mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 21:52:47 +01:00
552 lines
13 KiB
YAML
552 lines
13 KiB
YAML
role:
|
|
eval:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- playbook
|
|
- mysql
|
|
- kibana
|
|
- redis
|
|
- minio
|
|
- influxdb
|
|
- cortex
|
|
- elasticsearch_rest
|
|
- elasticsearch_node
|
|
- cortex_es_rest
|
|
- cortex_es_node
|
|
minion:
|
|
portgroups:
|
|
- acng
|
|
- docker_registry
|
|
- influxdb
|
|
- sensoroni
|
|
sensor:
|
|
portgroups:
|
|
- beats_5044
|
|
- beats_5644
|
|
search_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
heavy_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
self:
|
|
portgroups:
|
|
- syslog
|
|
beats_endpoint:
|
|
portgroups:
|
|
- beats_5044
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- beats_5644
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- elasticsearch_rest
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- elastic_agent_control
|
|
- elastic_agent_data
|
|
strelka_frontend:
|
|
portgroups:
|
|
- strelka_frontend
|
|
syslog:
|
|
portgroups:
|
|
- syslog
|
|
analyst:
|
|
portgroups:
|
|
- nginx
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
minion:
|
|
portgroups:
|
|
- salt_manager
|
|
manager:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- playbook
|
|
- mysql
|
|
- kibana
|
|
- redis
|
|
- minio
|
|
- influxdb
|
|
- cortex
|
|
- elasticsearch_rest
|
|
- elasticsearch_node
|
|
- cortex_es_rest
|
|
- cortex_es_node
|
|
minion:
|
|
portgroups:
|
|
- acng
|
|
- docker_registry
|
|
- influxdb
|
|
- sensoroni
|
|
- yum
|
|
sensor:
|
|
portgroups:
|
|
- beats_5044
|
|
- beats_5644
|
|
search_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
- beats_5644
|
|
heavy_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
- beats_5644
|
|
self:
|
|
portgroups:
|
|
- syslog
|
|
syslog:
|
|
portgroups:
|
|
- syslog
|
|
beats_endpoint:
|
|
portgroups:
|
|
- beats_5044
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- beats_5644
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- elasticsearch_rest
|
|
endgame:
|
|
portgroups:
|
|
- endgame
|
|
analyst:
|
|
portgroups:
|
|
- nginx
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
minion:
|
|
portgroups:
|
|
- salt_manager
|
|
managersearch:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- playbook
|
|
- mysql
|
|
- kibana
|
|
- redis
|
|
- minio
|
|
- influxdb
|
|
- cortex
|
|
- elasticsearch_rest
|
|
- elasticsearch_node
|
|
- cortex_es_rest
|
|
- cortex_es_node
|
|
minion:
|
|
portgroups:
|
|
- acng
|
|
- docker_registry
|
|
- influxdb
|
|
- sensoroni
|
|
- yum
|
|
sensor:
|
|
portgroups:
|
|
- beats_5044
|
|
- beats_5644
|
|
search_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
heavy_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
self:
|
|
portgroups:
|
|
- syslog}}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- beats_5044
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- beats_5644
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- elasticsearch_rest
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- elastic_agent_control
|
|
- elastic_agent_data
|
|
endgame:
|
|
portgroups:
|
|
- endgame
|
|
syslog:
|
|
portgroups:
|
|
- syslog
|
|
analyst:
|
|
portgroups:
|
|
- nginx
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
minion:
|
|
portgroups:
|
|
- salt_manager
|
|
standalone:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- playbook
|
|
- mysql
|
|
- kibana
|
|
- redis
|
|
- minio
|
|
- influxdb
|
|
- cortex
|
|
- elasticsearch_rest
|
|
- elasticsearch_node
|
|
- cortex_es_rest
|
|
- cortex_es_node
|
|
minion:
|
|
portgroups:
|
|
- acng
|
|
- docker_registry
|
|
- influxdb
|
|
- sensoroni
|
|
- yum
|
|
sensor:
|
|
portgroups:
|
|
- beats_5044
|
|
- beats_5644
|
|
search_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
heavy_node:
|
|
portgroups:
|
|
- redis
|
|
- minio
|
|
- elasticsearch_node
|
|
self:
|
|
portgroups:
|
|
- syslog}}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- beats_5044
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- beats_5644
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- elasticsearch_rest
|
|
elastic_agent_endpoint:
|
|
portgroups:
|
|
- elastic_agent_control
|
|
- elastic_agent_data
|
|
endgame:
|
|
portgroups:
|
|
- endgame
|
|
strelka_frontend:
|
|
portgroups:
|
|
- strelka_frontend
|
|
syslog:
|
|
portgroups:
|
|
- syslog
|
|
analyst:
|
|
portgroups:
|
|
- nginx
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
minion:
|
|
portgroups:
|
|
- salt_manager
|
|
helixsensor:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- playbook
|
|
- mysql
|
|
- kibana
|
|
- redis
|
|
- influxdb
|
|
- cortex
|
|
- elasticsearch_rest
|
|
- elasticsearch_node
|
|
- cortex_es_rest
|
|
- cortex_es_node
|
|
minion:
|
|
portgroups:
|
|
- acng
|
|
- docker_registry
|
|
- influxdb
|
|
- sensoroni
|
|
sensor:
|
|
portgroups:
|
|
- beats_5044
|
|
- beats_5644
|
|
search_node:
|
|
portgroups:
|
|
- redis
|
|
- elasticsearch_node
|
|
self:
|
|
portgroups:
|
|
- syslog}}
|
|
beats_endpoint:
|
|
portgroups:
|
|
- beats_5044
|
|
analyst:
|
|
portgroups:
|
|
- nginx
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
minion:
|
|
portgroups:
|
|
- salt_manager
|
|
searchnode:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- elasticsearch_node
|
|
- elasticsearch_rest
|
|
dockernet:
|
|
portgroups:
|
|
- elasticsearch_node
|
|
- elasticsearch_rest
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- elasticsearch_rest
|
|
search_node:
|
|
portgroups:
|
|
- elasticsearch_node
|
|
self:
|
|
portgroups:
|
|
- syslog
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
sensor:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
self:
|
|
portgroups:
|
|
- syslog
|
|
strelka_frontend:
|
|
portgroups:
|
|
- strelka_frontend
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
heavynode:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- elasticsearch_node
|
|
- elasticsearch_rest
|
|
dockernet:
|
|
portgroups:
|
|
- elasticsearch_node
|
|
- elasticsearch_rest
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- elasticsearch_rest
|
|
self:
|
|
portgroups:
|
|
- syslog
|
|
strelka_frontend:
|
|
portgroups:
|
|
- strelka_frontend
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
import:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
manager:
|
|
portgroups:
|
|
- kibana
|
|
- redis
|
|
- influxdb
|
|
- elasticsearch_rest
|
|
- elasticsearch_node
|
|
minion:
|
|
portgroups:
|
|
- docker_registry
|
|
- sensoroni
|
|
sensor:
|
|
portgroups:
|
|
- beats_5044
|
|
- beats_5644
|
|
search_node:
|
|
portgroups:
|
|
- redis
|
|
- elasticsearch_node
|
|
beats_endpoint:
|
|
portgroups:
|
|
- beats_5044
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- beats_5644
|
|
elasticsearch_rest:
|
|
portgroups:
|
|
- elasticsearch_rest
|
|
analyst:
|
|
portgroups:
|
|
- nginx
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
minion:
|
|
portgroups:
|
|
- salt_manager
|
|
|
|
receiver:
|
|
chain:
|
|
DOCKER-USER:
|
|
hostgroups:
|
|
sensor:
|
|
portgroups:
|
|
- beats_5644
|
|
search_node:
|
|
portgroups:
|
|
- redis
|
|
- beats_5644
|
|
self:
|
|
portgroups:
|
|
- redis
|
|
- syslog
|
|
- beats_5644
|
|
syslog:
|
|
portgroups:
|
|
- syslog
|
|
beats_endpoint:
|
|
portgroups:
|
|
- beats_5044
|
|
beats_endpoint_ssl:
|
|
portgroups:
|
|
- beats_5644
|
|
endgame:
|
|
portgroups:
|
|
- endgame
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
idh:
|
|
chain:
|
|
INPUT:
|
|
hostgroups:
|
|
anywhere:
|
|
portgroups:
|
|
- ssh
|
|
dockernet:
|
|
portgroups:
|
|
- all
|
|
localhost:
|
|
portgroups:
|
|
- all
|
|
manager:
|
|
portgroups:
|
|
- ssh |