mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-07-24 09:45:40 +02:00
Josh Patterson
6bd3c414bb
Previously salt/vars/elasticsearch.map.jinja read the elasticsearch heap
size via a raw pillar access (INIT.PILLAR.elasticsearch.esheap). If the
esheap key was missing from a minion pillar, building GLOBALS raised
'dict object has no attribute esheap', cascading into every state that
imports GLOBALS (elasticsearch.enabled, logstash.config, telegraf.config,
etc.) and blocking highstate entirely.
Add an esheap default ('600m', matching the es_heapsize() floor) to
elasticsearch/defaults.yaml and fall back to it via dict .get() so a
missing pillar value degrades gracefully. The per-node pillar value still
wins when present.
4886 lines
131 KiB
YAML
4886 lines
131 KiB
YAML
elasticsearch:
|
|
enabled: false
|
|
esheap: '600m'
|
|
version: 9.3.7
|
|
index_clean: true
|
|
data_retention_method: DLM
|
|
vm:
|
|
max_map_count: 1048576
|
|
config:
|
|
action:
|
|
destructive_requires_name: true
|
|
cluster:
|
|
logsdb:
|
|
enabled: false
|
|
routing:
|
|
allocation:
|
|
disk:
|
|
threshold_enabled: true
|
|
watermark:
|
|
flood_stage: 90%
|
|
high: 85%
|
|
low: 80%
|
|
indices:
|
|
id_field_data:
|
|
enabled: false
|
|
logger:
|
|
org:
|
|
elasticsearch:
|
|
deprecation: ERROR
|
|
network:
|
|
host: 0.0.0.0
|
|
node: {}
|
|
path:
|
|
logs: /var/log/elasticsearch
|
|
script:
|
|
max_compilations_rate: 20000/1m
|
|
transport:
|
|
bind_host: 0.0.0.0
|
|
publish_port: 9300
|
|
xpack:
|
|
ml:
|
|
enabled: false
|
|
security:
|
|
authc:
|
|
anonymous:
|
|
authz_exception: true
|
|
roles: []
|
|
username: _anonymous
|
|
enabled: true
|
|
http:
|
|
ssl:
|
|
certificate: /usr/share/elasticsearch/config/elasticsearch.crt
|
|
certificate_authorities:
|
|
- /usr/share/elasticsearch/config/ca.crt
|
|
client_authentication: none
|
|
enabled: true
|
|
key: /usr/share/elasticsearch/config/elasticsearch.key
|
|
transport:
|
|
ssl:
|
|
certificate: /usr/share/elasticsearch/config/elasticsearch.crt
|
|
certificate_authorities:
|
|
- /usr/share/elasticsearch/config/ca.crt
|
|
enabled: true
|
|
key: /usr/share/elasticsearch/config/elasticsearch.key
|
|
verification_mode: none
|
|
index_settings:
|
|
global_overrides:
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: global_overrides-logs
|
|
number_of_replicas: default_placeholder
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
allocate:
|
|
number_of_replicas: ""
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
forcemerge:
|
|
max_num_segments: ""
|
|
shrink:
|
|
max_primary_shard_size: ""
|
|
method: COUNT
|
|
number_of_shards: ""
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
forcemerge:
|
|
max_num_segments: ""
|
|
shrink:
|
|
max_primary_shard_size: ""
|
|
method: COUNT
|
|
number_of_shards: ""
|
|
allocate:
|
|
number_of_replicas: ""
|
|
min_age: 30d
|
|
so-case:
|
|
index_sorting: false
|
|
index_template:
|
|
composed_of:
|
|
- case-mappings
|
|
- case-settings
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- so-case*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 1500
|
|
number_of_replicas: 0
|
|
auto_expand_replicas: 0-2
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
so-common:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- syslog-mappings
|
|
- dtc-syslog-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-*-so*
|
|
priority: 1
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-common-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-detection:
|
|
index_sorting: false
|
|
index_template:
|
|
composed_of:
|
|
- detection-mappings
|
|
- detection-settings
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- so-detection*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 1500
|
|
number_of_replicas: 0
|
|
auto_expand_replicas: 0-2
|
|
number_of_shards: 1
|
|
refresh_interval: 1s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
sos-backup:
|
|
index_sorting: false
|
|
index_template:
|
|
composed_of: []
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- sos-backup-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
so-assistant-chat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: ""
|
|
index_template:
|
|
composed_of:
|
|
- assistant-chat-mappings
|
|
- assistant-chat-settings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- so-assistant-chat*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-assistant-chat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 1500
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 1s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
hot:
|
|
actions: {}
|
|
min_age: 0ms
|
|
so-assistant-session:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: ""
|
|
index_template:
|
|
composed_of:
|
|
- assistant-session-mappings
|
|
- assistant-session-settings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- so-assistant-session*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-assistant-session-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 1500
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 1s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
hot:
|
|
actions: {}
|
|
min_age: 0ms
|
|
so-endgame:
|
|
index_sorting: false
