mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-08-19 06:02:28 +02:00
Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 reyesj2
|
b48d1df2c7 | ||
|
reyesj2
|
c9a041ddb4 | ||
|
reyesj2
|
de3306e73c |
@@ -352,8 +352,8 @@ get_elastic_agent_vars() {
|
||||
|
||||
if [ -f "$defaultsfile" ]; then
|
||||
ELASTIC_AGENT_TARBALL_VERSION=$(egrep " +version: " $defaultsfile | awk -F: '{print $2}' | tr -d '[:space:]')
|
||||
ELASTIC_AGENT_URL="https://repo.securityonion.net/file/so-repo/prod/3/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz"
|
||||
ELASTIC_AGENT_MD5_URL="https://repo.securityonion.net/file/so-repo/prod/3/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5"
|
||||
ELASTIC_AGENT_URL="https://demo.jorgereyes.dev/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz"
|
||||
ELASTIC_AGENT_MD5_URL="https://demo.jorgereyes.dev/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5"
|
||||
ELASTIC_AGENT_FILE="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz"
|
||||
ELASTIC_AGENT_MD5="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5"
|
||||
ELASTIC_AGENT_EXPANSION_DIR=/nsm/elastic-fleet/artifacts/beats/elastic-agent
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
'awsfirehose.metrics': 'aws.cloudwatch',
|
||||
'cribl.logs': 'cribl',
|
||||
'cribl.metrics': 'cribl',
|
||||
'sentinel_one_cloud_funnel.logins': 'sentinel_one_cloud_funnel.login',
|
||||
'azure_application_insights.app_insights': 'azure.app_insights',
|
||||
'azure_application_insights.app_state': 'azure.app_state',
|
||||
'azure_billing.billing': 'azure.billing',
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
elasticsearch:
|
||||
enabled: false
|
||||
esheap: '600m'
|
||||
version: 9.3.7
|
||||
version: 9.4.5
|
||||
index_clean: true
|
||||
data_retention_method: DLM
|
||||
vm:
|
||||
|
||||
@@ -344,16 +344,6 @@ check_cluster_health() {
|
||||
|
||||
check_fleet_server() {
|
||||
echo "Checking that Elastic Fleet Server is responding."
|
||||
# Before checking fleet health, check for and fix known issue with elastic-agent container and fs.protected_symlinks
|
||||
local protected_symlinks=$(sysctl -b fs.protected_symlinks)
|
||||
if [[ "$protected_symlinks" == "1" ]]; then
|
||||
# disable fs.protected_symlinks and restart elasticfleet
|
||||
sysctl -w fs.protected_symlinks=0
|
||||
docker stop so-elastic-fleet; docker rm -f so-elastic-fleet
|
||||
printf "\nUpdated sysctl fs.protected_symlinks. Restarting fleet before running health check and continuing with soup.\n"
|
||||
salt-call state.apply elasticfleet queue=True
|
||||
fi
|
||||
|
||||
# Modeled on the wait_for_so-elastic-fleet state check in elasticfleet/enabled.sls,
|
||||
# which waits for HTTP 200 from the Fleet Server status API.
|
||||
if curl -sk --fail --retry 3 --retry-delay 10 --max-time 30 "https://localhost:8220/api/status" > /dev/null 2>&1; then
