mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-26 14:37:49 +02:00
Merge branch 'dev' into kilo
This commit is contained in:
@@ -73,7 +73,13 @@ logging.files:
|
||||
# Set to true to log messages in json format.
|
||||
#logging.json: false
|
||||
|
||||
|
||||
|
||||
#========================== Modules configuration ============================
|
||||
filebeat.config.modules:
|
||||
enabled: true
|
||||
path: ${path.config}/modules.d/*.yml
|
||||
|
||||
filebeat.modules:
|
||||
#=========================== Filebeat prospectors =============================
|
||||
|
||||
@@ -185,7 +191,6 @@ filebeat.inputs:
|
||||
fields_under_root: true
|
||||
clean_removed: false
|
||||
close_removed: false
|
||||
|
||||
{%- if STRELKAENABLED == 1 %}
|
||||
- type: log
|
||||
paths:
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
{%- if grains['role'] in ['so-managersearch', 'so-heavynode', 'so-node'] %}
|
||||
{%- set MANAGER = salt['grains.get']('host' '') %}
|
||||
{%- else %}
|
||||
{%- set MANAGER = salt['grains.get']('master') %}
|
||||
{%- endif %}
|
||||
|
||||
output.elasticsearch:
|
||||
enabled: true
|
||||
hosts: ["https://{{ MANAGER }}:9200"]
|
||||
ssl.certificate_authorities: ["/usr/share/filebeat/intraca.crt"]
|
||||
@@ -0,0 +1,18 @@
|
||||
# DO NOT EDIT THIS FILE
|
||||
{%- if MODULES.modules is iterable and MODULES.modules is not string and MODULES.modules|length > 0%}
|
||||
{%- for module in MODULES.modules.keys() %}
|
||||
- module: {{ module }}
|
||||
{%- for fileset in MODULES.modules[module] %}
|
||||
{{ fileset }}:
|
||||
enabled: {{ MODULES.modules[module][fileset].enabled|string|lower }}
|
||||
{#- only manage the settings if the fileset is enabled #}
|
||||
{%- if MODULES.modules[module][fileset].enabled %}
|
||||
{%- for var, value in MODULES.modules[module][fileset].items() %}
|
||||
{%- if var|lower != 'enabled' %}
|
||||
{{ var }}: {{ value }}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
{%- endif %}
|
||||
{%- endfor %}
|
||||
{%- endfor %}
|
||||
{% endif %}
|
||||
Reference in New Issue
Block a user