securityonion/salt/soc/files/soc/soc.json

{%- set MANAGERIP = salt['pillar.get']('global:managerip', '') %}
{%- set SENSORONIKEY = salt['pillar.get']('global:sensoronikey', '') %}
{%- set THEHIVEKEY = salt['pillar.get']('global:hivekey', '') %}
{%- set PLAYBOOK = salt['pillar.get']('manager:playbook', '0') %}
{%- set THEHIVE = salt['pillar.get']('manager:thehive', '0') %}
{%- set OSQUERY = salt['pillar.get']('manager:osquery', '0') %}
{%- set GRAFANA = salt['pillar.get']('manager:grafana', '0') %}
{%- set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %}
{%- set API_TIMEOUT = salt['pillar.get']('sensoroni:api_timeout_ms', 0) %}
{%- set WEBSOCKET_TIMEOUT = salt['pillar.get']('sensoroni:websocket_timeout_ms', 0) %}
{%- set TIP_TIMEOUT = salt['pillar.get']('sensoroni:tip_timeout_ms', 0) %}
{%- set CACHE_EXPIRATION = salt['pillar.get']('sensoroni:cache_expiration_ms', 0) %}
{%- set ES_FIELDCAPS_CACHE = salt['pillar.get']('sensoroni:es_fieldcaps_cache_ms', '300000') %}
{%- import_json "soc/files/soc/alerts.queries.json" as alerts_queries %}
{%- import_json "soc/files/soc/alerts.eventfields.json" as alerts_eventfields %}
{%- import_json "soc/files/soc/hunt.queries.json" as hunt_queries %}
{%- import_json "soc/files/soc/hunt.eventfields.json" as hunt_eventfields %}
{%- import_json "soc/files/soc/menu.actions.json" as menu_actions %}
{%- import_json "soc/files/soc/tools.json" as tools %}
{%- set DNET = salt['pillar.get']('global:dockernet', '172.17.0.0') %}

{
  "logFilename": "/opt/sensoroni/logs/sensoroni-server.log",
  "server": {
    "bindAddress": "0.0.0.0:9822",
    "baseUrl": "/",
    "maxPacketCount": 5000,
    "htmlDir": "html",
    {%- if ISAIRGAP is sameas true %}
    "airgapEnabled": true,
    {%- else %}
    "airgapEnabled": false,
    {%- endif %}
    "modules": {
      "filedatastore": {
        "jobDir": "jobs"
      },
      "kratos": {
        "hostUrl": "http://{{ MANAGERIP }}:4434/"
      },
      "elastic": {
        "hostUrl": "https://{{ MANAGERIP }}:9200",
        {%- if salt['pillar.get']('nodestab', {}) %}
        "remoteHostUrls": [
        {%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
        "https://{{ SN.split('_')|first }}:9200"{{ "," if not loop.last else ""}}
        {%- endfor %}
        ],
        {%- endif %}
        "username": "",
        "password": "",
        "cacheMs": {{ ES_FIELDCAPS_CACHE }},
        "verifyCert": false,
        "timeoutMs": {{ API_TIMEOUT }}
      },
      "influxdb": {
{%- if grains['role'] in ['so-import'] or (grains['role'] == 'so-eval' and GRAFANA == 0) %}
        "hostUrl": "",
{%- else %}
        "hostUrl": "https://{{ MANAGERIP }}:8086",
{%- endif %}
        "token": "",
        "org": "",
        "bucket": "telegraf",
        "verifyCert": false
      },
      "sostatus": {
        "refreshIntervalMs": 30000,
        "offlineThresholdMs": 900000
      },
{% if THEHIVEKEY != '' %}
      "thehive": {
        "hostUrl": "http://{{ MANAGERIP }}:9000/thehive",
        "key": "{{ THEHIVEKEY }}",
        "verifyCert": false
      },
{% endif %}
      "statickeyauth": {
        "anonymousCidr": "{{ DNET }}/24",
        "apiKey": "{{ SENSORONIKEY }}"
      }
    },
    "client": {
      {%- if ISAIRGAP is sameas true %}
      "docsUrl": "/docs/",
      "cheatsheetUrl": "/docs/cheatsheet.pdf",
      {%- else %}
      "docsUrl": "https://docs.securityonion.net/en/2.3/",
      "cheatsheetUrl": "https://github.com/Security-Onion-Solutions/securityonion-docs/raw/2.3/images/cheat-sheet/Security-Onion-Cheat-Sheet.pdf",
      {%- endif %}
      "apiTimeoutMs": {{ API_TIMEOUT }},
      "webSocketTimeoutMs": {{ WEBSOCKET_TIMEOUT }},
      "tipTimeoutMs": {{ TIP_TIMEOUT }},
      "cacheExpirationMs": {{ CACHE_EXPIRATION }},
      "inactiveTools": [
        {%- if PLAYBOOK == 0 %}
          "toolPlaybook",
        {%- endif %}
        {%- if THEHIVE == 0 %}
          "toolTheHive",
        {%- endif %}
        {%- if OSQUERY == 0 %}
          "toolFleet",
        {%- endif %}
        {%- if GRAFANA == 0 %}
          "toolGrafana",
        {%- endif %}
          "toolUnused"
      ],
      "tools": {{ tools | json }},
      "hunt": {
        "advanced": true,
        "groupItemsPerPage": 10,
        "groupFetchLimit": 10,
        "eventItemsPerPage": 10,
        "eventFetchLimit": 100,
        "relativeTimeValue": 24,
        "relativeTimeUnit": 30,
        "mostRecentlyUsedLimit": 5,
        "ackEnabled": false,
        "escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }},
        "eventFields": {{ hunt_eventfields | json }},
        "queryBaseFilter": "",
        "queryToggleFilters": [],
        "queries": {{ hunt_queries | json }},
        "actions": {{ menu_actions | json }}           
      },
      "job": {
        "actions": {{ menu_actions | json }}        
      }, 
      "alerts": {
        "advanced": false,
        "groupItemsPerPage": 50,
        "groupFetchLimit": 500,
        "eventItemsPerPage": 50,
        "eventFetchLimit": 500,
        "relativeTimeValue": 24,
        "relativeTimeUnit": 30,
        "mostRecentlyUsedLimit": 5,
        "ackEnabled": true,
        "escalateEnabled": {{ 'true' if THEHIVEKEY != '' else 'false' }},
        "eventFields": {{ alerts_eventfields | json }},
        "queryBaseFilter": "event.dataset:alert",
        "queryToggleFilters": [
          { "name": "acknowledged", "filter": "event.acknowledged:true", "enabled": false, "exclusive": true },
          { "name": "escalated", "filter": "event.escalated:true", "enabled": false, "exclusive": true, "enablesToggles":["acknowledged"] }
        ],
        "queries": {{ alerts_queries | json }},
        "actions": {{ menu_actions | json }}        
      }        
    }
  }
}