mirror of
https://github.com/cliffe/SecGen.git
synced 2026-02-21 11:18:06 +00:00
141 lines
3.5 KiB
XML
141 lines
3.5 KiB
XML
<?xml version="1.0"?>
|
|
|
|
<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
|
|
|
|
<!-- an example single system containing a ELK 7.10 instance -->
|
|
|
|
<system>
|
|
<system_name>elk</system_name>
|
|
<base platform="linux" distro="Buster"/>
|
|
|
|
<input into_datastore="IP_addresses">
|
|
<value>172.16.0.2</value>
|
|
<value>172.16.0.3</value>
|
|
</input>
|
|
|
|
<input into_datastore="elasticsearch_port">
|
|
<value>9200</value>
|
|
</input>
|
|
|
|
<input into_datastore="logstash_port">
|
|
<value>5044</value>
|
|
</input>
|
|
|
|
<input into_datastore="kibana_port">
|
|
<value>5601</value>
|
|
</input>
|
|
|
|
<service module_path=".*/elasticsearch">
|
|
<input into="elasticsearch_ip">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
<input into="elasticsearch_port">
|
|
<datastore access="0">elasticsearch_port</datastore>
|
|
</input>
|
|
</service>
|
|
|
|
<service module_path=".*/logstash">
|
|
<input into="logstash_port">
|
|
<datastore access="0">logstash_port</datastore>
|
|
</input>
|
|
<input into="elasticsearch_ip">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
<input into="elasticsearch_port">
|
|
<datastore access="0">elasticsearch_port</datastore>
|
|
</input>
|
|
</service>
|
|
|
|
<service module_path=".*/kibana">
|
|
<input into="kibana_ip">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
<input into="kibana_port">
|
|
<datastore access="0">kibana_port</datastore>
|
|
</input>
|
|
<input into="elasticsearch_ip">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
<input into="elasticsearch_port">
|
|
<datastore access="0">elasticsearch_port</datastore>
|
|
</input>
|
|
</service>
|
|
|
|
<utility module_path=".*/filebeat.*">
|
|
<input into="logstash_ip">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
<input into="logstash_port">
|
|
<datastore access="0">logstash_port</datastore>
|
|
</input>
|
|
</utility>
|
|
|
|
<utility module_path=".*/auditbeat.*">
|
|
<input into="logstash_ip">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
<input into="logstash_port">
|
|
<datastore access="0">logstash_port</datastore>
|
|
</input>
|
|
</utility>
|
|
|
|
<utility module_path=".*/elastalert.*"/>
|
|
|
|
<network type="private_network" >
|
|
<input into="IP_address">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
</network>
|
|
<build type="cleanup">
|
|
<input into="root_password">
|
|
<value>dev</value>
|
|
</input>
|
|
</build>
|
|
</system>
|
|
|
|
<system>
|
|
<system_name>auditpusher</system_name>
|
|
<base platform="linux" type="desktop" distro="Debian 10"/>
|
|
|
|
<utility module_path=".*/auditbeat.*">
|
|
<input into="logstash_ip">
|
|
<datastore access="0">IP_addresses</datastore>
|
|
</input>
|
|
<input into="logstash_port">
|
|
<datastore access="0">logstash_port</datastore>
|
|
</input>
|
|
</utility>
|
|
|
|
<utility module_path=".*/parameterised_accounts">
|
|
<input into="accounts" into_datastore="account">
|
|
<generator type="account">
|
|
<input into="username">
|
|
<value>test</value>
|
|
</input>
|
|
<input into="password">
|
|
<value>test</value>
|
|
</input>
|
|
<input into="strings_to_leak">
|
|
<value/>
|
|
</input>
|
|
<input into="leaked_filenames">
|
|
<value/>
|
|
</input>
|
|
<input into="super_user">
|
|
<value>true</value>
|
|
</input>
|
|
</generator>
|
|
</input>
|
|
</utility>
|
|
|
|
<network type="private_network" >
|
|
<input into="IP_address">
|
|
<datastore access="1">IP_addresses</datastore>
|
|
</input>
|
|
</network>
|
|
</system>
|
|
|
|
</scenario>
|