|
||||
@@ -1046,20 +1036,8 @@ post_to_3.2.0() {
|
||||
}
|
||||
### 3.2.0 End ###
|
||||
|
||||
### 3.3.0 Scripts ###
|
||||
|
||||
# Sets fs.protected_symlinks=0
|
||||
#
|
||||
# Elastic Agent docker image chowns its directory to the running UID
|
||||
# but does not chown the elastic-agent launcher symlink.
|
||||
# Preventing non-root users from following that launcher symlink.
|
||||
disable_sysctl_fs_protected_symlink() {
|
||||
salt -C 'I@stig:enabled' state.single sysctl.present name=fs.protected_symlinks value=0 config=/etc/sysctl.conf || true
|
||||
}
|
||||
|
||||
### 3.2.0 Scripts ###
|
||||
up_to_3.3.0() {
|
||||
disable_sysctl_fs_protected_symlink
|
||||
|
||||
INSTALLEDVERSION=3.3.0
|
||||
}
|
||||
|
||||
|
||||
@@ -1537,17 +1537,6 @@ soc:
|
||||
Orchestrator: sonnet@SOAI
|
||||
Investigator: gemma@SOAI
|
||||
DetectionEngineer: gemma@SOAI
|
||||
useMemory: true
|
||||
useMemoryScanner: true
|
||||
memoryProximityThreshold: 0.8
|
||||
messageProximityThreshold: 0.5
|
||||
maxUserMemoriesToInclude: 5
|
||||
maxGlobalMemoriesToInclude: 5
|
||||
maxUserMemoriesToReconcile: 20
|
||||
maxGlobalMemoriesToReconcile: 20
|
||||
memoryModel: gemma@SOAI
|
||||
embedModel: gemma@SOAI
|
||||
reconcileModel: gemma@SOAI
|
||||
onionconfig:
|
||||
saltstackDir: /opt/so/saltstack
|
||||
bypassEnabled: false
|
||||
|
||||
@@ -845,39 +845,6 @@ soc:
|
||||
DetectionEngineer:
|
||||
description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
|
||||
global: True
|
||||
useMemory:
|
||||
description: Enables the Memory system for OnionAI
|
||||
global: True
|
||||
useMemoryScanner:
|
||||
description: Enables the memory scanner for automatic memory extraction from historical sessions.
|
||||
global: True
|
||||
memoryProximityThreshold:
|
||||
description: Describes how close memories need to be on a floating point scale from 0.0 to 1.0 to be considered when reconciling new memories with old ones. This value is usually higher than messageProximityThreshold.
|
||||
global: True
|
||||
messageProximityThreshold:
|
||||
description: Describes how close a memory needs to be to a user's message on a floating point scale from 0.0 to 1.0 to be included in the context. This value is usually lower than memoryProximityThreshold.
|
||||
global: True
|
||||
maxUserMemoriesToInclude:
|
||||
description: Specify the max number of user-specific memories to include in the prompt when a user sends a message.
|
||||
global: True
|
||||
maxGlobalMemoriesToInclude:
|
||||
description: Specify the max number of global memories to include in the prompt when a user sends a message.
|
||||
global: True
|
||||
maxUserMemoriesToReconcile:
|
||||
description: When reconciling new user-specific memories with existing user-specific memories, this determines how many old memories may be considered.
|
||||
global: True
|
||||
maxGlobalMemoriesToReconcile:
|
||||
description: When reconciling new global memories with existing global memories, this determines how many old memories may be considered.
|
||||
global: True
|
||||
memoryModel:
|
||||
description: The model to use when extracting memories from sessions.
|
||||
global: True
|
||||
embedModel:
|
||||
description: The model to use when embedding a memory as a vector. Note that only memories embedded using the same model may be compared and only memories created with the model specified here will be considered when informing an agent of existing memories.
|
||||
global: True
|
||||
reconcileModel:
|
||||
description: The model to use when reconciling memories that contain nearly the same content.
|
||||
global: True
|
||||
client:
|
||||
assistant:
|
||||
enabled:
|
||||
|
||||
@@ -65,15 +65,6 @@ run_remediate:
|
||||
- success_retcodes:
|
||||
- 2
|
||||
|
||||
# Elastic Agent docker image chowns its directory to the running UID but does not
|
||||
# chown the elastic-agent launcher symlink. fs.protected_symlinks=1 then prevents
|
||||
# non-root users from following that launcher symlink.
|
||||
{# OSCAP rule id: xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks #}
|
||||
fs.protected_symlinks:
|
||||
sysctl.present:
|
||||
- value: 0
|
||||
- config: /etc/sysctl.conf
|
||||
|
||||
{# OSCAP rule id: xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction #}
|
||||
disable_ctrl_alt_del_action:
|
||||
file.replace:
|
||||
|
||||
@@ -1601,7 +1601,7 @@ DISA STIG for Oracle Linux 9 V1R3.</xccdf-1.2:description>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="false"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" selected="true"/>
|
||||
@@ -2202,7 +2202,7 @@ standard DISA STIG for Oracle Linux 9 profile.</xccdf-1.2:description>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="false"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
|
||||
<xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" selected="true"/>
|
||||
|
||||
Reference in New Issue
Block a user