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- endgame-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- endgame*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-endgame-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-idh:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- container-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-idh-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-idh-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-import:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- winlog-mappings
|
|
- hash-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-import-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-import-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-ip-mappings:
|
|
index_sorting: false
|
|
index_template:
|
|
composed_of:
|
|
- so-ip-mappings
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- so-ip*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
mapping:
|
|
total_fields:
|
|
limit: 1500
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
so-items:
|
|
index_sorting: false
|
|
index_template:
|
|
composed_of:
|
|
- so-items-mappings
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- .items-default-**
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-items-logs
|
|
rollover_alias: .items-default
|
|
mapping:
|
|
total_fields:
|
|
limit: 10000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
routing:
|
|
allocation:
|
|
include:
|
|
_tier_preference: data_content
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_size: 50gb
|
|
min_age: 0ms
|
|
so-kismet:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- kismet-mappings
|
|
- source-mappings
|
|
- client-mappings
|
|
- device-mappings
|
|
- network-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-kismet-so*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-kismet-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-kratos:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- event-mappings
|
|
- file-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- metadata-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-kratos-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-kratos-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-hydra:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- container-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-hydra-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-hydra-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-lists:
|
|
index_sorting: false
|
|
index_template:
|
|
composed_of:
|
|
- so-lists-mappings
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- .lists-default-**
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-lists-logs
|
|
rollover_alias: .lists-default
|
|
mapping:
|
|
total_fields:
|
|
limit: 10000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
routing:
|
|
allocation:
|
|
include:
|
|
_tier_preference: data_content
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_size: 50gb
|
|
min_age: 0ms
|
|
so-logs:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- so-data-streams-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
- so-logs-mappings
|
|
- so-logs-settings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-*-*
|
|
priority: 225
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5001
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
allocate:
|
|
number_of_replicas: ""
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
forcemerge:
|
|
max_num_segments: ""
|
|
shrink:
|
|
max_primary_shard_size: ""
|
|
method: COUNT
|
|
number_of_shards: ""
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
allocate:
|
|
number_of_replicas: ""
|
|
forcemerge:
|
|
max_num_segments: ""
|
|
shrink:
|
|
max_primary_shard_size: ""
|
|
method: COUNT
|
|
number_of_shards: ""
|
|
min_age: 30d
|
|
so-logs-detections_x_alerts:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- so-data-streams-mappings
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
- so-logs-mappings
|
|
- so-logs-settings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-detections.alerts-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-detections.alerts-so
|
|
mapping:
|
|
total_fields:
|
|
limit: 5001
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 1d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-elastic_agent@package
|
|
- logs-elastic_agent@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent@custom
|
|
index_patterns:
|
|
- logs-elastic_agent-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
codec: best_compression
|
|
lifecycle:
|
|
name: so-logs-elastic_agent-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
ignore_malformed: true
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
query:
|
|
default_field:
|
|
- cloud.account.id
|
|
- cloud.availability_zone
|
|
- cloud.instance.id
|
|
- cloud.instance.name
|
|
- cloud.machine.type
|
|
- cloud.provider
|
|
- cloud.region
|
|
- cloud.project.id
|
|
- cloud.image.id
|
|
- container.id
|
|
- container.image.name
|
|
- container.name
|
|
- host.architecture
|
|
- host.hostname
|
|
- host.id
|
|
- host.mac
|
|
- host.name
|
|
- host.os.family
|
|
- host.os.kernel
|
|
- host.os.name
|
|
- host.os.platform
|
|
- host.os.version
|
|
- host.os.build
|
|
- host.os.codename
|
|
- host.type
|
|
- ecs.version
|
|
- agent.build.original
|
|
- agent.ephemeral_id
|
|
- agent.id
|
|
- agent.name
|
