This repository has been archived by the owner on Dec 13, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update documentation and minor fixes
- Loading branch information
Alban MARGUET
authored and
tescure
committed
Jan 28, 2020
1 parent
a06ee00
commit 720568b
Showing
10 changed files
with
115 additions
and
85 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| ELK_VERSION=5.6.7 | ||
| ELK_VERSION=6.8.2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,38 +1,34 @@ | ||
| # Kibana index-pattern | ||
|
|
||
| List of Kibana index-pattern, used for Stormshield product logs: | ||
| * stormshield-sns-fields-format.json [Network Security](https://www.stormshield.com/products-services/products/network-security/) | ||
| * stormshield-sdmc-fields-format.json [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) | ||
| * stormshield-sds-fields-format.json [Data Enterprise](https://www.stormshield.com/products/enterprise) | ||
| * stormshield-ses-fields-format.json [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) | ||
|
|
||
| * stormshield-sns-fields-format.json [Network Security](https://www.stormshield.com/products-services/products/network-security/) | ||
| * stormshield-sdmc-fields-format.json [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) | ||
| * stormshield-sds-fields-format.json [Data Enterprise](https://www.stormshield.com/products/enterprise) | ||
| * stormshield-ses-fields-format.json [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) | ||
|
|
||
| ## Installation instructions | ||
|
|
||
| - For [Network Security](https://www.stormshield.com/products-services/products/network-security/) logs: | ||
| * For [Network Security](https://www.stormshield.com/products-services/products/network-security/) logs: | ||
|
|
||
| ```bash | ||
| curl -XPOST -D- 'http://<your-kibana-server>:5601/api/saved_objects/index-pattern' \ | ||
| -H 'Content-Type: application/json' \ | ||
| -H 'kbn-version: 6.8.2' \ | ||
| -H 'Content-Type: application/json' -d @stormshield-sns-fields-format.json | ||
| curl -XPOST --user elastic:changeme -D- 'http://<your-kibana-server>:5601/api/saved_objects/_bulk_create' -H 'kbn-version: 6.8.2' -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d @stormshield-sns-fields-format.json | ||
| ``` | ||
| - For [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) logs: | ||
|
|
||
| * For [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) logs: | ||
|
|
||
| ```bash | ||
| curl -XPOST -D- 'http://<your-kibana-server>:5601/api/saved_objects/index-pattern' \ | ||
| -H 'Content-Type: application/json' \ | ||
| -H 'kbn-version: 6.8.2' \ | ||
| -H 'Content-Type: application/json' -d @stormshield-sdmc-fields-format.json | ||
| curl -XPOST --user elastic:changeme -D- 'http://<your-kibana-server>:5601/api/saved_objects/_bulk_create' -H 'kbn-version: 6.8.2' -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d @stormshield-sdmc-fields-format.json | ||
| ``` | ||
| - For [Data Enterprise](https://www.stormshield.com/products/enterprise) logs: | ||
|
|
||
| * For [Data Enterprise](https://www.stormshield.com/products/enterprise) logs: | ||
|
|
||
| ```bash | ||
| curl -XPOST -D- 'http://<your-kibana-server>:5601/api/saved_objects/index-pattern' \ | ||
| -H 'Content-Type: application/json' \ | ||
| -H 'kbn-version: 6.8.2' \ | ||
| -H 'Content-Type: application/json' -d @stormshield-sds-fields-format.json | ||
| curl -XPOST --user elastic:changeme -D- 'http://<your-kibana-server>:5601/api/saved_objects/_bulk_create' -H 'kbn-version: 6.8.2' -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d @stormshield-sds-fields-format.json | ||
| ``` | ||
| - For [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) logs: | ||
|
|
||
| * For [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) logs: | ||
|
|
||
| ```bash | ||
| curl -XPOST -D- 'http://<your-kibana-server>:5601/api/saved_objects/index-pattern' \ | ||
| -H 'Content-Type: application/json' \ | ||
