Files
securityonion/salt/soc/merged.map.jinja
Jason Ertel aed41404fc Merge pull request #9852 from Security-Onion-Solutions/kilo
Remove FleetDM tool from SOC instead of deactivating it; generate SRV key during setup
2023-02-24 13:05:58 -05:00

54 lines
2.6 KiB
Django/Jinja

{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from 'soc/defaults.map.jinja' import SOCDEFAULTS with context %}
{% from 'logstash/map.jinja' import LOGSTASH_NODES %}
{% set DOCKER_EXTRA_HOSTS = LOGSTASH_NODES %}
{% do DOCKER_EXTRA_HOSTS.append({GLOBALS.influxdb_host:pillar.node_data[GLOBALS.influxdb_host].ip}) %}
{% set SOCMERGED = salt['pillar.get']('soc', SOCDEFAULTS, merge=true) %}
{# if SOCMERGED.server.modules.cases == httpcase details come from the soc pillar #}
{% if SOCMERGED.server.modules.cases != 'soc' %}
{% do SOCMERGED.server.modules.elastic.update({'casesEnabled': false}) %}
{% do SOCMERGED.server.client.update({'casesEnabled': false}) %}
{% do SOCMERGED.server.client.hunt.update({'escalateRelatedEventsEnabled': false}) %}
{% do SOCMERGED.server.client.alerts.update({'escalateRelatedEventsEnabled': false}) %}
{% if SOCMERGED.server.modules.cases == 'elasticcases' %}
{% do SOCMERGED.server.modules.update({
'elasticcases': {
'hostUrl': 'https://' ~ GLOBALS.manager_ip ~ ':5601',
'username': GLOBALS.elasticsearch.auth.users.so_elastic_user.user,
'password': GLOBALS.elasticsearch.auth.users.so_elastic_user.pass,
}
}) %}
{% endif %}
{% endif %}
{# since cases is not a valid soc config item and only used for the map files, remove it from being placed in the config #}
{% do SOCMERGED.server.modules.pop('cases') %}
{% if pillar.manager.playbook == 0 %}
{% do SOCMERGED.server.client.inactiveTools.append('toolPlaybook') %}
{% endif %}
{% set standard_actions = SOCMERGED.pop('actions') %}
{% if pillar.global.endgamehost is defined %}
{% set endgame_dict = {
"name": "Endgame",
"description": "Endgame Endpoint Investigation and Response",
"icon": "fa-external-link-alt",
"target": "_blank",
"links": ["https://" ~ pillar.global.endgamehost ~ "/endpoints/{:agent.id}"]
}
%}
{% do standard_actions.append(endgame_dict) %}
{% endif %}
{% do SOCMERGED.server.client.hunt.update({'actions': standard_actions}) %}
{% do SOCMERGED.server.client.dashboards.update({'actions': standard_actions}) %}
{% do SOCMERGED.server.client.update({'job': {'actions': standard_actions}}) %}
{% do SOCMERGED.server.client.alerts.update({'actions': standard_actions}) %}
{% do SOCMERGED.server.client.cases.update({'actions': standard_actions}) %}
{% set standard_eventFields = SOCMERGED.pop('eventFields') %}
{% do SOCMERGED.server.client.hunt.update({'eventFields': standard_eventFields}) %}
{% do SOCMERGED.server.client.dashboards.update({'eventFields': standard_eventFields}) %}