|
- agent.type
|
|
- agent.version
|
|
- log.level
|
|
- message
|
|
- elastic_agent.id
|
|
- elastic_agent.process
|
|
- elastic_agent.version
|
|
- component.id
|
|
- component.type
|
|
- component.binary
|
|
- component.state
|
|
- component.old_state
|
|
- unit.id
|
|
- unit.type
|
|
- unit.state
|
|
- unit.old_state
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-elastic-agent-monitor:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- so-elastic-agent-monitor
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
index_patterns:
|
|
- logs-agentmonitor-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-elastic-agent-monitor-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_apm_server:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-elastic_agent.apm_server@package
|
|
- logs-elastic_agent.apm_server@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.apm_server@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.apm_server-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.apm_server-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_auditbeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-elastic_agent.auditbeat@package
|
|
- logs-elastic_agent.auditbeat@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.auditbeat@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.auditbeat-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.auditbeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_cloudbeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-elastic_agent.cloudbeat@package
|
|
- logs-elastic_agent.cloudbeat@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.cloudbeat@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.cloudbeat-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.cloudbeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_endpoint_security:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-elastic_agent.endpoint_security@package
|
|
- logs-elastic_agent.endpoint_security@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.endpoint_security@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.endpoint_security-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.endpoint_security-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_filebeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-elastic_agent.filebeat@package
|
|
- logs-elastic_agent.filebeat@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.filebeat@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.filebeat-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.filebeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_fleet_server:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-elastic_agent.fleet_server@package
|
|
- logs-elastic_agent.fleet_server@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.fleet_server@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.fleet_server-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.fleet_server-logs
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_heartbeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-elastic_agent.heartbeat@package
|
|
- logs-elastic_agent.heartbeat@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.heartbeat@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.heartbeat-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.heartbeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_metricbeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-elastic_agent.metricbeat@package
|
|
- logs-elastic_agent.metricbeat@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.metricbeat@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.metricbeat-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.metricbeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_osquerybeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-elastic_agent.osquerybeat@package
|
|
- logs-elastic_agent.osquerybeat@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.osquerybeat@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.osquerybeat-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.osquerybeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elastic_agent_x_packetbeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-elastic_agent.packetbeat@package
|
|
- logs-elastic_agent.packetbeat@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elastic_agent.packetbeat@custom
|
|
index_patterns:
|
|
- logs-elastic_agent.packetbeat-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elastic_agent.packetbeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-elasticsearch_x_server:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-elasticsearch.server@package
|
|
- logs-elasticsearch.server@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-elasticsearch.server@custom
|
|
index_patterns:
|
|
- logs-elasticsearch.server-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-elasticsearch.server-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_actions:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- .logs-endpoint.actions@package
|
|
- .logs-endpoint.actions@custom
|
|
- endpoint@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- .logs-endpoint.actions@custom
|
|
- endpoint@custom
|
|
index_patterns:
|
|
