mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
88 lines
5.0 KiB
Plaintext
88 lines
5.0 KiB
Plaintext
|
|
#!/bin/bash
|
|
|
|
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use
|
|
# this file except in compliance with the Elastic License 2.0.
|
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
|
|
|
. /usr/sbin/so-common
|
|
|
|
|
|
# Create ES Token
|
|
ESTOKEN=$(curl -K /opt/so/conf/elasticsearch/curl.config -L -X POST "localhost:5601/api/fleet/service_tokens" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' | jq -r .value)
|
|
printf "ESTOKEN = $ESTOKEN \n"
|
|
|
|
# Add SO-Manager Fleet URL
|
|
## This array replaces whatever URLs are currently configured
|
|
printf "\n"
|
|
curl -K /opt/so/conf/elasticsearch/curl.config -L -X PUT "localhost:5601/api/fleet/settings" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{"fleet_server_hosts":["https://{{ GLOBALS.manager_ip }}:8220"]}'
|
|
printf "\n\n"
|
|
|
|
# Create Logstash Output payload
|
|
mkdir /opt/so/conf/elastic-fleet/certs
|
|
cp /etc/ssl/certs/intca.crt /opt/so/conf/elastic-fleet/certs
|
|
cp /etc/pki/elasticfleet* /opt/so/conf/elastic-fleet/certs
|
|
LOGSTASHCRT=$(openssl x509 -in /opt/so/conf/elastic-fleet/certs/elasticfleet.crt)
|
|
LOGSTASHKEY=$(openssl rsa -in /opt/so/conf/elastic-fleet/certs/elasticfleet.key)
|
|
LOGSTASHCA=$(openssl x509 -in /opt/so/conf/elastic-fleet/certs/intca.crt)
|
|
JSON_STRING=$( jq -n \
|
|
--arg LOGSTASHCRT "$LOGSTASHCRT" \
|
|
--arg LOGSTASHKEY "$LOGSTASHKEY" \
|
|
--arg LOGSTASHCA "$LOGSTASHCA" \
|
|
'{"name":"so-manager_logstash","id":"so-manager_logstash","type":"logstash","hosts":["{{ GLOBALS.manager_ip }}:5055"],"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl":{"certificate": $LOGSTASHCRT,"key": $LOGSTASHKEY,"certificate_authorities":[ $LOGSTASHCA ]}}'
|
|
)
|
|
|
|
# Add SO-Manager Logstash Ouput
|
|
curl -K /opt/so/conf/elasticsearch/curl.config -L -X POST "localhost:5601/api/fleet/outputs" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d "$JSON_STRING"
|
|
printf "\n\n"
|
|
|
|
# Add Elastic Fleet Integrations
|
|
|
|
# Add Elastic Fleet Server Agent Policy
|
|
#curl -vv -K /opt/so/conf/elasticsearch/curl.config -L \
|
|
#-X POST "localhost:5601/api/fleet/agent_policies" \
|
|
#-H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
|
|
#-d '{"name":"SO-Manager","id":"so-manager","description":"SO Manager Fleet Server Policy","namespace":"default","monitoring_enabled":["logs"],"has_fleet_server":true}'
|
|
|
|
# Add Agent Policy - SOS Grid Nodes
|
|
#curl -vv -K /opt/so/conf/elasticsearch/curl.config -L \
|
|
#-X POST "localhost:5601/api/fleet/agent_policies" \
|
|
#-H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
|
|
#-d '{"name":"SO-Grid","id":"so-grid","description":"SO Grid Endpoint Policy","namespace":"default","monitoring_enabled":["logs"]}'
|
|
|
|
# Add Agent Policy - Default endpoints
|
|
#curl -vv -K /opt/so/conf/elasticsearch/curl.config -L \
|
|
#-X POST "localhost:5601/api/fleet/agent_policies" \
|
|
#-H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
|
|
#-d '{"name":"Endpoints-Initalization","id":"endpoints","description":"Initial Endpoint Policy","namespace":"default","monitoring_enabled":["logs"]}'
|
|
|
|
ENDPOINTSENROLLMENTOKEN=$(curl -K /opt/so/conf/elasticsearch/curl.config -L "localhost:5601/api/fleet/enrollment_api_keys" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' | jq .list | jq -r -c '.[] | select(.policy_id | contains("endpoints-default")) | .api_key')
|
|
GRIDNODESENROLLMENTOKEN=$(curl -K /opt/so/conf/elasticsearch/curl.config -L "localhost:5601/api/fleet/enrollment_api_keys" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' | jq .list | jq -r -c '.[] | select(.policy_id | contains("so-grid-nodes")) | .api_key')
|
|
|
|
# Store needed data in minion pillar
|
|
pillar_file=/opt/so/saltstack/local/pillar/minions/{{ GLOBALS.minion_id }}.sls
|
|
printf '%s\n'\
|
|
"elasticfleet:"\
|
|
" server:"\
|
|
" es_token: '$ESTOKEN'"\
|
|
" endpoints_enrollment: '$ENDPOINTSENROLLMENTOKEN'"\
|
|
" grid_enrollment: '$GRIDNODESENROLLMENTOKEN'"\
|
|
" url: '{{ GLOBALS.manager_ip }}'"\
|
|
"" >> "$pillar_file"
|
|
|
|
|
|
# Call Elastic-Fleet Salt State
|
|
salt-call state.apply elastic-fleet
|
|
|
|
# Temp
|
|
wget -P /opt/so/saltstack/default/salt/elastic-fleet/files/elastic-agent/ https://github.com/Security-Onion-Solutions/securityonion-docker-rpm/releases/download/so_elastic-agent-8.4.1/so-elastic-agent-8.4.1-darwin-x86_64.tar.gz
|
|
wget -P /opt/so/saltstack/default/salt/elastic-fleet/files/elastic-agent/ https://github.com/Security-Onion-Solutions/securityonion-docker-rpm/releases/download/so_elastic-agent-8.4.1/so-elastic-agent-8.4.1-linux-x86_64.tar.gz
|
|
wget -P /opt/so/saltstack/default/salt/elastic-fleet/files/elastic-agent/ https://github.com/Security-Onion-Solutions/securityonion-docker-rpm/releases/download/so_elastic-agent-8.4.1/so-elastic-agent-8.4.1-windows-x86_64.tar.gz
|
|
|
|
#git clone -b 2.4-so-elastic-agent https://github.com/Security-Onion-Solutions/securityonion-image.git
|
|
#cd securityonion-image/so-elastic-agent-builder
|
|
#docker build -t so-elastic-agent-builder .
|
|
|
|
so-elastic-agent-gen-installers
|
|
salt-call state.apply elastic-fleet.install_agent_grid |