Skip to content

Commit cd46ccc

Browse files
TOoSmOotHTOoSmOotH
authored
Merge pull request #19 from TOoSmOotH/master
Hybrid Hunter 1.0.4
2 parents 9dd3c07 + e47352e commit cd46ccc

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+19868
-84
lines changed

‎README.md

+9-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Security Onion Hybrid Hunter Tech Preview 1.0.3
1+
# Security Onion Hybrid Hunter Tech Preview 1.0.4
22

33
### About
44
Hybrid Hunter is a brand new Security Onion platform with the following characteristics:
@@ -56,6 +56,14 @@ sudo bash so-setup-network.sh
5656
```
5757
Follow the prompts and reboot if asked to do so.
5858

59+
Want to try the bleeding edge? You can install the following:
60+
```
61+
git clone https://github.com/TOoSmOotH/securityonion-saltstack
62+
cd securityonion-saltstack
63+
sudo bash so-setup-network.sh
64+
```
65+
This is an active development repo so many things can and will be broken.
66+
5967
### Allow Access to Kibana
6068
Once Setup is complete and services have initialized, you can then allow access to Kibana as follows.
6169

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.0.3
1+
1.0.4

‎pillar/data/addtotab.sh

+41-6
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,47 @@
55
TYPE=$1
66
NAME=$2
77
IPADDRESS=$3
8+
CPUS=$4
9+
GUID=$5
10+
MANINT=$6
11+
ROOTFS=$7
12+
NSM=$8
13+
MONINT=$9
814

9-
if grep -q $IPADDRESS "/opt/so/saltstack/pillar/data/nodestab.sls"; then
10-
echo "Storage Node Already in There"
11-
else
12-
echo " $NAME:" >> /opt/so/saltstack/pillar/data/nodestab.sls
13-
echo " ip: $IPADDRESS" >> /opt/so/saltstack/pillar/data/nodestab.sls
14-
salt-call state.apply utility
15+
echo "Seeing if this host is already in here. If so delete it"
16+
if grep -q $NAME "/opt/so/saltstack/pillar/data/$TYPE.sls"; then
17+
echo "Node Already Present - Let's re-add it"
18+
awk -v blah=" $NAME:" 'BEGIN{ print_flag=1 }
19+
{
20+
if( $0 ~ blah )
21+
{
22+
print_flag=0;
23+
next
24+
}
25+
if( $0 ~ /^ [a-zA-Z0-9]+:$/ )
26+
{
27+
print_flag=1;
28+
}
29+
if ( print_flag == 1 )
30+
print $0
1531
32+
} ' /opt/so/saltstack/pillar/data/$TYPE.sls > /opt/so/saltstack/pillar/data/tmp.$TYPE.sls
33+
mv /opt/so/saltstack/pillar/data/tmp.$TYPE.sls /opt/so/saltstack/pillar/data/$TYPE.sls
34+
echo "Deleted $NAME from the tab. Now adding it in again with updated info"
35+
fi
36+
echo " $NAME:" >> /opt/so/saltstack/pillar/data/$TYPE.sls
37+
echo " ip: $IPADDRESS" >> /opt/so/saltstack/pillar/data/$TYPE.sls
38+
echo " manint: $MANINT" >> /opt/so/saltstack/pillar/data/$TYPE.sls
39+
echo " totalcpus: $CPUS" >> /opt/so/saltstack/pillar/data/$TYPE.sls
40+
echo " guid: $GUID" >> /opt/so/saltstack/pillar/data/$TYPE.sls
41+
echo " rootfs: $ROOTFS" >> /opt/so/saltstack/pillar/data/$TYPE.sls
42+
echo " nsmfs: $NSM" >> /opt/so/saltstack/pillar/data/$TYPE.sls
43+
if [ $TYPE == 'sensorstab' ]; then
44+
echo " monint: $MONINT" >> /opt/so/saltstack/pillar/data/$TYPE.sls
45+
salt-call state.apply common
46+
fi
47+
if [ $TYPE == 'evaltab' ]; then
48+
echo " monint: $MONINT" >> /opt/so/saltstack/pillar/data/$TYPE.sls
49+
salt-call state.apply common
50+
salt-call state.apply utility
1651
fi

‎pillar/data/evaltab.sls

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
evaltab:

‎pillar/data/mastertab.sls

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
mastertab:

‎pillar/data/sensorstab.sls

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
sensorstab:

‎pillar/masters/schedule.sls

-5
This file was deleted.

‎pillar/nodes/schedule.sls

-5
This file was deleted.

‎pillar/sensors/schedule.sls

-5
This file was deleted.

‎pillar/top.sls

-4
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,24 @@
11
base:
22
'G@role:so-sensor':
3-
- sensors.schedule
43
- sensors.{{ grains.host }}
54
- static
65
- firewall.*
76
- brologs
87

98
'G@role:so-master':
10-
- masters.schedule
119
- masters.{{ grains.host }}
1210
- static
1311
- firewall.*
1412
- data.*
1513

1614
'G@role:so-eval':
17-
- masters.schedule
1815
- masters.{{ grains.host }}
1916
- static
2017