| -H 'kbn-version: 6.8.2' \ | ||
| -H 'Content-Type: application/json' -d @stormshield-ses-fields-format.json | ||
| curl -XPOST --user elastic:changeme -D- 'http://<your-kibana-server>:5601/api/saved_objects/_bulk_create' -H 'kbn-version: 6.8.2' -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d @stormshield-ses-fields-format.json | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| input { | ||
| syslog { | ||
| host => "127.0.0.1" | ||
| port => 5514 | ||
| port => 5000 | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
| @version: 3.13 | ||
| @define allow-config-dups 1 | ||
| @define MAX_CONNECTIONS 10 | ||
| @define LOG_IW_SIZE 10000 | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,34 @@ | ||
| # Elasticsearch templates | ||
|
|
||
| List of Elasticsearch templates, used for Stormshield product logs: | ||
| * sns.template.json [Network Security](https://www.stormshield.com/products-services/products/network-security/) | ||
| * sdmc.template.json [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) | ||
| * sds.template.json [Data Enterprise](https://www.stormshield.com/products/enterprise) | ||
| * ses.template.json [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) | ||
|
|
||
| * sns-*.template.json [Network Security](https://www.stormshield.com/products-services/products/network-security/) | ||
| * sdmc-*.template.json [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) | ||
| * sds.template.json [Data Enterprise](https://www.stormshield.com/products/enterprise) | ||
| * ses-*.template.json [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) | ||
|
|
||
| ## Installation instructions | ||
|
|
||
| - For [Network Security](https://www.stormshield.com/products-services/products/network-security/) logs: | ||
| ```bash | ||
| curl -XPUT http://<your-elasticsearch-server>:9200/_template/snslog -H 'Content-Type: application/json' -d @sns.template.json | ||
| * For [Network Security](https://www.stormshield.com/products-services/products/network-security/) logs: | ||
|
|
||
| ```bash | ||
| find . -maxdepth 1 -name 'sns-*.template.json' -execdir bash -c 'file=${0#./}; curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/${file%.template.json} -H "Content-Type: application/json" -d @${file}' {} \; | ||
| ``` | ||
| - For [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) logs: | ||
| ```bash | ||
| curl -XPUT http://<your-elasticsearch-server>:9200/_template/sdmclog -H 'Content-Type: application/json' -d @sdmc.template.json | ||
|
|
||
| * For [Data For Cloud Mobility](https://www.stormshield.com/products/cloud-and-mobility/) logs: | ||
|
|
||
| ```bash | ||
| find . -maxdepth 1 -name 'sdmc-*.template.json' -execdir bash -c 'file=${0#./}; curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/${file%.template.json} -H "Content-Type: application/json" -d @${file}' {} \; | ||
| ``` | ||
| - For [Data Enterprise](https://www.stormshield.com/products/enterprise) logs: | ||
| ```bash | ||
| curl -XPUT http://<your-elasticsearch-server>:9200/_template/sdslog -H 'Content-Type: application/json' -d @sds.template.json | ||
|
|
||
| * For [Data Enterprise](https://www.stormshield.com/products/enterprise) logs: | ||
|
|
||
| ```bash | ||
| curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/sds -H 'Content-Type: application/json' -d @sds.template.json | ||
| ``` | ||
| - For [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) logs: | ||
|
|
||
| * For [Stormshield Endpoint Security](https://www.stormshield.com/products/stormshield-endpoint-security/) logs: | ||
|
|
||
| ```bash | ||
| curl -XPUT http://<your-elasticsearch-server>:9200/_template/seslog -H 'Content-Type: application/json' -d @ses.template.json | ||
| find . -maxdepth 1 -name 'ses-*.template.json' -execdir bash -c 'file=${0#./}; curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/${file%.template.json} -H "Content-Type: application/json" -d @${file}' {} \; | ||
| ``` |