Skip to content

Commit a9f2dfc

Browse files
TOoSmOotHTOoSmOotH
authored
Merge pull request #13576 from Security-Onion-Solutions/2.4/dev
2.4.100
2 parents 945d04a + b7e047d commit a9f2dfc

File tree

68 files changed

+2487
-1179
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+2487
-1179
lines changed

‎DOWNLOAD_AND_VERIFY_ISO.md

+11-11
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
1-
### 2.4.90-20240729 ISO image released on 2024/07/29
1+
### 2.4.100-20240829 ISO image released on 2024/08/29
22

33

44
### Download and Verify
55

6-
2.4.90-20240729 ISO image:
7-
https://download.securityonion.net/file/securityonion/securityonion-2.4.90-20240729.iso
6+
2.4.100-20240829 ISO image:
7+
https://download.securityonion.net/file/securityonion/securityonion-2.4.100-20240829.iso
88

9-
MD5: 9A7714F5922EE555F08675D25E6237D5
10-
SHA1: D3B331452627DB716906BA9F3922574DFA3852DC
11-
SHA256: 5B0CE32543944DBC50C4E906857384211E1BE83EF409619778F18FC62017E0E0
9+
MD5: 377586C143FABD662DB414DEA49D46B7
10+
SHA1: 69D4B94522789AF47075A9FF1354B069679AC366
11+
SHA256: 52FBA5C8762B8DCF2945AD2837B3A19E63ADCC209AB510D7FD0F86AE713AA153
1212

1313
Signature for ISO image:
14-
https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.90-20240729.iso.sig
14+
https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.100-20240829.iso.sig
1515

1616
Signing key:
1717
https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.4/main/KEYS
@@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.
2525

2626
Download the signature file for the ISO:
2727
```
28-
wget https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.90-20240729.iso.sig
28+
wget https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.100-20240829.iso.sig
2929
```
3030

3131
Download the ISO image:
3232
```
33-
wget https://download.securityonion.net/file/securityonion/securityonion-2.4.90-20240729.iso
33+
wget https://download.securityonion.net/file/securityonion/securityonion-2.4.100-20240829.iso
3434
```
3535

3636
Verify the downloaded ISO image using the signature file:
3737
```
38-
gpg --verify securityonion-2.4.90-20240729.iso.sig securityonion-2.4.90-20240729.iso
38+
gpg --verify securityonion-2.4.100-20240829.iso.sig securityonion-2.4.100-20240829.iso
3939
```
4040