- .logs-endpoint.actions-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.actions-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_action_x_responses:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- .logs-endpoint.action.responses@package
|
|
- .logs-endpoint.action.responses@custom
|
|
- endpoint@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- .logs-endpoint.action.responses@custom
|
|
- endpoint@custom
|
|
index_patterns:
|
|
- .logs-endpoint.action.responses-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.action.responses-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_alerts:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.alerts@package
|
|
- logs-endpoint.alerts@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.alerts@custom
|
|
index_patterns:
|
|
- logs-endpoint.alerts-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.alerts-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_diagnostic_x_collection:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- .logs-endpoint.diagnostic.collection@package
|
|
- .logs-endpoint.diagnostic.collection@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- .logs-endpoint.diagnostic.collection@custom
|
|
index_patterns:
|
|
- .logs-endpoint.diagnostic.collection-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
codec: best_compression
|
|
lifecycle:
|
|
name: so-logs-endpoint.diagnostic.collection-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
ignore_malformed: true
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
query:
|
|
default_field:
|
|
- ecs.version
|
|
- event.action
|
|
- event.category
|
|
- event.code
|
|
- event.dataset
|
|
- event.hash
|
|
- event.id
|
|
- event.kind
|
|
- event.module
|
|
- event.outcome
|
|
- event.provider
|
|
- event.type
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_events_x_api:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.events.api@package
|
|
- logs-endpoint.events.api@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.events.api@custom
|
|
index_patterns:
|
|
- logs-endpoint.events.api-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.events.api-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_events_x_file:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.events.file@package
|
|
- logs-endpoint.events.file@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.events.file@custom
|
|
index_patterns:
|
|
- logs-endpoint.events.file-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.events.file-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_events_x_library:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.events.library@package
|
|
- logs-endpoint.events.library@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.events.library@custom
|
|
index_patterns:
|
|
- logs-endpoint.events.library-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.events.library-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_events_x_network:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.events.network@package
|
|
- logs-endpoint.events.network@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.events.network@custom
|
|
index_patterns:
|
|
- logs-endpoint.events.network-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.events.network-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_events_x_process:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.events.process@package
|
|
- logs-endpoint.events.process@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.events.process@custom
|
|
index_patterns:
|
|
- logs-endpoint.events.process-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.events.process-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_events_x_registry:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.events.registry@package
|
|
- logs-endpoint.events.registry@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.events.registry@custom
|
|
index_patterns:
|
|
- logs-endpoint.events.registry-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.events.registry-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_events_x_security:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-endpoint.events.security@package
|
|
- logs-endpoint.events.security@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-endpoint.events.security@custom
|
|
index_patterns:
|
|
- logs-endpoint.events.security-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.events.security-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-endpoint_x_heartbeat:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- .logs-endpoint.heartbeat@package
|
|
- .logs-endpoint.heartbeat@custom
|
|
- event-mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- .logs-endpoint.heartbeat@custom
|
|
index_patterns:
|
|
- .logs-endpoint.heartbeat-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-endpoint.heartbeat-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-http_endpoint_x_generic:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-http_endpoint.generic@package
|
|
- logs-http_endpoint.generic@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-http_endpoint.generic@package
|
|
- logs-http_endpoint.generic@custom
|
|
index_patterns:
|
|
- logs-http_endpoint.generic-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-http_endpoint.generic-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-httpjson_x_generic:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-httpjson.generic@package
