diff --git a/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/graylog upgrade.sh b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/graylog upgrade.sh new file mode 100644 index 00000000..25f9171b --- /dev/null +++ b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/graylog upgrade.sh @@ -0,0 +1,105 @@ +#!/bin/bash + +# Variables +GRAYLOG_VERSION="4.5.6" # Update to the desired Graylog version +OPENSEARCH_VERSION="2.9.0" # Update to the desired OpenSearch version +MONGO_VERSION="6.0" # Update to the desired MongoDB version +MONGO_BACKUP_PATH="/backup/mongo_$(date +%Y%m%d_%H%M%S)" +CONFIG_BACKUP_PATH="/backup/graylog_config_$(date +%Y%m%d_%H%M%S)" +OPENSEARCH_SNAPSHOT_PATH="/backup/opensearch_snapshot_$(date +%Y%m%d_%H%M%S)" +LOG_FILE="/var/log/graylog_opensearch_mongo_upgrade.log" + +# Functions +log() { + echo "$(date +%Y-%m-%d_%H:%M:%S) - $1" | tee -a $LOG_FILE +} + +# Step 1: Stop Graylog Services +log "Stopping Graylog service..." +sudo systemctl stop graylog-server + +# Step 2: Backup MongoDB +log "Backing up MongoDB..." +mkdir -p $MONGO_BACKUP_PATH +mongodump --db graylog --out $MONGO_BACKUP_PATH +if [[ $? -ne 0 ]]; then + log "Error during MongoDB backup. Aborting!" + exit 1 +fi + +# Step 3: Backup Graylog Configuration +log "Backing up Graylog configuration..." +mkdir -p $CONFIG_BACKUP_PATH +cp /etc/graylog/server/server.conf $CONFIG_BACKUP_PATH +if [[ $? -ne 0 ]]; then + log "Error during configuration backup. Aborting!" + exit 1 +fi + +# Step 4: Backup OpenSearch Data +log "Creating an OpenSearch snapshot..." +mkdir -p $OPENSEARCH_SNAPSHOT_PATH +curl -XPUT "http://localhost:9200/_snapshot/my_backup" -H 'Content-Type: application/json' -d '{ + "type": "fs", + "settings": { + "location": "'$OPENSEARCH_SNAPSHOT_PATH'", + "compress": true + } +}' + +curl -XPUT "http://localhost:9200/_snapshot/my_backup/snapshot_$(date +%Y%m%d)" -H 'Content-Type: application/json' +if [[ $? -ne 0 ]]; then + log "Error during OpenSearch snapshot creation. Aborting!" + exit 1 +fi + +# Step 5: Stop OpenSearch and MongoDB +log "Stopping OpenSearch and MongoDB services..." +sudo systemctl stop opensearch +sudo systemctl stop mongod + +# Step 6: Upgrade MongoDB +log "Upgrading MongoDB to version $MONGO_VERSION..." +# Update the MongoDB repository to point to the new version +wget -qO - https://www.mongodb.org/static/pgp/server-$MONGO_VERSION.asc | sudo apt-key add - +echo "deb [ arch=amd64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/$MONGO_VERSION multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-$MONGO_VERSION.list + +sudo apt update && sudo apt install -y mongodb-org +if [[ $? -ne 0 ]]; then + log "Error during MongoDB upgrade. Aborting!" + exit 1 +fi + +# Step 7: Upgrade OpenSearch +log "Upgrading OpenSearch to version $OPENSEARCH_VERSION..." +sudo apt update && sudo apt install -y opensearch=$OPENSEARCH_VERSION +if [[ $? -ne 0 ]]; then + log "Error during OpenSearch upgrade. Aborting!" + exit 1 +fi + +# Step 8: Upgrade Graylog +log "Upgrading Graylog to version $GRAYLOG_VERSION..." +sudo apt update && sudo apt install -y graylog-server=$GRAYLOG_VERSION +if [[ $? -ne 0 ]]; then + log "Error during Graylog upgrade. Aborting!" + exit 1 +fi + +# Step 9: Start Services +log "Starting MongoDB, OpenSearch, and Graylog services..." +sudo systemctl start mongod +sudo systemctl start opensearch +sudo systemctl start graylog-server + +# Step 10: Verify Services +log "Verifying MongoDB service..." +sudo systemctl status mongod | tee -a $LOG_FILE + +log "Verifying OpenSearch service..." +sudo systemctl status opensearch | tee -a $LOG_FILE + +log "Verifying Graylog service..." +sudo systemctl status graylog-server | tee -a $LOG_FILE + +log "Upgrade completed successfully!" \ No newline at end of file diff --git a/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/safe_sysctl.sh b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/safe_sysctl.sh new file mode 100644 index 00000000..d71b14ab --- /dev/null +++ b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/safe_sysctl.