reyesj2
4ac04a1a46
add kafkapass soc annotation
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 16:46:36 -04:00
reyesj2
746128e37b
update so-kafka-clusterid
...
This is a temporary script used to setup kafka secret and clusterid needed for kafka to start. This scripts functionality will be replaced by soup/setup scripts
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 15:13:29 -04:00
reyesj2
fe81ffaf78
Variables no longer used. Replaced by map file
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 15:11:22 -04:00
reyesj2
5cc358de4e
Update map files to handle empty kafka:nodes pillar
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 11:58:25 -04:00
reyesj2
665b7197a6
Update Kafka nodeid
...
Update so-minion to include running kafka.nodes state to ensure nodeid is generated for new brokers
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-17 17:08:41 -04:00
reyesj2
eedea2ca88
Merge remote-tracking branch 'remotes/origin/kaffytaffy' into reyesj2/kafka
2024-04-12 16:24:33 -04:00
reyesj2
de6ea29e3b
update default process.role to broker only
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 16:18:53 -04:00
m0duspwnens
bb983d4ba2
just broker as default process
2024-04-12 16:16:03 -04:00
m0duspwnens
c014508519
need /opt/so/conf/ca/cacerts on receiver for kafka to run
2024-04-12 13:50:25 -04:00
reyesj2
fcfbb1e857
Merge kaffytaffy
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 12:50:56 -04:00
reyesj2
911ee579a9
Typo
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 12:16:20 -04:00
reyesj2
a6ff92b099
Note to remove so-kafka-clusterid. Update soup and setup to generate needed kafka pillar values
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 12:11:18 -04:00
m0duspwnens
d73ba7dd3e
order kafka pillar assignment
2024-04-12 11:55:26 -04:00
m0duspwnens
04ddcd5c93
add receiver managersearch and standalone to kafka.nodes pillar
2024-04-12 11:52:57 -04:00
reyesj2
af29ae1968
Merge kaffytaffy
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 11:43:46 -04:00
reyesj2
fbd3cff90d
Make global.pipeline use GLOBALMERGED value
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 11:21:19 -04:00
m0duspwnens
0ed9894b7e
create kratos local pillar dirs during setup
2024-04-12 11:19:46 -04:00
m0duspwnens
a54a72c269
move kafka_cluster_id to kafka:cluster_id
2024-04-12 11:19:20 -04:00
m0duspwnens
f514e5e9bb
add kafka to receiver
2024-04-11 16:23:05 -04:00
reyesj2
3955587372
Use global.pipeline for redis / kafka states
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 16:20:09 -04:00
reyesj2
6b28dc72e8
Update annotation for global.pipeline
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 15:38:33 -04:00
reyesj2
ca7253a589
Run kafka-clusterid script when pillar values are missing
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 15:38:03 -04:00
reyesj2
af53dcda1b
Remove references to kafkanode
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 15:32:00 -04:00
m0duspwnens
d3bd56b131
disable logstash and redis if kafka enabled
2024-04-10 14:13:27 -04:00
m0duspwnens
e9e61ea2d8
Merge remote-tracking branch 'origin/2.4/dev' into kaffytaffy
2024-04-10 13:14:13 -04:00
m0duspwnens
86b984001d
annotations and enable/disable from ui
2024-04-10 10:39:06 -04:00
m0duspwnens
fa7f8104c8
Merge remote-tracking branch 'origin/reyesj2/kafka' into kaffytaffy
2024-04-09 11:13:02 -04:00
m0duspwnens
bd5fe43285
jinja config files
2024-04-09 11:07:53 -04:00
m0duspwnens
d38051e806
fix client and server properties formatting
2024-04-09 10:36:37 -04:00
m0duspwnens
daa5342986
items not keys in for loop
2024-04-09 10:22:05 -04:00
m0duspwnens
c48436ccbf
fix dict update
2024-04-09 10:19:17 -04:00
m0duspwnens
7aa00faa6c
fix var
2024-04-09 09:31:54 -04:00
m0duspwnens
6217a7b9a9
add defaults and jijafy kafka config
2024-04-09 09:27:21 -04:00
reyesj2
d67ebabc95
Remove logstash output to kafka pipeline. Add additional topics for searchnodes to ingest and add partition/offset info to event
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-08 16:38:03 -04:00
Josh Brower
b9474b9352
Merge pull request #12766 from Security-Onion-Solutions/2.4/sigma-pipeline
...
Ship Defender logs + more
2024-04-08 16:35:24 -04:00
DefensiveDepth
376efab40c
Ship Defender logs
2024-04-08 14:01:38 -04:00
reyesj2
65274e89d7
Add client_id to logstash pipeline. To identify which searchnode is pulling messages
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-05 15:38:00 -04:00
coreyogburn
acf29a6c9c
Merge pull request #12760 from Security-Onion-Solutions/cogburn/detection-author-remap
...
Detection Author as a Keyword instead of Text
2024-04-05 11:39:53 -06:00
reyesj2
721e04f793
initial logstash input from kafka over ssl
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-05 13:37:14 -04:00
Corey Ogburn
00cea6fb80
Detection Author as a Keyword instead of Text
...
With Quick Actions added to Detections, as many fields should be usable as possible.
2024-04-05 11:22:47 -06:00
reyesj2
433309ef1a
Generate kafka cluster id if it doesn't exist
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-05 09:35:12 -04:00
Mike Reeves
cbc95d0b30
Merge pull request #12759 from Security-Onion-Solutions/TOoSmOotH-patch-2
...
Update so-log-check
2024-04-05 08:17:50 -04:00
Mike Reeves
21f86be8ee
Update so-log-check
2024-04-05 08:03:42 -04:00
Josh Brower
8e38c3763e
Merge pull request #12756 from Security-Onion-Solutions/2.4/detections-defaults
...
Use list not string
2024-04-04 17:00:38 -04:00
DefensiveDepth
ca807bd6bd
Use list not string
2024-04-04 16:58:39 -04:00
reyesj2
735cfb4c29
Autogenerate kafka topics when a message it sent to non-existing topic
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-04 16:45:58 -04:00
reyesj2
6202090836
Merge remote-tracking branch 'origin/kaffytaffy' into reyesj2/kafka
2024-04-04 16:27:06 -04:00
reyesj2
436cbc1f06
Add kafka signing_policy for client/server auth. Add kafka-client cert on manager so manager can interact with kafka using its own cert
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-04 16:21:29 -04:00
reyesj2
40b08d737c
Generate kafka keystore on changes to kafka.key
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-04 16:16:53 -04:00
m0duspwnens
4c5b42b898
restart container on server config changes
2024-04-04 15:47:01 -04:00
