mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-12 20:22:59 +01:00
608 lines
19 KiB
YAML
608 lines
19 KiB
YAML
{% set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %}
|
|
{% import_yaml 'firewall/ports/ports.yaml' as portgroups %}
|
|
{% set portgroups = portgroups.firewall.ports %}
|
|
{% set TRUE_CLUSTER = salt['pillar.get']('elasticsearch:true_cluster', True) %}
|
|
{% from 'idh/opencanary_config.map.jinja' import IDH_PORTGROUPS %}
|
|
|
|
role:
|
|
eval:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
eval:
|
|
portgroups:
|
|
- {{ portgroups.playbook }}
|
|
- {{ portgroups.mysql }}
|
|
- {{ portgroups.kibana }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
- {{ portgroups.beats_5644 }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.syslog}}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- {{ portgroups.beats_5644 }}
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
strelka_frontend:
|
|
portgroups:
|
|
- {{ portgroups.strelka_frontend }}
|
|
syslog:
|
|
portgroups:
|
|
- {{ portgroups.syslog }}
|
|
analyst:
|
|
portgroups:
|
|
- {{ portgroups.nginx }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
fleet:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
standalone:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
manager:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- {{ portgroups.playbook }}
|
|
- {{ portgroups.mysql }}
|
|
- {{ portgroups.kibana }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
{% if ISAIRGAP is sameas true %}
|
|
- {{ portgroups.agrules }}
|
|
{% endif %}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
- {{ portgroups.beats_5644 }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.beats_5644 }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.beats_5644 }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.syslog}}
|
|
syslog:
|
|
portgroups:
|
|
- {{ portgroups.syslog }}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- {{ portgroups.beats_5644 }}
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
endgame:
|
|
portgroups:
|
|
- {{ portgroups.endgame }}
|
|
analyst:
|
|
portgroups:
|
|
- {{ portgroups.nginx }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
managersearch:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
managersearch:
|
|
portgroups:
|
|
- {{ portgroups.playbook }}
|
|
- {{ portgroups.mysql }}
|
|
- {{ portgroups.kibana }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
- {{ portgroups.beats_5644 }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.syslog}}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- {{ portgroups.beats_5644 }}
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
endgame:
|
|
portgroups:
|
|
- {{ portgroups.endgame }}
|
|
syslog:
|
|
portgroups:
|
|
- {{ portgroups.syslog }}
|
|
analyst:
|
|
portgroups:
|
|
- {{ portgroups.nginx }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
standalone:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
standalone:
|
|
portgroups:
|
|
- {{ portgroups.playbook }}
|
|
- {{ portgroups.mysql }}
|
|
- {{ portgroups.kibana }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.sensoroni }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.beats_5044 }}
|
|
- {{ portgroups.beats_5644 }}
|
|
- {{ portgroups.beats_5056 }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
- {{ portgroups.endgame }}
|
|
- {{ portgroups.strelka_frontend }}
|
|
fleet:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.sensoroni }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.beats_5044 }}
|
|
- {{ portgroups.beats_5644 }}
|
|
- {{ portgroups.beats_5056 }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.sensoroni }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.beats_5044 }}
|
|
- {{ portgroups.beats_5644 }}
|
|
- {{ portgroups.beats_5056 }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.sensoroni }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.docker_registry }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.sensoroni }}
|
|
- {{ portgroups.yum }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.syslog}}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- {{ portgroups.beats_5644 }}
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
endgame:
|
|
portgroups:
|
|
- {{ portgroups.endgame }}
|
|
strelka_frontend:
|
|
portgroups:
|
|
- {{ portgroups.strelka_frontend }}
|
|
syslog:
|
|
portgroups:
|
|
- {{ portgroups.syslog }}
|
|
analyst:
|
|
portgroups:
|
|
- {{ portgroups.nginx }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
fleet:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
standalone:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
heavynodes:
|
|
portgroups:
|
|
- {{ portgroups.salt_manager }}
|
|
searchnode:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_node }}
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.syslog}}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
sensor:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.syslog}}
|
|
strelka_frontend:
|
|
portgroups:
|
|
- {{ portgroups.strelka_frontend }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
heavynode:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.syslog}}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
strelka_frontend:
|
|
portgroups:
|
|
- {{ portgroups.strelka_frontend }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
import:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- {{ portgroups.kibana }}
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.influxdb }}
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
- {{ portgroups.elastic_agent_control }}
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
- {{ portgroups.beats_5644 }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.elasticsearch_node }}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- {{ portgroups.beats_5644 }}
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- {{ portgroups.elasticsearch_rest }}
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.elastic_agent_control }}
|
|
- {{ portgroups.elastic_agent_data }}
|
|
analyst:
|
|
portgroups:
|
|
- {{ portgroups.nginx }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
receiver:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
sensors:
|
|
portgroups:
|
|
- {{ portgroups.beats_5644 }}
|
|
searchnodes:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.beats_5644 }}
|
|
self:
|
|
portgroups:
|
|
- {{ portgroups.redis }}
|
|
- {{ portgroups.syslog}}
|
|
- {{ portgroups.beats_5644 }}
|
|
syslog:
|
|
portgroups:
|
|
- {{ portgroups.syslog }}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- {{ portgroups.beats_5044 }}
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- {{ portgroups.beats_5644 }}
|
|
endgame:
|
|
portgroups:
|
|
- {{ portgroups.endgame }}
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- {{ portgroups.ssh }}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
idh:
|
|
chain:
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
{% for service in IDH_PORTGROUPS.keys() %}
|
|
{% if service != 'openssh' %}
|
|
- {{ IDH_PORTGROUPS[service] }}
|
|
{% endif %}
|
|
{% endfor %}
|
|
dockernet:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
localhost:
|
|
portgroups:
|
|
- {{ portgroups.all }}
|
|
manager:
|
|
portgroups:
|
|
- {{ IDH_PORTGROUPS.openssh }}
|
|
standalone:
|
|
portgroups:
|
|
- {{ IDH_PORTGROUPS.openssh }}
|