-
Notifications
You must be signed in to change notification settings - Fork 96
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #109 from rocknsm/dcode/pull-102/fsf
Updates towards merging in FSF LGTM
- Loading branch information
Showing
12 changed files
with
304 additions
and
66 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| /data/fsf/*.log | ||
| { | ||
| rotate 3 | ||
| missingok | ||
| compress | ||
| create 0644 fsf fsf | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| input { | ||
| file { | ||
| codec => "json" | ||
| path => "/data/fsf/scan.log" | ||
| add_field => { "[@metadata][stage]" => "fsf" } | ||
| } | ||
| } | ||
|
|
||
| filter { | ||
| if "_jsonparsefailure" in [tags] { | ||
| drop { } | ||
| } | ||
| if [@metadata][stage] == "fsf" { | ||
| mutate { remove_field => ["path"] } | ||
| } | ||
| } | ||
|
|
||
| output { | ||
| if [@metadata][stage] == "fsf" { | ||
| #stdout { codec => rubydebug } | ||
| elasticsearch { | ||
| hosts => ["127.0.0.1"] | ||
| index => "fsf-%{+YYYY.MM.dd}" | ||
| document_type => "fsf" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,43 +1,71 @@ | ||
| #!/bin/bash | ||
|
|
||
| echo "Starting Zookeeper..." | ||
| systemctl start zookeeper | ||
| sleep 5 | ||
| systemctl status zookeeper | egrep "^\s*Active" | ||
|
|
||
| echo "Starting Elasticsearch..." | ||
| systemctl start elasticsearch | ||
| sleep 5 | ||
| systemctl status elasticsearch | egrep "^\s*Active" | ||
|
|
||
| echo "Starting Kafka..." | ||
| systemctl start kafka | ||
| sleep 5 | ||
| systemctl status kafka | egrep "^\s*Active" | ||
|
|
||
| echo "Starting Logstash..." | ||
| systemctl start logstash | ||
| sleep 5 | ||
| systemctl status logstash | egrep "^\s*Active" | ||
|
|
||
| echo "Starting Kibana..." | ||
| systemctl start kibana | ||
| sleep 5 | ||
| systemctl status kibana | egrep "^\s*Active" | ||
|
|
||
| echo "Starting Suricata..." | ||
| systemctl start suricata | ||
| sleep 5 | ||
| systemctl status suricata | egrep "^\s*Active" | ||
|
|
||
| echo "Starting Bro..." | ||
| systemctl start broctl | ||
| sleep 5 | ||
| systemctl status broctl | egrep "^\s*Active" | ||
|
|
||
| #echo "Starting Stenographer..." | ||
| #systemctl start stenographer | ||
| #sleep 5 | ||
| #systemctl status stenographer | egrep "^\s*Active" | ||
| function feature_enabled() { | ||
| grep -qiE "^enable_$1: (true|yes)" /etc/rocknsm/config.yml; | ||
| return $? | ||
| } | ||
|
|
||
| if feature_enabled zookeeper; then | ||
| echo "Starting Zookeeper..." | ||
| systemctl start zookeeper | ||
| sleep 5 | ||
| systemctl status zookeeper | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled elasticsearch; then | ||
| echo "Starting Elasticsearch..." | ||
| systemctl start elasticsearch | ||
| sleep 5 | ||
| systemctl status elasticsearch | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled kafka; then | ||
| echo "Starting Kafka..." | ||
| systemctl start kafka | ||
| sleep 5 | ||
| systemctl status kafka | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled logstash; then | ||
| echo "Starting Logstash..." | ||
| systemctl start logstash | ||
| sleep 5 | ||
| systemctl status logstash | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled kibana; then | ||
| echo "Starting Kibana..." | ||
| systemctl start kibana | ||
| sleep 5 | ||
| systemctl status kibana | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled suricata; then | ||
| echo "Starting Suricata..." | ||
| systemctl start suricata | ||
| sleep 5 | ||
| systemctl status suricata | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled bro; then | ||
| echo "Starting Bro..." | ||
| systemctl start broctl | ||
| sleep 5 | ||
| systemctl status broctl | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled stenographer; then | ||
| echo "Starting Stenographer..." | ||
| systemctl start stenographer | ||
| sleep 5 | ||
| systemctl status stenographer | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| if feature_enabled fsf; then | ||
| echo "Starting FSF..." | ||
| systemctl start fsf | ||
| sleep 5 | ||
| systemctl status fsf | egrep "^\s*Active" | ||
| fi | ||
|
|
||
| exit 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,27 +1,59 @@ | ||
| #!/bin/bash | ||
|
|
||
| #echo "Stopping Stenographer..." | ||
| #systemctl stop stenographer | ||
|
|
||
| echo "Stopping Suricata..." | ||
| systemctl stop suricata | ||
|
|
||
| echo "Stopping Bro..." | ||
| systemctl stop broctl | ||
|
|
||
| echo "Stopping Logstash..." | ||
| systemctl stop logstash | ||
|
|
||
| echo "Stopping Kibana..." | ||
| systemctl stop kibana | ||
|
|
||
| echo "Stopping Elasticsearch..." | ||
| systemctl stop elasticsearch | ||
|
|
||
| echo "Stopping Kafka..." | ||
| systemctl stop kafka | ||
|
|
||
| echo "Stopping Zookeeper..." | ||
| systemctl stop zookeeper | ||
| function feature_enabled() { | ||
| grep -qiE "^enable_$1: (true|yes)" /etc/rocknsm/config.yml; | ||
| return $? | ||
| } | ||
|
|
||
| if feature_enabled fsf; then | ||
| echo "Stopping FSF..." | ||
| systemctl stop fsf | ||
| fi | ||
|
|
||
| if feature_enabled suricata; then | ||
| echo "Stopping Stenographer..." | ||
| systemctl stop stenographer | ||
| fi | ||
|
|
||
| if feature_enabled suricata; then | ||
| echo "Stopping Suricata..." | ||
| systemctl stop suricata | ||
| fi | ||
|
|
||
| if feature_enabled snort; then | ||
| echo "Stopping Snort..." | ||
| systemctl stop snortd | ||
| fi | ||
|
|
||
| if feature_enabled bro; then | ||
| echo "Stopping Bro..." | ||
| systemctl stop broctl | ||
| fi | ||
|
|
||
| if feature_enabled logstash; then | ||
| echo "Stopping Logstash..." | ||
| systemctl stop logstash | ||
| fi | ||
|
|
||
| if feature_enabled kibana; then | ||
| echo "Stopping Kibana..." | ||
| systemctl stop kibana | ||
| fi | ||
|
|
||
| if feature_enabled elasticsearch; then | ||
| echo "Stopping Elasticsearch..." | ||
| systemctl stop elasticsearch | ||
| fi | ||
|
|
||
| if feature_enabled kafka; then | ||
| echo "Stopping Kafka..." | ||
| systemctl stop kafka | ||
| fi | ||
|
|
||
| if feature_enabled zookeeper; then | ||
| echo "Stopping Zookeeper..." | ||
| systemctl stop zookeeper | ||
| fi | ||
|
|
||
| exit 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.