mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-07 09:42:46 +01:00
100 lines
3.1 KiB
Django/Jinja
Executable File
100 lines
3.1 KiB
Django/Jinja
Executable File
#!/bin/bash
|
|
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
|
|
echo "Starting to check for yara rule updates at $(date)..."
|
|
|
|
output_dir="/opt/so/saltstack/local/salt/strelka/rules"
|
|
mkdir -p $output_dir
|
|
repos="/opt/so/conf/strelka/repos.txt"
|
|
newcounter=0
|
|
excludedcounter=0
|
|
excluded_rules=({{ EXCLUDEDRULES | join(' ') }})
|
|
|
|
|
|
{% if ISAIRGAP is sameas true %}
|
|
|
|
echo "Airgap mode enabled."
|
|
|
|
clone_dir="/nsm/repo/rules/strelka"
|
|
repo_name="signature-base"
|
|
[ -d $output_dir/$repo_name ] && rm -rf $output_dir/$repo_name
|
|
mkdir -p mkdir -p $output_dir/$repo_name
|
|
# Ensure a copy of the license is available for the rules
|
|
[ -f $clone_dir/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name
|
|
|
|
# Copy over rules
|
|
for i in $(find $clone_dir/yara -name "*.yar*"); do
|
|
rule_name=$(echo $i | awk -F '/' '{print $NF}')
|
|
if [[ ! "${excluded_rules}" =~ ${rule_name} ]]; then
|
|
echo "Adding rule: $rule_name..."
|
|
cp $i $output_dir/$repo_name
|
|
((newcounter++))
|
|
else
|
|
echo "Excluding rule: $rule_name..."
|
|
((excludedcounter++))
|
|
fi
|
|
done
|
|
|
|
echo "Done!"
|
|
|
|
if [ "$newcounter" -gt 0 ] || [ "$excludedcounter" -gt 0 ];then
|
|
echo "$newcounter rules added."
|
|
echo "$excludedcounter rule(s) excluded."
|
|
fi
|
|
|
|
{% else %}
|
|
|
|
gh_status=$(curl -s -o /dev/null -w "%{http_code}" https://github.com)
|
|
clone_dir="/tmp"
|
|
if [ "$gh_status" == "200" ] || [ "$gh_status" == "301" ]; then
|
|
|
|
while IFS= read -r repo; do
|
|
if ! $(echo "$repo" | grep -qE '^#'); then
|
|
# Remove old repo if existing bc of previous error condition or unexpected disruption
|
|
repo_name=`echo $repo | awk -F '/' '{print $NF}'`
|
|
[ -d $output_dir/$repo_name ] && rm -rf $output_dir/$repo_name
|
|
|
|
# Clone repo and make appropriate directories for rules
|
|
git clone $repo $clone_dir/$repo_name
|
|
echo "Analyzing rules from $clone_dir/$repo_name..."
|
|
mkdir -p $output_dir/$repo_name
|
|
# Ensure a copy of the license is available for the rules
|
|
[ -f $clone_dir/$repo_name/LICENSE ] && cp $clone_dir/$repo_name/LICENSE $output_dir/$repo_name
|
|
|
|
# Copy over rules
|
|
for i in $(find $clone_dir/$repo_name -name "*.yar*"); do
|
|
rule_name=$(echo $i | awk -F '/' '{print $NF}')
|
|
|
|
if [[ ! "${excluded_rules}" =~ ${rule_name} ]]; then
|
|
echo "Adding rule: $rule_name..."
|
|
cp $i $output_dir/$repo_name
|
|
((newcounter++))
|
|
else
|
|
echo "Excluding rule: $rule_name..."
|
|
((excludedcounter++))
|
|
fi
|
|
done
|
|
rm -rf $clone_dir/$repo_name
|
|
fi
|
|
done < $repos
|
|
|
|
echo "Done!"
|
|
|
|
if [ "$newcounter" -gt 0 ] || [ "$excludedcounter" -gt 0 ];then
|
|
echo "$newcounter rule(s) added."
|
|
echo "$excludedcounter rule(s) excluded."
|
|
fi
|
|
|
|
else
|
|
echo "Server returned $gh_status status code."
|
|
echo "No connectivity to Github...exiting..."
|
|
exit 1
|
|
fi
|
|
{% endif %}
|
|
|
|
echo "Finished rule updates at $(date)..."
|