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Apply security-hardening sysctl settings + +echo "Applying security-hardening sysctl settings..." + +# Set sysctl parameters +sysctl -w net.ipv4.conf.all.log_martians=1 +sysctl -w net.ipv4.icmp_ignore_broadcasts=1 +sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 +sysctl -w net.ipv4.conf.all.rp_filter=1 +sysctl -w net.ipv4.conf.default.rp_filter=1 +sysctl -w net.ipv4.tcp_syncookies=1 +sysctl -w kernel.randomize_va_space=2 +sysctl -w kernel.panic=10 +sysctl -w fs.protected_hardlinks=1 +sysctl -w fs.protected_symlinks=1 + +# Persist settings across reboots +cat << EOF > /etc/sysctl.d/security_hardening.conf +net.ipv4.conf.all.log_martians=1 +net.ipv4.icmp_ignore_broadcasts=1 +net.ipv4.icmp_ignore_bogus_error_responses=1 +net.ipv4.conf.all.rp_filter=1 +net.ipv4.conf.default.rp_filter=1 +net.ipv4.tcp_syncookies=1 +kernel.randomize_va_space=2 +kernel.panic=10 +fs.protected_hardlinks=1 +fs.protected_symlinks=1 +EOF + +# Reload sysctl settings +sysctl --system + +echo "Security-hardening sysctl settings applied." \ No newline at end of file diff --git a/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/sshd_config.sh b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/sshd_config.sh new file mode 100644 index 00000000..0d4935c0 --- /dev/null +++ b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/sshd_config.sh @@ -0,0 +1,73 @@ +#!/bin/bash + +# Backup existing SSH configuration files +echo "Backing up /etc/ssh/sshd_config to /etc/ssh/sshd_config.bak..." +cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak +cp -r /etc/ssh/sshd_config.d /etc/ssh/sshd_config_bak.d + +# Create backup directory if it doesn't exist +mkdir -p /etc/ssh/sshd_config_bak.d +mkdir -p /etc/ssh/sshd_config_bak_danger.d + +# SSH Configurations - Apply the hardening settings +echo "Applying SSH hardening configurations..." + +# Disable root login +sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config + +# Use only Protocol 2 +sed -i 's/^#Protocol.*/Protocol 2/' /etc/ssh/sshd_config + +# Set log level to verbose +sed -i 's/^#LogLevel.*/LogLevel VERBOSE/' /etc/ssh/sshd_config + +# Set MaxAuthTries to 4 +sed -i 's/^#MaxAuthTries.*/MaxAuthTries 4/' /etc/ssh/sshd_config + +# Ignore Rhosts +sed -i 's/^#IgnoreRhosts.*/IgnoreRhosts yes/' /etc/ssh/sshd_config + +# Disable host-based authentication +sed -i 's/^#HostBasedAuthentication.*/HostBasedAuthentication no/' /etc/ssh/sshd_config + +# Disable PermitUserEnvironment +sed -i 's/^#PermitUserEnvironment.*/PermitUserEnvironment no/' /etc/ssh/sshd_config + +# Disable empty passwords +sed -i 's/^#PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config + +# Set ClientAliveInterval to 300 seconds +sed -i 's/^#ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config + +# Set ClientAliveCountMax to 0 +sed -i 's/^#ClientAliveCountMax.*/ClientAliveCountMax 0/' /etc/ssh/sshd_config + +# Set LoginGraceTime to 60 seconds +sed -i 's/^#LoginGraceTime.*/LoginGraceTime 60/' /etc/ssh/sshd_config + +# Set MaxStartups to 10:30:60 +sed -i 's/^#MaxStartups.*/MaxStartups 10:30:60/' /etc/ssh/sshd_config + +# Set MaxSessions to 10 +sed -i 's/^#MaxSessions.