- firewall.*
2118
- data.*
2219
- brologs
2320

2421
'G@role:so-node':
25-
- nodes.schedule
2622
- nodes.{{ grains.host }}
2723
- static
2824
- firewall.*

‎salt/bro/cron/packetloss.sh

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash
2+
/usr/bin/docker exec so-bro /opt/bro/bin/broctl netstats | awk -F '[ =]' '{RCVD += $5;DRP += $7;TTL += $9} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/bro/logs/packetloss.log

‎salt/bro/files/local.bro

+2-1
Original file line numberDiff line numberDiff line change
@@ -141,4 +141,5 @@
141141
#@load custom/somebropolicy.bro
142142

143143
# Write logs in JSON
144-
#redef LogAscii::use_json = T;
144+
redef LogAscii::use_json = T;
145+
redef LogAscii::json_timestamps = JSON::TS_ISO8601;

‎salt/bro/files/local.bro.community

+2-1
Original file line numberDiff line numberDiff line change
@@ -129,4 +129,5 @@
129129
#@load custom/somebropolicy.bro
130130

131131
# Use JSON
132-
#redef LogAscii::use_json = T;
132+
redef LogAscii::use_json = T;
133+
redef LogAscii::json_timestamps = JSON::TS_ISO8601;

‎salt/bro/init.sls

+27
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ brospooldir:
3535
- user: 937
3636
- makedirs: true
3737

38+
brosfafincompletedir:
39+
file.directory:
40+
- name: /nsm/faf/files/incomplete
41+
- user: 937
42+
- makedirs: true
43+
44+
brosfafcompletedir:
45+
file.directory:
46+
- name: /nsm/faf/files/complete
47+
- user: 937
48+
- makedirs: true
49+
3850
# Sync the policies
3951
bropolicysync:
4052
file.recurse:
@@ -53,6 +65,21 @@ nodecfgsync:
5365
- group: 939
5466
- template: jinja
5567

68+
plcronscript:
69+
file.managed:
70+
- name: /usr/local/bin/packetloss.sh
71+
- source: salt://bro/cron/packetloss.sh
72+
- mode: 755
73+
74+
/usr/local/bin/packetloss.sh:
75+
cron.present:
76+
- user: root
77+
- minute: '*/10'
78+
- hour: '*'
79+
- daymonth: '*'
80+
- month: '*'
81+
- dayweek: '*'
82+
5683
# Sync local.bro
5784
{% if salt['pillar.get']('static:broversion', '') == 'COMMUNITY' %}
5885
localbrosync:

‎salt/ca/files/signing_policies.conf

+13
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,16 @@ x509_signing_policies:
3838
- authorityKeyIdentifier: keyid,issuer:always
3939
- days_valid: 3000
4040
- copypath: /etc/pki/issued_certs/
41+
influxdb:
42+
- minions: '*'
43+
- signing_private_key: /etc/pki/ca.key
44+
- signing_cert: /etc/pki/ca.crt
45+
- C: US
46+
- ST: Utah
47+
- L: Salt Lake City
48+
- basicConstraints: "critical CA:false"
49+
- keyUsage: "critical keyEncipherment"
50+
- subjectKeyIdentifier: hash
51+
- authorityKeyIdentifier: keyid,issuer:always
52+
- days_valid: 3000
53+
- copypath: /etc/pki/issued_certs/

‎salt/common/grafana/etc/dashboards/dashboard.yml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: 1
2+
3+
providers:
4+
5+
{%- if grains['role'] != 'so-eval' %}
6+
- name: 'Master'
7+
folder: 'Master'
8+
type: file
9+
disableDeletion: false
10+
editable: true
11+
options:
12+
path: /etc/grafana/grafana_dashboards/master
13+
- name: 'Forward Nodes'
14+
folder: 'Forward Nodes'
15+
type: file
16+
disableDeletion: false
17+
editable: true
18+
options:
19+
path: /etc/grafana/grafana_dashboards/forward_nodes
20+
- name: 'Storage Nodes'
21+
folder: 'Storage Nodes'
22+
type: file
23+
disableDeletion: false
24+
editable: true
25+
options:
26+
path: /etc/grafana/grafana_dashboards/storage_nodes
27+
{%- else %}
28+
- name: 'Security Onion'
29+
folder: 'Eval Mode'
30+
type: file
31+
disableDeletion: false
32+
editable: true
33+
options:
34+
path: /etc/grafana/grafana_dashboards/eval
35+
{% endif %}

‎salt/common/grafana/etc/datasources/influxdb.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{%- set MASTER = salt['pillar.get']('static:masterip', '') %}
2+
apiVersion: 1
3+
4+
deleteDatasources:
5+
- name: Graphite
6+
orgId: 1
7+
8+
datasources:
9+
- name: InfluxDB
10+
type: influxdb
11+
access: proxy
12+
database: telegraf
13+
url: https://{{ MASTER }}:8086
14+
jsonData:
15+
tlsAuth: false
16+
tlsAuthWithCACert: false
17+
tlsSkipVerify: true
18+
version: 1

0 commit comments

Comments
 (0)