mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
HH Alpha Initial Push
This commit is contained in:
@@ -92,13 +92,13 @@ eslogdir:
|
||||
|
||||
so-elasticsearchimage:
|
||||
cmd.run:
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-elasticsearch:HH1.0.6
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-elasticsearch:HH1.1.0
|
||||
|
||||
so-elasticsearch:
|
||||
docker_container.running:
|
||||
- require:
|
||||
- so-elasticsearchimage
|
||||
- image: soshybridhunter/so-elasticsearch:HH1.0.6
|
||||
- image: soshybridhunter/so-elasticsearch:HH1.1.0
|
||||
- hostname: elasticsearch
|
||||
- name: so-elasticsearch
|
||||
- user: elasticsearch
|
||||
|
||||
@@ -51,13 +51,13 @@ filebeatconfsync:
|
||||
|
||||
so-filebeatimage:
|
||||
cmd.run:
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-filebeat:HH1.0.6
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-filebeat:HH1.1.0
|
||||
|
||||
so-filebeat:
|
||||
docker_container.running:
|
||||
- require:
|
||||
- so-filebeatimage
|
||||
- image: soshybridhunter/so-filebeat:HH1.0.6
|
||||
- image: soshybridhunter/so-filebeat:HH1.1.0
|
||||
- hostname: so-filebeat
|
||||
- user: root
|
||||
- extra_hosts: {{ MASTER }}:{{ MASTERIP }}
|
||||
|
||||
@@ -56,14 +56,14 @@ synckibanacustom:
|
||||
|
||||
so-kibanaimage:
|
||||
cmd.run:
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-kibana:HH1.0.7
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-kibana:HH1.1.0
|
||||
|
||||
# Start the kibana docker
|
||||
so-kibana:
|
||||
docker_container.running:
|
||||
- require:
|
||||
- so-kibanaimage
|
||||
- image: soshybridhunter/so-kibana:HH1.0.7
|
||||
- image: soshybridhunter/so-kibana:HH1.1.0
|
||||
- hostname: kibana
|
||||
- user: kibana
|
||||
- environment:
|
||||
|
||||
@@ -148,13 +148,13 @@ lslogdir:
|
||||
# Add the container
|
||||
so-logstashimage:
|
||||
cmd.run:
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-logstash:HH1.0.6
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-logstash:HH1.1.0
|
||||
|
||||
so-logstash:
|
||||
docker_container.running:
|
||||
- require:
|
||||
- so-logstashimage
|
||||
- image: soshybridhunter/so-logstash:HH1.0.6
|
||||
- image: soshybridhunter/so-logstash:HH1.1.0
|
||||
- hostname: so-logstash
|
||||
- name: so-logstash
|
||||
- user: logstash
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%}
|
||||
{%- set SENSORONIKEY = salt['pillar.get']('static:sensoronikey', '') -%}
|
||||
{
|
||||
"logFilename": "sensoroni.log",
|
||||
"logFilename": "log/sensoroni.log",
|
||||
"agent": {
|
||||
"pollIntervalMs": 10000,
|
||||
"serverUrl": "https://{{ MASTERIP }}/sensoroniagents",
|
||||
@@ -44,6 +44,15 @@ stenoconf:
|
||||
- mode: 644
|
||||
- template: jinja
|
||||
|
||||
sensoroniagentconf:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/steno/sensoroni.json
|
||||
- source: salt://pcap/files/sensoroni.json
|
||||
- user: root
|
||||
- group: root
|
||||
- mode: 644
|
||||
- template: jinja
|
||||
|
||||
stenoca:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/steno/certs
|
||||
@@ -87,13 +96,13 @@ stenolog:
|
||||
|
||||
so-stenoimage:
|
||||
cmd.run:
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-steno:HH1.0.3
|
||||
- name: docker pull --disable-content-trust=false soshybridhunter/so-steno:HH1.1.0
|
||||
|
||||
so-steno:
|
||||
docker_container.running:
|
||||
- require:
|
||||
- so-stenoimage
|
||||
- image: soshybridhunter/so-steno:HH1.0.3
|
||||
- image: soshybridhunter/so-steno:HH1.1.0
|
||||
- network_mode: host
|
||||
- privileged: True
|
||||
- port_bindings:
|
||||
@@ -106,3 +115,4 @@ so-steno:
|
||||
- /nsm/pcaptmp:/tmp:rw
|
||||
- /nsm/pcapout:/nsm/pcapout:rw
|
||||
- /opt/so/log/stenographer:/var/log/stenographer:rw
|
||||
- /opt/so/conf/steno/sensoroni.json:/opt/sensoroni/sensoroni.json:ro
|
||||
|
||||
Reference in New Issue
Block a user