms', 10000) %}
|
||||||
{%- set ROLE = grains.id.split('_') | last %}
|
{%- set ROLE = grains.id.split('_') | last %}
|
||||||
{%- if ROLE in ['eval', 'standalone', 'sensor', 'heavynode'] %}
|
{%- if ROLE in ['eval', 'standalone', 'sensor', 'heavynode'] %}
|
||||||
@@ -23,13 +20,13 @@
|
|||||||
"logFilename": "/opt/sensoroni/logs/sensoroni.log",
|
"logFilename": "/opt/sensoroni/logs/sensoroni.log",
|
||||||
"logLevel":"info",
|
"logLevel":"info",
|
||||||
"agent": {
|
"agent": {
|
||||||
"nodeId": "{{ grains.host | lower }}",
|
"nodeId": "{{ GLOBALS.hostname | lower }}",
|
||||||
"role": "{{ grains.role }}",
|
"role": "{{ GLOBALS.role }}",
|
||||||
"description": {{ DESCRIPTION | tojson }},
|
"description": {{ GLOBALS.description | tojson }},
|
||||||
"address": "{{ ADDRESS }}",
|
"address": "{{ GLOBALS.node_ip }}",
|
||||||
"model": "{{ MODEL }}",
|
"model": "{{ GLOBLAS.so_model }}",
|
||||||
"pollIntervalMs": {{ CHECKININTERVALMS if CHECKININTERVALMS else 10000 }},
|
"pollIntervalMs": {{ CHECKININTERVALMS if CHECKININTERVALMS else 10000 }},
|
||||||
"serverUrl": "https://{{ URLBASE }}/sensoroniagents",
|
"serverUrl": "https://{{ GLOBALS.url_base }}/sensoroniagents",
|
||||||
"verifyCert": false,
|
"verifyCert": false,
|
||||||
"modules": {
|
"modules": {
|
||||||
{%- if ANALYZEENABLED %}
|
{%- if ANALYZEENABLED %}
|
||||||
@@ -40,7 +37,7 @@
|
|||||||
{%- endif %}
|
{%- endif %}
|
||||||
"importer": {},
|
"importer": {},
|
||||||
"statickeyauth": {
|
"statickeyauth": {
|
||||||
"apiKey": "{{ SENSORONIKEY }}"
|
"apiKey": "{{ GLOBALS.sensoroni_key }}"
|
||||||
{%- if STENOENABLED %}
|
{%- if STENOENABLED %}
|
||||||
},
|
},
|
||||||
"stenoquery": {
|
"stenoquery": {
|
||||||
|
|||||||
@@ -1,6 +1,4 @@
|
|||||||
{% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||||
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
|
|
||||||
{% set MANAGER = salt['grains.get']('master') %}
|
|
||||||
|
|
||||||
sensoroniconfdir:
|
sensoroniconfdir:
|
||||||
file.directory:
|
file.directory:
|
||||||
@@ -43,7 +41,7 @@ analyzerscripts:
|
|||||||
|
|
||||||
so-sensoroni:
|
so-sensoroni:
|
||||||
docker_container.running:
|
docker_container.running:
|
||||||
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-soc:{{ VERSION }}
|
- image: {{ GLOBALS.manager }}:5000/{{ GLOBALS.image_repo }}/so-soc:{{ GLOBALS.so_version }}
|
||||||
- network_mode: host
|
- network_mode: host
|
||||||
- binds:
|
- binds:
|
||||||
- /opt/so/conf/steno/certs:/etc/stenographer/certs:rw
|
- /opt/so/conf/steno/certs:/etc/stenographer/certs:rw
|
||||||
|
|||||||
@@ -20,7 +20,10 @@
|
|||||||
'pipeline': INIT.PILLAR.global.pipeline,
|
'pipeline': INIT.PILLAR.global.pipeline,
|
||||||
'so_version': INIT.PILLAR.global.soversion,
|
'so_version': INIT.PILLAR.global.soversion,
|
||||||
'url_base': INIT.PILLAR.global.url_base,
|
'url_base': INIT.PILLAR.global.url_base,
|
||||||
|
'so_model': INIT.GRAINS.sosmodel,
|
||||||
|
'description': INIT.PILLAR.sensoroni.node_desccription,
|
||||||
'docker_range': INIT.PILLAR.docker.range,
|
'docker_range': INIT.PILLAR.docker.range,
|
||||||
|
'sensoroni_key': INIT.PILLAR.sensoroni.sensoronikey,
|
||||||
'application_urls': {},
|
'application_urls': {},
|
||||||
'manager_roles': [
|
'manager_roles': [
|
||||||
'so-eval',
|
'so-eval',
|
||||||
|
|||||||
Reference in New Issue
Block a user