4141
The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
4242
```
43-
gpg: Signature made Thu 25 Jul 2024 06:51:11 PM EDT using RSA key ID FE507013
43+
gpg: Signature made Thu 29 Aug 2024 12:02:55 PM EDT using RSA key ID FE507013
4444
gpg: Good signature from "Security Onion Solutions, LLC <[email protected]>"
4545
gpg: WARNING: This key is not certified with a trusted signature!
4646
gpg: There is no indication that the signature belongs to the owner.

‎SECURITY.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@
55
| Version | Supported |
66
| ------- | ------------------ |
77
| 2.4.x | :white_check_mark: |
8-
| 2.3.x | :white_check_mark: |
8+
| 2.3.x | :x: |
99
| 16.04.x | :x: |
1010

11+
Security Onion 2.3 has reached End Of Life and is no longer supported.
12+
1113
Security Onion 16.04 has reached End Of Life and is no longer supported.
1214

1315
## Reporting a Vulnerability

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.4.90
1+
2.4.100

‎salt/common/init.sls

+5
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ net.core.wmem_default:
1414
sysctl.present:
1515
- value: 26214400
1616
17+
# Users are not a fan of console messages
18+
kernel.printk:
19+
sysctl.present:
20+
- value: "3 4 1 3"
21+
1722
# Remove variables.txt from /tmp - This is temp
1823
rmvariablesfile:
1924
file.absent:

‎salt/common/tools/sbin/so-common

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
# Elastic agent is not managed by salt. Because of this we must store this base information in a
99
# script that accompanies the soup system. Since so-common is one of those special soup files,
1010
# and since this same logic is required during installation, it's included in this file.
11-
ELASTIC_AGENT_TARBALL_VERSION="8.10.4"
11+
ELASTIC_AGENT_TARBALL_VERSION="8.14.3"
1212
ELASTIC_AGENT_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz"
1313
ELASTIC_AGENT_MD5_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5"
1414
ELASTIC_AGENT_FILE="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz"

‎salt/common/tools/sbin/so-log-check

+5
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@ if [[ $EXCLUDE_STARTUP_ERRORS == 'Y' ]]; then
9595
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|shutdown process" # server not yet ready (logstash waiting on elastic)
9696
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|contain valid certificates" # server not yet ready (logstash waiting on elastic)
9797
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|failedaction" # server not yet ready (logstash waiting on elastic)
98+
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|block in start_workers" # server not yet ready (logstash waiting on elastic)
99+
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|block in buffer_initialize" # server not yet ready (logstash waiting on elastic)
98100
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no route to host" # server not yet ready
99101
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|not running" # server not yet ready
100102
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|unavailable" # server not yet ready
@@ -147,6 +149,7 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
147149
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|status 200" # false positive (request successful, contained error string in content)
148150
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|app_layer.error" # false positive (suricata 7) in stats.log e.g. app_layer.error.imap.parser | Total | 0
149151
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|is not an ip string literal" # false positive (Open Canary logging out blank IP addresses)
152+
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|syncing rule" # false positive (rule sync log line includes rule name which can contain 'error')
150153
fi
151154

152155
if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
@@ -170,6 +173,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
170173
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|cannot join on an empty table" # InfluxDB flux query, import nodes
171174
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|exhausting result iterator" # InfluxDB flux query mismatched table results (temporary data issue)
172175
