CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 02:02:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

add pcap to import node, test not starting zeek docker by default

Browse Source
This commit is contained in:
m0duspwnens
2020-08-14 13:59:23 -04:00
parent fbbec71165
commit ff84640aad
5 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/top.sls
View File

@@ -399,6 +399,7 @@ base:
- firewall - firewall
- idstools - idstools
- suricata.manager - suricata.manager
- pcap
- elasticsearch - elasticsearch
- kibana - kibana
- filebeat - filebeat

3
salt/zeek/init.sls
View File

@@ -1,3 +1,5 @@
{% from "zeek/map.jinja" import START with context %}
{% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %} {% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %} {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
{% set MANAGER = salt['grains.get']('master') %} {% set MANAGER = salt['grains.get']('master') %}
@@ -167,6 +169,7 @@ localzeeksync:
so-zeek: so-zeek:
docker_container.running: docker_container.running:
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-zeek:{{ VERSION }} - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-zeek:{{ VERSION }}
- start: {{ START }}
- privileged: True - privileged: True
- binds: - binds:
- /nsm/zeek/logs:/nsm/zeek/logs:rw - /nsm/zeek/logs:/nsm/zeek/logs:rw

6
salt/zeek/map.jinja Normal file
View File

@@ -0,0 +1,6 @@
# don't start the docker container if it is an import node
{% if grains.id.split('_')|last == 'import' %}
{% set START = False %}
{% else %}
{% set START = True %}
{% endif %}

1
setup/so-functions
View File

@@ -804,6 +804,7 @@ docker_seed_registry() {
"so-filebeat:$VERSION" \ "so-filebeat:$VERSION" \
"so-suricata:$VERSION" \ "so-suricata:$VERSION" \
"so-soc:$VERSION" \ "so-soc:$VERSION" \
"so-steno:$VERSION" \
"so-elasticsearch:$VERSION" \ "so-elasticsearch:$VERSION" \
"so-kibana:$VERSION" \ "so-kibana:$VERSION" \
"so-kratos:$VERSION" \ "so-kratos:$VERSION" \

2
setup/so-setup
View File

@@ -577,7 +577,7 @@ fi
salt-call state.apply -l info elasticsearch >> $setup_log 2>&1 salt-call state.apply -l info elasticsearch >> $setup_log 2>&1
fi fi
if [[ $is_sensor ]]; then if [[ $is_sensor || $is_import ]]; then
set_progress_str 65 "$(print_salt_state_apply 'pcap')" set_progress_str 65 "$(print_salt_state_apply 'pcap')"
salt-call state.apply -l info pcap >> $setup_log 2>&1 salt-call state.apply -l info pcap >> $setup_log 2>&1
fi fi