mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 05:32:49 +01:00
59 lines
1.5 KiB
Bash
59 lines
1.5 KiB
Bash
#!/bin/bash
|
|
|
|
DIR=/etc/filebeat
|
|
YML=$DIR/filebeat.yml
|
|
|
|
mkdir -p $DIR
|
|
|
|
cat << EOF > $YML
|
|
filebeat.prospectors:
|
|
|
|
EOF
|
|
|
|
# For each Bro log type, watch current and import
|
|
grep "source(s_bro_" /etc/syslog-ng/syslog-ng.conf |cut -d\( -f2 | cut -d\) -f1 | sed 's|s_bro_||g' |sort -u | while read LOG; do
|
|
cat << EOF
|
|
- type: log
|
|
paths:
|
|
- /nsm/bro/logs/current/$LOG*.log
|
|
fields:
|
|
type: bro_$LOG
|
|
fields_under_root: true
|
|
tags: ["bro"]
|
|
clean_removed: false
|
|
close_removed: false
|
|
|
|
- type: log
|
|
paths:
|
|
- /nsm/import/bro/$LOG*.log
|
|
fields:
|
|
type: bro_$LOG
|
|
fields_under_root: true
|
|
tags: ["bro", "import"]
|
|
clean_removed: false
|
|
close_removed: false
|
|
|
|
EOF
|
|
done >> $YML
|
|
|
|
# Change tunnels.log to tunnel.log
|
|
sed -i 's|tunnels\*.log|tunnel*.log|g' $YML
|
|
|
|
# Output to logstash
|
|
cat << EOF >> $YML
|
|
output.logstash:
|
|
enabled: true
|
|
hosts: ["logstash:5044"]
|
|
|
|
EOF
|
|
|
|
# syslog-ng doesn't need to monitor Bro logs anymore
|
|
grep -v "source(s_bro_" /etc/syslog-ng/syslog-ng.conf > /etc/syslog-ng/syslog-ng.conf.without.bro
|
|
mv /etc/syslog-ng/syslog-ng.conf /etc/syslog-ng/syslog-ng.conf.with.bro
|
|
mv /etc/syslog-ng/syslog-ng.conf.without.bro /etc/syslog-ng/syslog-ng.conf
|
|
service syslog-ng restart
|
|
|
|
# start filebeat and allow it to connect to logstash
|
|
docker run --detach --name so-filebeat -v /etc/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro -v /nsm/bro:/nsm/bro:ro docker.elastic.co/beats/filebeat:6.2.1
|
|
docker network connect --alias filebeat so-elastic-net so-filebeat
|