mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Fix sensoroni Agent
This commit is contained in:
@@ -2,14 +2,10 @@
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
{% from 'allowed_states.map.jinja' import allowed_states %}
|
||||
{% if sls in allowed_states %}
|
||||
|
||||
{% set VERSION = salt['pillar.get']('global:soversion') %}
|
||||
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
|
||||
{% set MANAGER = salt['grains.get']('master') %}
|
||||
{% set ENGINE = salt['pillar.get']('global:mdengine') %}
|
||||
{% set proxy = salt['pillar.get']('manager:proxy') %}
|
||||
|
||||
include:
|
||||
@@ -33,7 +29,7 @@ so-ruleupdatecron:
|
||||
|
||||
so-idstools:
|
||||
docker_container.running:
|
||||
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-idstools:{{ VERSION }}
|
||||
- image: {{ GLOBALS.manager }}:5000/{{ GLOBALS.image_repo }}/so-idstools:{{ GLOBALS.so_version }}
|
||||
- hostname: so-idstools
|
||||
- user: socore
|
||||
{% if proxy %}
|
||||
|
||||
@@ -1,10 +1,7 @@
|
||||
{%- set URLBASE = salt['pillar.get']('global:url_base') %}
|
||||
{%- set DESCRIPTION = salt['pillar.get']('sensoroni:node_description', '') %}
|
||||
{%- set MODEL = salt['grains.get']('sosmodel', '') %}
|
||||
{%- set ADDRESS = salt['pillar.get']('sensoroni:node_address') %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
{%- set ANALYZE_TIMEOUT_MS = salt['pillar.get']('sensoroni:analyze_timeout_ms', 900000) %}
|
||||
{%- set ANALYZE_PARALLEL_LIMIT = salt['pillar.get']('sensoroni:analyze_parallel_limit', 5) %}
|
||||
{%- set SENSORONIKEY = salt['pillar.get']('sensoroni:sensoronikey', '') %}
|
||||
{%- set CHECKININTERVALMS = salt['pillar.get']('sensoroni:node_checkin_interval_ms', 10000) %}
|
||||
{%- set ROLE = grains.id.split('_') | last %}
|
||||
{%- if ROLE in ['eval', 'standalone', 'sensor', 'heavynode'] %}
|
||||
@@ -23,13 +20,13 @@
|
||||
"logFilename": "/opt/sensoroni/logs/sensoroni.log",
|
||||
"logLevel":"info",
|
||||
"agent": {
|
||||
"nodeId": "{{ grains.host | lower }}",
|
||||
"role": "{{ grains.role }}",
|
||||
"description": {{ DESCRIPTION | tojson }},
|
||||
"address": "{{ ADDRESS }}",
|
||||
"model": "{{ MODEL }}",
|
||||
"nodeId": "{{ GLOBALS.hostname | lower }}",
|
||||
"role": "{{ GLOBALS.role }}",
|
||||
"description": {{ GLOBALS.description | tojson }},
|
||||
"address": "{{ GLOBALS.node_ip }}",
|
||||
"model": "{{ GLOBLAS.so_model }}",
|
||||
"pollIntervalMs": {{ CHECKININTERVALMS if CHECKININTERVALMS else 10000 }},
|
||||
"serverUrl": "https://{{ URLBASE }}/sensoroniagents",
|
||||
"serverUrl": "https://{{ GLOBALS.url_base }}/sensoroniagents",
|
||||
"verifyCert": false,
|
||||
"modules": {
|
||||
{%- if ANALYZEENABLED %}
|
||||
@@ -40,7 +37,7 @@
|
||||
{%- endif %}
|
||||
"importer": {},
|
||||
"statickeyauth": {
|
||||
"apiKey": "{{ SENSORONIKEY }}"
|
||||
"apiKey": "{{ GLOBALS.sensoroni_key }}"
|
||||
{%- if STENOENABLED %}
|
||||
},
|
||||
"stenoquery": {
|
||||
|
||||
@@ -1,6 +1,4 @@
|
||||
{% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
|
||||
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
|
||||
{% set MANAGER = salt['grains.get']('master') %}
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
|
||||
sensoroniconfdir:
|
||||
file.directory:
|
||||
@@ -43,7 +41,7 @@ analyzerscripts:
|
||||
|
||||
so-sensoroni:
|
||||
docker_container.running:
|
||||
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-soc:{{ VERSION }}
|
||||
- image: {{ GLOBALS.manager }}:5000/{{ GLOBALS.image_repo }}/so-soc:{{ GLOBALS.so_version }}
|
||||
- network_mode: host
|
||||
- binds:
|
||||
- /opt/so/conf/steno/certs:/etc/stenographer/certs:rw
|
||||
|
||||
@@ -20,7 +20,10 @@
|
||||
'pipeline': INIT.PILLAR.global.pipeline,
|
||||
'so_version': INIT.PILLAR.global.soversion,
|
||||
'url_base': INIT.PILLAR.global.url_base,
|
||||
'so_model': INIT.GRAINS.sosmodel,
|
||||
'description': INIT.PILLAR.sensoroni.node_desccription,
|
||||
'docker_range': INIT.PILLAR.docker.range,
|
||||
'sensoroni_key': INIT.PILLAR.sensoroni.sensoronikey,
|
||||
'application_urls': {},
|
||||
'manager_roles': [
|
||||
'so-eval',
|
||||
|
||||
Reference in New Issue
Block a user