mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
126 lines
4.7 KiB
Bash
126 lines
4.7 KiB
Bash
#!/bin/bash
|
|
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
. /usr/sbin/so-elastic-fleet-common
|
|
|
|
RETURN_CODE=0
|
|
|
|
if [ ! -f /opt/so/state/eaintegrations.txt ]; then
|
|
# First, check for any package upgrades
|
|
/usr/sbin/so-elastic-fleet-package-upgrade
|
|
|
|
# Second, update Fleet Server policies
|
|
/usr/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server
|
|
|
|
# Third, configure Elastic Defend Integration seperately
|
|
/usr/sbin/so-elastic-fleet-integration-policy-elastic-defend
|
|
# Initial Endpoints
|
|
for INTEGRATION in /opt/so/conf/elastic-fleet/integrations/endpoints-initial/*.json
|
|
do
|
|
printf "\n\nInitial Endpoints Policy - Loading $INTEGRATION\n"
|
|
elastic_fleet_integration_check "endpoints-initial" "$INTEGRATION"
|
|
if [ -n "$INTEGRATION_ID" ]; then
|
|
printf "\n\nIntegration $NAME exists - Updating integration\n"
|
|
if ! elastic_fleet_integration_update "$INTEGRATION_ID" "@$INTEGRATION"; then
|
|
echo -e "\nFailed to update integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
else
|
|
printf "\n\nIntegration does not exist - Creating integration\n"
|
|
if ! elastic_fleet_integration_create "@$INTEGRATION"; then
|
|
echo -e "\nFailed to create integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
fi
|
|
done
|
|
|
|
# Grid Nodes - General
|
|
for INTEGRATION in /opt/so/conf/elastic-fleet/integrations/grid-nodes_general/*.json
|
|
do
|
|
printf "\n\nGrid Nodes Policy_General - Loading $INTEGRATION\n"
|
|
elastic_fleet_integration_check "so-grid-nodes_general" "$INTEGRATION"
|
|
if [ -n "$INTEGRATION_ID" ]; then
|
|
printf "\n\nIntegration $NAME exists - Updating integration\n"
|
|
if ! elastic_fleet_integration_update "$INTEGRATION_ID" "@$INTEGRATION"; then
|
|
echo -e "\nFailed to update integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
else
|
|
printf "\n\nIntegration does not exist - Creating integration\n"
|
|
if ! elastic_fleet_integration_create "@$INTEGRATION"; then
|
|
echo -e "\nFailed to create integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
fi
|
|
done
|
|
if [[ "$RETURN_CODE" != "1" ]]; then
|
|
touch /opt/so/state/eaintegrations.txt
|
|
fi
|
|
|
|
# Grid Nodes - Heavy
|
|
for INTEGRATION in /opt/so/conf/elastic-fleet/integrations/grid-nodes_heavy/*.json
|
|
do
|
|
printf "\n\nGrid Nodes Policy_Heavy - Loading $INTEGRATION\n"
|
|
elastic_fleet_integration_check "so-grid-nodes_heavy" "$INTEGRATION"
|
|
if [ -n "$INTEGRATION_ID" ]; then
|
|
printf "\n\nIntegration $NAME exists - Updating integration\n"
|
|
if ! elastic_fleet_integration_update "$INTEGRATION_ID" "@$INTEGRATION"; then
|
|
echo -e "\nFailed to update integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
else
|
|
printf "\n\nIntegration does not exist - Creating integration\n"
|
|
if [ "$NAME" != "elasticsearch-logs" ]; then
|
|
if ! elastic_fleet_integration_create "@$INTEGRATION"; then
|
|
echo -e "\nFailed to create integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
fi
|
|
fi
|
|
done
|
|
if [[ "$RETURN_CODE" != "1" ]]; then
|
|
touch /opt/so/state/eaintegrations.txt
|
|
fi
|
|
|
|
# Fleet Server - Optional integrations
|
|
for INTEGRATION in /opt/so/conf/elastic-fleet/integrations-optional/FleetServer*/*.json
|
|
do
|
|
if ! [ "$INTEGRATION" == "/opt/so/conf/elastic-fleet/integrations-optional/FleetServer*/*.json" ]; then
|
|
FLEET_POLICY=`echo "$INTEGRATION"| cut -d'/' -f7`
|
|
printf "\n\nFleet Server Policy - Loading $INTEGRATION\n"
|
|
elastic_fleet_integration_check "$FLEET_POLICY" "$INTEGRATION"
|
|
if [ -n "$INTEGRATION_ID" ]; then
|
|
printf "\n\nIntegration $NAME exists - Updating integration\n"
|
|
if ! elastic_fleet_integration_update "$INTEGRATION_ID" "@$INTEGRATION"; then
|
|
echo -e "\nFailed to update integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
else
|
|
printf "\n\nIntegration does not exist - Creating integration\n"
|
|
if [ "$NAME" != "elasticsearch-logs" ]; then
|
|
if ! elastic_fleet_integration_create "@$INTEGRATION"; then
|
|
echo -e "\nFailed to create integration for ${INTEGRATION##*/}"
|
|
RETURN_CODE=1
|
|
continue
|
|
fi
|
|
fi
|
|
fi
|
|
fi
|
|
done
|
|
if [[ "$RETURN_CODE" != "1" ]]; then
|
|
touch /opt/so/state/eaintegrations.txt
|
|
fi
|
|
else
|
|
exit $RETURN_CODE
|
|
fi
|