|
|
- logs-httpjson.generic@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-httpjson.generic@custom
|
|
index_patterns:
|
|
- logs-httpjson.generic-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-httpjson.generic-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-osquery-manager-action_x_responses:
|
|
index_sorting: false
|
|
index_template:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
composed_of:
|
|
- logs-osquery_manager.action.responses
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- .logs-osquery_manager.action.responses*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
number_of_replicas: 0
|
|
so-logs-osquery-manager_x_action_x_responses:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
composed_of:
|
|
- logs-osquery_manager.action.responses@package
|
|
- logs-osquery_manager.action.responses@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
ignore_missing_component_templates:
|
|
- logs-osquery_manager.action.responses@custom
|
|
index_patterns:
|
|
- logs-osquery_manager.action.responses*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
lifecycle:
|
|
name:
|
|
so-logs-osquery-manager.action.responses-logs
|
|
index:
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-osquery-manager-actions:
|
|
index_sorting: false
|
|
index_template:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
composed_of:
|
|
- logs-osquery_manager.actions
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- .logs-osquery_manager.actions-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
number_of_replicas: 0
|
|
so-logs-osquery-manager_x_result:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
_meta:
|
|
managed: true
|
|
managed_by: security_onion
|
|
package:
|
|
name: elastic_agent
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
composed_of:
|
|
- logs-osquery_manager.result@package
|
|
- logs-osquery_manager.result@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
ignore_missing_component_templates:
|
|
- logs-osquery_manager.result@custom
|
|
index_patterns:
|
|
- logs-osquery_manager.result*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-osquery-manager.result-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-soc:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- container-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-soc-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-soc-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-system_x_application:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-system.application@package
|
|
- logs-system.application@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
- so-system-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-system.application@custom
|
|
index_patterns:
|
|
- logs-system.application*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-system.application-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-system_x_auth:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-system.auth@package
|
|
- logs-system.auth@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
- so-system-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-system.auth@custom
|
|
index_patterns:
|
|
- logs-system.auth*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-system.auth-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-system_x_security:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-system.security@package
|
|
- logs-system.security@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
- so-system-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-system.security@custom
|
|
index_patterns:
|
|
- logs-system.security*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-system.security-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-system_x_syslog:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-system.syslog@package
|
|
- logs-system.syslog@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
- so-system-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-system.syslog@custom
|
|
index_patterns:
|
|
- logs-system.syslog*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-system.syslog-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-system_x_system:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- event-mappings
|
|
- logs-system.system@package
|
|
- logs-system.system@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
- so-system-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-system.system@custom
|
|
index_patterns:
|
|
- logs-system.system*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-system.system-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-windows_x_forwarded:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-windows.forwarded@package
|
|
- logs-windows.forwarded@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-windows.forwarded@custom
|
|
index_patterns:
|
|
- logs-windows.forwarded*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-windows.forwarded-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-windows_x_powershell:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-windows.powershell@package
|
|