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|failed to finish run" # InfluxDB rare error, self-recoverable
176+
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Unable to gather disk name" # InfluxDB known error, can't read disks because the container doesn't have them mounted
173177
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|iteration"
174178
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|communication packets"
175179
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|use of closed"
@@ -205,6 +209,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
205209
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|detect-parse" # Suricata encountering a malformed rule
206210
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|integrity check failed" # Detections: Exclude false positive due to automated testing
207211
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|syncErrors" # Detections: Not an actual error
212+
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Initialized license manager" # SOC log: before fields.status was changed to fields.licenseStatus
208213
fi
209214

210215
RESULT=0

‎salt/common/tools/sbin_jinja/so-raid-status

+44-23
Original file line numberDiff line numberDiff line change
@@ -9,58 +9,80 @@
99

1010
. /usr/sbin/so-common
1111

12+
software_raid=("SOSMN" "SOSMN-DE02" "SOSSNNV" "SOSSNNV-DE02" "SOS10k-DE02" "SOS10KNV" "SOS10KNV-DE02" "SOS10KNV-DE02" "SOS2000-DE02" "SOS-GOFAST-LT-DE02" "SOS-GOFAST-MD-DE02" "SOS-GOFAST-HV-DE02")
13+
hardware_raid=("SOS1000" "SOS1000F" "SOSSN7200" "SOS5000" "SOS4000")
14+
1215
{%- if salt['grains.get']('sosmodel', '') %}
1316
{%- set model = salt['grains.get']('sosmodel') %}
1417
model={{ model }}
1518
# Don't need cloud images to use this
1619
if [[ $model =~ ^(SO2AMI01|SO2AZI01|SO2GCI01)$ ]]; then
1720
exit 0
1821
fi
22+
23+
for i in "${software_raid[@]}"; do
24+
if [[ "$model" == $i ]]; then
25+
is_softwareraid=true
26+
is_hwraid=false
27+
break
28+
fi
29+
done
30+
31+
for i in "${hardware_raid[@]}"; do
32+
if [[ "$model" == $i ]]; then
33+
is_softwareraid=false
34+
is_hwraid=true
35+
break
36+
fi
37+
done
38+
1939
{%- else %}
2040
echo "This is not an appliance"
2141
exit 0
2242
{%- endif %}
23-
if [[ $model =~ ^(SOS10K|SOS500|SOS1000|SOS1000F|SOS4000|SOSSN7200|SOSSNNV|SOSMN)$ ]]; then
24-
is_bossraid=true
25-
fi
26-
if [[ $model =~ ^(SOSSNNV|SOSMN)$ ]]; then
27-
is_swraid=true
28-
fi
29-
if [[ $model =~ ^(SOS10K|SOS500|SOS1000|SOS1000F|SOS4000|SOSSN7200)$ ]]; then
30-
is_hwraid=true
31-
fi
3243

3344
check_nsm_raid() {
3445
PERCCLI=$(/opt/raidtools/perccli/perccli64 /c0/v0 show|grep RAID|grep Optl)
3546
MEGACTL=$(/opt/raidtools/megasasctl |grep optimal)
36-
37-
if [[ $APPLIANCE == '1' ]]; then
47+
if [[ "$model" == "SOS500" || "$model" == "SOS500-DE02" ]]; then
48+
#This doesn't have raid
49+
HWRAID=0
50+
else
3851
if [[ -n $PERCCLI ]]; then
3952
HWRAID=0
4053
elif [[ -n $MEGACTL ]]; then
4154
HWRAID=0
4255
else
4356
HWRAID=1
44-
fi
45-
57+
fi
4658
fi
4759

4860
}
4961

5062
check_boss_raid() {
5163
MVCLI=$(/usr/local/bin/mvcli info -o vd |grep status |grep functional)
5264
MVTEST=$(/usr/local/bin/mvcli info -o vd | grep "No adapter")
65+
BOSSNVMECLI=$(/usr/local/bin/mnv_cli info -o vd -i 0 | grep Functional)
5366

54-
# Check to see if this is a SM based system
55-
if [[ -z $MVTEST ]]; then
56-
if [[ -n $MVCLI ]]; then
67+
# Is this NVMe Boss Raid?
68+
if [[ "$model" =~ "-DE02" ]]; then
69+
if [[ -n $BOSSNVMECLI ]]; then
5770
BOSSRAID=0
5871
else
5972
BOSSRAID=1
6073
fi
6174
else
62-
# This doesn't have boss raid so lets make it 0
63-
BOSSRAID=0
75+
# Check to see if this is a SM based system
76+
if [[ -z $MVTEST ]]; then
77+
if [[ -n $MVCLI ]]; then
78+
BOSSRAID=0
79+
else
80+
BOSSRAID=1
81+
fi
82+
else
83+
# This doesn't have boss raid so lets make it 0
84+
BOSSRAID=0
85+
fi
6486
fi
6587
}
6688

@@ -79,14 +101,13 @@ SWRAID=0
79101
BOSSRAID=0
80102
HWRAID=0
81103

82-
if [[ $is_hwraid ]]; then
104+
if [[ "$is_hwraid" == "true" ]]; then
83105
check_nsm_raid
106+
check_boss_raid
84107
fi
85-
if [[ $is_bossraid ]]; then
86-
check_boss_raid
87-
fi
88-
if [[ $is_swraid ]]; then
108+
if [[ "$is_softwareraid" == "true" ]]; then
89109
check_software_raid
110+
check_boss_raid
90111
fi
91112

92113
