mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-06-14 14:18:40 +02:00
Josh Patterson
f54939b444
The active-push feature detected pillar/settings changes via an inotify beacon on the manager watching /opt/so/saltstack/local/pillar. Replace that pillar watch with a custom salt beacon (pillar_db) that polls the SOC so_soc.audit_settings table on a monotonic id watermark, so changes made through SOC drive immediate pushes from the database instead of the files. The suricata/strelka rule inotify watches (and pyinotify) are kept unchanged, since rule-file edits are not recorded in audit_settings. - salt/_beacons/pillar_db.py: new beacon. Polls audit_settings via `docker exec so-postgres psql` (unix-socket trust auth), tracks the last processed id in /opt/so/state/pillar_db_watch.id, seeds to MAX(id) on first run (no history replay), and emits one event per new row. - salt/reactor/push_pillar.sls: consume setting_id/node_id from the beacon event instead of a file path. App = first dotted segment of setting_id, looked up in pillar_push_map.yaml. Empty node_id -> grid-wide actions as is; populated node_id -> the app's state(s) retargeted to that one node. - salt/manager/files/beacons_pushstate.conf.jinja: drop the pillar inotify block, add the pillar_db beacon (interval = push.drain_interval); keep the suricata/strelka inotify watches. - salt/salt/files/reactor_pushstate.conf: map salt/beacon/*/pillar_db/ audit_settings to push_pillar.sls; remove the pillar inotify reactor lines; keep suricata/strelka. The intent -> so-push-drainer -> orch.push_batch pipeline is unchanged. Verified end-to-end on a standalone: a grid-wide telegraf.output change re-applied telegraf fleetwide (container replaced), and a per-host ntp.config.servers change applied ntp to only that node.
42 lines
1.1 KiB
Django/Jinja
42 lines
1.1 KiB
Django/Jinja
{% from 'global/map.jinja' import GLOBALMERGED %}
|
|
beacons:
|
|
pillar_db:
|
|
- interval: {{ GLOBALMERGED.push.drain_interval }}
|
|
- disable_during_state_run: True
|
|
inotify:
|
|
- disable_during_state_run: True
|
|
- coalesce: True
|
|
- files:
|
|
/opt/so/saltstack/local/salt/suricata/rules:
|
|
mask:
|
|
- close_write
|
|
- moved_to
|
|
- delete
|
|
recurse: True
|
|
auto_add: True
|
|
exclude:
|
|
- '\.sw[a-z]$':
|
|
regex: True
|
|
- '~$':
|
|
regex: True
|
|
- '/4913$':
|
|
regex: True
|
|
- '/\.#':
|
|
regex: True
|
|
/opt/so/saltstack/local/salt/strelka/rules/compiled:
|
|
mask:
|
|
- close_write
|
|
- moved_to
|
|
- delete
|
|
recurse: True
|
|
auto_add: True
|
|
exclude:
|
|
- '\.sw[a-z]$':
|
|
regex: True
|
|
- '~$':
|
|
regex: True
|
|
- '/4913$':
|
|
regex: True
|
|
- '/\.#':
|
|
regex: True
|