- logs-windows.powershell@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-windows.powershell@custom
|
|
index_patterns:
|
|
- logs-windows.powershell-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-windows.powershell-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-windows_x_powershell_operational:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-windows.powershell_operational@package
|
|
- logs-windows.powershell_operational@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-windows.powershell_operational@custom
|
|
index_patterns:
|
|
- logs-windows.powershell_operational-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-windows.powershell_operational-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-windows_x_sysmon_operational:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-windows.sysmon_operational@package
|
|
- logs-windows.sysmon_operational@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-windows.sysmon_operational@custom
|
|
index_patterns:
|
|
- logs-windows.sysmon_operational-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-windows.sysmon_operational-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logs-winlog_x_winlog:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- logs-winlog.winlog@package
|
|
- logs-winlog.winlog@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- logs-winlog.winlog@package
|
|
- logs-winlog.winlog@custom
|
|
index_patterns:
|
|
- logs-winlog.winlog-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logs-winlog.winlog-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-logstash:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- logstash-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-logstash-default*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-logstash-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-metrics-endpoint_x_metadata:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- metrics-endpoint.metadata@package
|
|
- metrics-endpoint.metadata@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- metrics-endpoint.metadata@custom
|
|
index_patterns:
|
|
- metrics-endpoint.metadata-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-metrics-endpoint.metadata-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-metrics-endpoint_x_metrics:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- metrics-endpoint.metrics@package
|
|
- metrics-endpoint.metrics@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- metrics-endpoint.metrics@custom
|
|
index_patterns:
|
|
- metrics-endpoint.metrics-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-metrics-endpoint.metrics-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-metrics-endpoint_x_policy:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- metrics-endpoint.policy@package
|
|
- metrics-endpoint.policy@custom
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- metrics-endpoint.policy@custom
|
|
index_patterns:
|
|
- metrics-endpoint.policy-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-metrics-endpoint.policy-logs
|
|
number_of_replicas: 0
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-metrics-fleet_server_x_agent_status:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- metrics@tsdb-settings
|
|
- metrics-fleet_server.agent_status@package
|
|
- metrics-fleet_server.agent_status@custom
|
|
- ecs@mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- metrics-fleet_server.agent_status@custom
|
|
index_patterns:
|
|
- metrics-fleet_server.agent_status-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
mode: time_series
|
|
number_of_replicas: 0
|
|
so-metrics-fleet_server_x_agent_versions:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- metrics@tsdb-settings
|
|
- metrics-fleet_server.agent_versions@package
|
|
- metrics-fleet_server.agent_versions@custom
|
|
- ecs@mappings
|
|
- so-fleet_integrations.ip_mappings-1
|
|
- so-fleet_globals-1
|
|
- so-fleet_agent_id_verification-1
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates:
|
|
- metrics-fleet_server.agent_versions@custom
|
|
index_patterns:
|
|
- metrics-fleet_server.agent_versions-*
|
|
priority: 501
|
|
template:
|
|
settings:
|
|
index:
|
|
mode: time_series
|
|
number_of_replicas: 0
|
|
so-redis:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- redis-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-redis.log*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-redis-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-strelka:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- so-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- so-scan-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- hash-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-strelka-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-strelka-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-suricata:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- suricata-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- hash-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-suricata-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-suricata-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-suricata_x_alerts:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- suricata-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- hash-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-suricata.alerts-*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-suricata.alerts-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 1d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-syslog:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- syslog-mappings