sum=$(($SWRAID + $BOSSRAID + $HWRAID))

‎salt/elastalert/soc_elastalert.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ elastalert:
33
description: You can enable or disable Elastalert.
44
helpLink: elastalert.html
55
alerter_parameters:
6-
title: Alerter Parameters
7-
description: Optional configuration parameters for additional alerters that can be enabled for all Sigma rules. Filter for 'Alerter' in this Configuration screen to find the setting that allows these alerters to be enabled within the SOC ElastAlert module. Use YAML format for these parameters, and reference the ElastAlert 2 documentation, located at https://elastalert2.readthedocs.io, for available alerters and their required configuration parameters. A full update of the ElastAlert rule engine, via the Detections screen, is required in order to apply these changes. Requires a valid Security Onion license key.
6+
title: Custom Configuration Parameters
7+
description: Optional configuration parameters made available as defaults for all rules and alerters. Use YAML format for these parameters, and reference the ElastAlert 2 documentation, located at https://elastalert2.readthedocs.io, for available configuration parameters. Requires a valid Security Onion license key.
88
global: True
99
multiline: True
1010
syntax: yaml

‎salt/elasticfleet/defaults.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ elasticfleet:
9797
- symantec_endpoint
9898
- system
9999
- tcp
100+
- tenable_io
100101
- tenable_sc
101102
- ti_abusech
102103
- ti_anomali

‎salt/elasticfleet/files/integrations-dynamic/fleet-server/fleet-server.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"package": {
3+
"name": "fleet_server",
4+
"version": ""
5+
},
6+
"name": "fleet_server-1",
7+
"namespace": "default",
8+
"policy_id": "FleetServer_hostname",
9+
"vars": {},
10+
"inputs": {
11+
"fleet_server-fleet-server": {
12+
"enabled": true,
13+
"vars": {
14+
"custom": "server.ssl.supported_protocols: [\"TLSv1.2\", \"TLSv1.3\"]\nserver.ssl.cipher_suites: [ \"ECDHE-RSA-AES-128-GCM-SHA256\", \"ECDHE-RSA-AES-256-GCM-SHA384\", \"ECDHE-RSA-AES-128-CBC-SHA\", \"ECDHE-RSA-AES-256-CBC-SHA\", \"RSA-AES-128-GCM-SHA256\", \"RSA-AES-256-GCM-SHA384\"]"
15+
},
16+
"streams": {}
17+
}
18+
}
19+
}

‎salt/elasticfleet/files/integrations/elastic-defend/elastic-defend-endpoints.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"package": {
66
"name": "endpoint",
77
"title": "Elastic Defend",
8-
"version": "8.10.2"
8+
"version": "8.14.0"
99
},
1010
"enabled": true,
1111
"policy_id": "endpoints-initial",

‎salt/elasticfleet/files/integrations/endpoints-initial/windows-defender.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"winlogs-winlog": {
1212
"enabled": true,
1313
"streams": {
14-
"winlog.winlog": {
14+
"winlog.winlogs": {
1515
"enabled": true,
1616
"vars": {
1717
"channel": "Microsoft-Windows-Windows Defender/Operational",

‎salt/elasticfleet/files/integrations/grid-nodes_general/import-evtx-logs.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
],
2121
"data_stream.dataset": "import",
2222
"custom": "",
23-
"processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"\n- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n- drop_fields:\n fields: [\"host\"]\n ignore_missing: true\n- add_fields:\n target: data_stream\n fields:\n type: logs\n dataset: system.security\n- add_fields:\n target: event\n fields:\n dataset: system.security\n module: system\n imported: true\n- add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.security-1.43.0\n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.sysmon_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.sysmon_operational\n module: windows\n imported: true\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-windows.sysmon_operational-1.38.0\n- if:\n equals:\n winlog.channel: 'Application'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.application\n - add_fields:\n target: event\n fields:\n dataset: system.application\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.application-1.43.0\n- if:\n equals:\n winlog.channel: 'System'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.system\n - add_fields:\n target: event\n fields:\n dataset: system.system\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.system-1.43.0\n \n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.powershell_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.powershell_operational\n module: windows\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-windows.powershell_operational-1.38.0\n- add_fields:\n target: data_stream\n fields:\n dataset: import",
