digital-forensics-labs/SecGen
1
0
Fork 0
mirror of https://github.com/cliffe/SecGen.git synced 2026-02-22 19:58:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auditbeat audit_rules.erb template added

Browse Source
This commit is contained in:
ts
2018-09-14 16:14:54 +01:00
committed by thomashaw
parent aa9dbcd099
commit 625ca18158
4 changed files with 27 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
modules/utilities/unix/logging/auditbeat/auditbeat.pp
View File

@@ -1,46 +1,27 @@
$secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
$logstash_ip = $secgen_parameters['logstash_ip'][0]
$logstash_port = 0 + $secgen_parameters['logstash_port'][0]
$files_to_audit = $secgen_parameters['files_to_audit']
# TODO - check if we need this (or are account accesses automatically audited)?
# Even if we don't need it - we will need to add the accounts to watch into the 'watchers' section when we reach that point.
# $accounts_to_audit = $secgen_parameters['accounts_to_audit']
class { 'auditbeat':
modules => [
{
'module' => 'file_integrity',
'enabled' => true,
'paths' => ['/bin', '/usr/bin', '/sbin', '/usr/sbin', '/etc'],
},
# {
# 'module' => 'auditd',
# 'enabled' => true,
# 'audit_rules' => '-a always,exit -F arch=b64 -S all -F key=64bit-abi',
# TODO: this needs correctly configuring. see https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-auditd.html
# 'module' => 'file_integrity',
# 'enabled' => true,
# 'paths' => ['/bin', '/usr/bin', '/sbin', '/usr/sbin', '/etc'],
# },
{
'module' => 'auditd',
'enabled' => true,
'audit_rules' => template('auditbeat/audit_rules.erb'),
},
],
outputs => {
'logstash' => {
'hosts' => ["$logstash_ip:$logstash_port"],
},
},
}
#
# class { 'auditbeat':
# modules => [
# {
# 'module' => 'file_integrity',
# 'enabled' => true,
# 'paths' => ['/bin', '/usr/bin', '/sbin', '/usr/sbin', '/etc'],
# },
# {
# 'module' => 'auditd',
# 'enabled' => true,
# },
# ],
# outputs => {
# 'elasticsearch' => {
# 'hosts' => ['http://localhost:9200'],
# 'index' => 'auditbeat-%{+YYYY.MM.dd}',
# },
# }
# }
}

6
modules/utilities/unix/logging/auditbeat/secgen_metadata.xml
View File

@@ -14,6 +14,7 @@
<read_fact>logstash_ip</read_fact>
<read_fact>logstash_port</read_fact>
<read_fact>files_to_audit</read_fact>
<default_input into="logstash_ip">
<value>localhost</value>
@@ -23,6 +24,11 @@
<value>5044</value>
</default_input>
<default_input into="files_to_audit">
<value>/etc/shadow</value>
<value>/etc/passwd</value>
</default_input>
<requires>
<type>update</type>
</requires>

7
modules/utilities/unix/logging/auditbeat/templates/audit_rules.erb Normal file
View File

@@ -0,0 +1,7 @@
<% audit_rules = ''
@files_to_audit.each {|file|
audit_rules << "-w #{file} -p rwa -k identity\n"
}
-%>
<%= audit_rules -%>

36
modules/utilities/unix/logging/logstash/logstash.pp
View File

@@ -5,40 +5,6 @@ $elasticsearch_port = 0 + $secgen_parameters['elasticsearch_port'][0]
include logstash
# You must provide a valid pipeline configuration for the service to start.
logstash::configfile { 'my_ls_config':
content => template('logstash/configfile-template.erb'),
}
# TODO: Delete this if its a problem
#
# class { 'logstash':
# settings => {
# 'http.host' => $ip_address,
# }
# }
# logstash::plugin { 'logstash-input-beats': }
# $myconfig = @("MYCONFIG"/L)
# input {
# beats {
# port => 5044
# }
# }
# output {
# elasticsearch {
# hosts => "192.168.1.133:9200"
# manage_template => false
# index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
# document_type => "%{[@metadata][type]}"
# }
# stdout { codec => rubydebug }
# }
# | MYCONFIG
#
# logstash::configfile { '02-beats-input.conf':
# content => $myconfig,
# }
}