mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-08 22:01:50 +02:00
c6c538363d
Adds sensoroni agent configuration for the new fileanalyze module that replaces the Strelka file analysis containers: - defaults.yaml: default config values (watchDirs, concurrency, dedup, etc.) - sensoroni.json: Jinja2 template to render module config when enabled - soc_sensoroni.yaml: SOC config schema with descriptions for all settings
60 lines
2.7 KiB
JSON
60 lines
2.7 KiB
JSON
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
|
{%- from 'sensoroni/map.jinja' import SENSORONIMERGED -%}
|
|
{
|
|
"logFilename": "/opt/sensoroni/logs/sensoroni.log",
|
|
"logLevel":"info",
|
|
"agent": {
|
|
"nodeId": "{{ GLOBALS.hostname | lower }}",
|
|
"role": "{{ GLOBALS.role }}",
|
|
"description": {{ SENSORONIMERGED.config.node_description | tojson }},
|
|
"address": "{{ GLOBALS.node_ip }}",
|
|
"mgmtNic": "{{ GLOBALS.main_interface }}",
|
|
"model": "{{ GLOBALS.so_model }}",
|
|
"pollIntervalMs": {{ SENSORONIMERGED.config.node_checkin_interval_ms }},
|
|
"serverUrl": "https://{{ GLOBALS.url_base }}/sensoroniagents",
|
|
"verifyCert": false,
|
|
"modules": {
|
|
{%- if SENSORONIMERGED.config.analyze.enabled %}
|
|
"analyze": {
|
|
"timeoutMs": {{ SENSORONIMERGED.config.analyze.timeout_ms }},
|
|
"parallelLimit": {{ SENSORONIMERGED.config.analyze.parallel_limit }}
|
|
},
|
|
{%- endif %}
|
|
"importer": {},
|
|
"export": {
|
|
"timeoutMs": {{ SENSORONIMERGED.config.export.timeout_ms }},
|
|
"cacheRefreshIntervalMs": {{ SENSORONIMERGED.config.export.cache_refresh_interval_ms }},
|
|
"exportMetricLimit": {{ SENSORONIMERGED.config.export.export_metric_limit }},
|
|
"exportEventLimit": {{ SENSORONIMERGED.config.export.export_event_limit }},
|
|
"csvSeparator": "{{ SENSORONIMERGED.config.export.csv_separator }}"
|
|
},
|
|
"statickeyauth": {
|
|
"apiKey": "{{ GLOBALS.sensoroni_key }}"
|
|
{% if GLOBALS.is_sensor %}
|
|
},
|
|
"suriquery": {
|
|
"pcapInputPath": "/nsm/suripcap",
|
|
"pcapOutputPath": "/nsm/pcapout",
|
|
"pcapMaxCount": {{ SENSORONIMERGED.config.suripcap.pcapMaxCount }}
|
|
{%- endif %}
|
|
{%- if SENSORONIMERGED.config.fileanalyze.enabled %}
|
|
},
|
|
"fileanalyze": {
|
|
"watchDirs": {{ SENSORONIMERGED.config.fileanalyze.watchDirs | tojson }},
|
|
"processedDir": "{{ SENSORONIMERGED.config.fileanalyze.processedDir }}",
|
|
"historyDir": "{{ SENSORONIMERGED.config.fileanalyze.historyDir }}",
|
|
"logFile": "{{ SENSORONIMERGED.config.fileanalyze.logFile }}",
|
|
"concurrency": {{ SENSORONIMERGED.config.fileanalyze.concurrency }},
|
|
"maxDepth": {{ SENSORONIMERGED.config.fileanalyze.maxDepth }},
|
|
"recycleSeconds": {{ SENSORONIMERGED.config.fileanalyze.recycleSeconds }},
|
|
"dedupMaxEntries": {{ SENSORONIMERGED.config.fileanalyze.dedupMaxEntries }},
|
|
"dedupTTLSeconds": {{ SENSORONIMERGED.config.fileanalyze.dedupTTLSeconds }},
|
|
"yaraRulesPath": "{{ SENSORONIMERGED.config.fileanalyze.yaraRulesPath }}",
|
|
"passwordsPath": "{{ SENSORONIMERGED.config.fileanalyze.passwordsPath }}",
|
|
"scannerTimeout": {{ SENSORONIMERGED.config.fileanalyze.scannerTimeout }}
|
|
{%- endif %}
|
|
}
|
|
}
|
|
}
|
|
}
|