23+
"processors": "- dissect:\n tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n field: \"log.file.path\"\n target_prefix: \"\"\n- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n- drop_fields:\n fields: [\"host\"]\n ignore_missing: true\n- add_fields:\n target: data_stream\n fields:\n type: logs\n dataset: system.security\n- add_fields:\n target: event\n fields:\n dataset: system.security\n module: system\n imported: true\n- add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.security-1.59.0\n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.sysmon_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.sysmon_operational\n module: windows\n imported: true\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-windows.sysmon_operational-1.45.1\n- if:\n equals:\n winlog.channel: 'Application'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.application\n - add_fields:\n target: event\n fields:\n dataset: system.application\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.application-1.59.0\n- if:\n equals:\n winlog.channel: 'System'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: system.system\n - add_fields:\n target: event\n fields:\n dataset: system.system\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-system.system-1.59.0\n \n- if:\n equals:\n winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n then: \n - add_fields:\n target: data_stream\n fields:\n dataset: windows.powershell_operational\n - add_fields:\n target: event\n fields:\n dataset: windows.powershell_operational\n module: windows\n - add_fields:\n target: \"@metadata\"\n fields:\n pipeline: logs-windows.powershell_operational-1.45.1\n- add_fields:\n target: data_stream\n fields:\n dataset: import",
2424
"tags": [
2525
"import"
2626
]

‎salt/elasticfleet/tools/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/bin/bash
2+
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
3+
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
4+
# https://securityonion.net/license; you may not use this file except in compliance with the
5+
# Elastic License 2.0.
6+
7+
. /usr/sbin/so-elastic-fleet-common
8+
9+
# Get all the fleet policies
10+
json_output=$(curl -s -K /opt/so/conf/elasticsearch/curl.config -L -X GET "localhost:5601/api/fleet/agent_policies" -H 'kbn-xsrf: true')
11+
12+
# Extract the IDs that start with "FleetServer_"
13+
POLICY=$(echo "$json_output" | jq -r '.items[] | select(.id | startswith("FleetServer_")) | .id')
14+
15+
# Iterate over each ID in the POLICY variable
16+
for POLICYNAME in $POLICY; do
17+
printf "\nUpdating Policy: $POLICYNAME\n"
18+
19+
# First get the Integration ID
20+
INTEGRATION_ID=$(/usr/sbin/so-elastic-fleet-agent-policy-view "$POLICYNAME" | jq -r '.item.package_policies[] | select(.package.name == "fleet_server") | .id')
21+
22+
# Modify the default integration policy to update the policy_id and an with the correct naming
23+
UPDATED_INTEGRATION_POLICY=$(jq --arg policy_id "$POLICYNAME" --arg name "fleet_server-$POLICYNAME" '
24+
.policy_id = $policy_id |
25+
.name = $name' /opt/so/conf/elastic-fleet/integrations/fleet-server/fleet-server.json)
26+
27+
# Now update the integration policy using the modified JSON
28+
elastic_fleet_integration_update "$INTEGRATION_ID" "$UPDATED_INTEGRATION_POLICY"
29+
done

‎salt/elasticfleet/tools/sbin/so-elastic-fleet-integration-policy-load

+4-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ if [ ! -f /opt/so/state/eaintegrations.txt ]; then
1212
# First, check for any package upgrades
1313
/usr/sbin/so-elastic-fleet-package-upgrade
1414

15-
# Second, configure Elastic Defend Integration seperately
15+
# Second, update Fleet Server policies
16+
/sbin/so-elastic-fleet-integration-policy-elastic-fleet-server
17+
18+
# Third, configure Elastic Defend Integration seperately
1619
/usr/sbin/so-elastic-fleet-integration-policy-elastic-defend
1720

1821
# Initial Endpoints

0 commit comments

Comments
 (0)