|
|
- dtc-syslog-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-syslog-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-syslog-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 1
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
so-zeek:
|
|
index_sorting: false
|
|
data_stream_lifecycle:
|
|
data_retention: 90d
|
|
index_template:
|
|
composed_of:
|
|
- agent-mappings
|
|
- dtc-agent-mappings
|
|
- base-mappings
|
|
- dtc-base-mappings
|
|
- client-mappings
|
|
- dtc-client-mappings
|
|
- cloud-mappings
|
|
- container-mappings
|
|
- data_stream-mappings
|
|
- destination-mappings
|
|
- dtc-destination-mappings
|
|
- pb-override-destination-mappings
|
|
- dll-mappings
|
|
- dns-mappings
|
|
- dtc-dns-mappings
|
|
- ecs-mappings
|
|
- dtc-ecs-mappings
|
|
- error-mappings
|
|
- event-mappings
|
|
- dtc-event-mappings
|
|
- file-mappings
|
|
- dtc-file-mappings
|
|
- group-mappings
|
|
- host-mappings
|
|
- dtc-host-mappings
|
|
- http-mappings
|
|
- dtc-http-mappings
|
|
- log-mappings
|
|
- metadata-mappings
|
|
- network-mappings
|
|
- dtc-network-mappings
|
|
- observer-mappings
|
|
- dtc-observer-mappings
|
|
- orchestrator-mappings
|
|
- organization-mappings
|
|
- package-mappings
|
|
- process-mappings
|
|
- dtc-process-mappings
|
|
- registry-mappings
|
|
- related-mappings
|
|
- rule-mappings
|
|
- dtc-rule-mappings
|
|
- server-mappings
|
|
- service-mappings
|
|
- dtc-service-mappings
|
|
- source-mappings
|
|
- dtc-source-mappings
|
|
- pb-override-source-mappings
|
|
- syslog-mappings
|
|
- dtc-syslog-mappings
|
|
- threat-mappings
|
|
- tls-mappings
|
|
- tracing-mappings
|
|
- url-mappings
|
|
- user_agent-mappings
|
|
- dtc-user_agent-mappings
|
|
- vulnerability-mappings
|
|
- zeek-mappings
|
|
- common-settings
|
|
- common-dynamic-mappings
|
|
- hash-mappings
|
|
data_stream:
|
|
allow_custom_routing: false
|
|
hidden: false
|
|
ignore_missing_component_templates: []
|
|
index_patterns:
|
|
- logs-zeek-so*
|
|
priority: 501
|
|
template:
|
|
mappings:
|
|
date_detection: false
|
|
dynamic_templates:
|
|
- strings_as_keyword:
|
|
mapping:
|
|
ignore_above: 1024
|
|
type: keyword
|
|
match_mapping_type: string
|
|
settings:
|
|
index:
|
|
lifecycle:
|
|
name: so-zeek-logs
|
|
mapping:
|
|
total_fields:
|
|
limit: 5000
|
|
number_of_replicas: 0
|
|
number_of_shards: 2
|
|
refresh_interval: 30s
|
|
sort:
|
|
field: '@timestamp'
|
|
order: desc
|
|
policy:
|
|
phases:
|
|
cold:
|
|
actions:
|
|
set_priority:
|
|
priority: 0
|
|
min_age: 60d
|
|
delete:
|
|
actions:
|
|
delete: {}
|
|
min_age: 365d
|
|
hot:
|
|
actions:
|
|
rollover:
|
|
max_age: 30d
|
|
max_primary_shard_size: 50gb
|
|
set_priority:
|
|
priority: 100
|
|
min_age: 0ms
|
|
warm:
|
|
actions:
|
|
set_priority:
|
|
priority: 50
|
|
min_age: 30d
|
|
pipelines:
|
|
custom001:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom001
|
|
- pipeline:
|
|
name: common
|
|
custom002:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom002
|
|
- pipeline:
|
|
name: common
|
|
custom003:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom003
|
|
- pipeline:
|
|
name: common
|
|
custom004:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom004
|
|
- pipeline:
|
|
name: common
|
|
custom005:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom005
|
|
- pipeline:
|
|
name: common
|
|
custom006:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom006
|
|
- pipeline:
|
|
name: common
|
|
custom007:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom007
|
|
- pipeline:
|
|
name: common
|
|
custom008:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom008
|
|
- pipeline:
|
|
name: common
|
|
custom009:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom009
|
|
- pipeline:
|
|
name: common
|
|
custom010:
|
|
description: Custom Pipeline
|
|
processors:
|
|
- set:
|
|
field: tags
|
|
value: custom010
|
|
- pipeline:
|
|
name: common
|
|
retention:
|
|
retention_pct: 50
|
|
so_roles:
|
|
so-eval:
|
|
config:
|
|
node:
|
|
roles:
|
|
- master
|
|
- data
|
|
- data_hot
|
|
- ingest
|
|
- transform
|
|
- remote_cluster_client
|
|
so-heavynode:
|
|
config:
|
|
node:
|
|
roles:
|
|
- master
|
|
- data
|
|
- data_hot
|
|
- remote_cluster_client
|
|
- ingest
|
|
so-import:
|
|
config:
|
|
node:
|
|
roles:
|
|
- master
|
|
- data
|
|
- data_hot
|
|
- ingest
|
|
- transform
|
|
- remote_cluster_client
|
|
so-manager:
|
|
config:
|
|
node:
|
|
roles:
|
|
- master
|
|
- data
|
|
- remote_cluster_client
|
|
- transform
|
|
so-managerhype:
|
|
config:
|
|
node:
|
|
roles:
|
|
- master
|
|
- data
|
|
- remote_cluster_client
|
|
- transform
|
|
so-managersearch:
|
|
config:
|
|
node:
|
|
roles:
|
|
- master
|
|
- data
|
|
- data_hot
|
|
- ingest
|
|
- transform
|
|
- remote_cluster_client
|
|
so-searchnode:
|
|
config:
|
|
node:
|
|
roles:
|
|
- data
|
|
- data_hot
|
|
- ingest
|
|
- transform
|
|
so-standalone:
|
|
config:
|
|
node:
|
|
roles:
|
|
- master
|
|
- data
|
|
- data_hot
|
|
- ingest
|
|
- transform
|
|
- remote_cluster_client
|