*/MaxSessions 10/' /etc/ssh/sshd_config + +# Configure Ciphers for secure SSH +sed -i 's/^#Ciphers.*/Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr/' /etc/ssh/sshd_config + +# Configure MACs for secure SSH +sed -i 's/^#MACs.*/MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256/' /etc/ssh/sshd_config + +# Configure KEX algorithms for secure SSH +sed -i 's/^#KexAlgorithms.*/KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256/' /etc/ssh/sshd_config + +# Disable TCP forwarding +sed -i 's/^#AllowTcpForwarding.*/AllowTcpForwarding no/' /etc/ssh/sshd_config + +# Disable X11 forwarding +sed -i 's/^#X11Forwarding.*/X11Forwarding no/' /etc/ssh/sshd_config + +# Restart SSH service again to apply changes +echo "Restarting SSH service again to apply forwarding changes..." +systemctl restart sshd + +echo "SSH hardening and configurations are complete." \ No newline at end of file diff --git a/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/sshd_config2.sh b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/sshd_config2.sh new file mode 100644 index 00000000..68833334 --- /dev/null +++ b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/sshd_config2.sh @@ -0,0 +1,146 @@ +#!/bin/bash + +# Backup existing SSH configuration files +echo "Backing up /etc/ssh/sshd_config to /etc/ssh/sshd_config.bak..." +cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak +cp -r /etc/ssh/sshd_config.d /etc/ssh/sshd_config_bak.d + +# Create backup directory if it doesn't exist +mkdir -p /etc/ssh/sshd_config_bak.d +mkdir -p /etc/ssh/sshd_config_bak_danger.d + +# SSH Configurations - Apply the hardening settings +echo "Applying SSH hardening configurations..." + +# Write out the custom sshd_config based on the provided template + +cat < /etc/ssh/sshd_config +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +Include /etc/ssh/sshd_config.d/*.conf + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +Protocol 2 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +LogLevel VERBOSE + +# Authentication: + +LoginGraceTime 60 +PermitRootLogin no +#StrictModes yes +MaxAuthTries 4 +MaxSessions 10 + +PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +AuthorizedKeysFile .ssh/authorized_keys #.ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +KbdInteractiveAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +AllowTcpForwarding no +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +PrintMotd no +#PrintLastLog yes +#TCPKeepAlive yes +PermitUserEnvironment no +#Compression delayed +ClientAliveInterval 300 +ClientAliveCountMax 0 +#UseDNS no +#PidFile /run/sshd.pid +MaxStartups 10:30:60 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server +EOL + +# Restart SSH service to apply changes +echo "Restarting SSH service to apply changes..." +systemctl restart sshd + +echo "SSH hardening and configurations are complete." \ No newline at end of file diff --git a/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/undo_unsafe_sysctl.sh b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/undo_unsafe_sysctl.sh new file mode 100644 index 00000000..a8be36b9 --- /dev/null +++ b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/undo_unsafe_sysctl.sh @@ -0,0 +1,73 @@ +#!/bin/bash +# Undo the security hardening configuration + +# Enable sending of ICMP redirects +sysctl -w net.ipv4.conf.all.send_redirects=1 +sysctl -w net.ipv4.conf.default.send_redirects=1 + +# Enable source routing +sysctl -w net.ipv4.conf.all.accept_source_route=1 +sysctl -w net.ipv4.conf.default.accept_source_route=1 +sysctl -w net.ipv6.conf.all.accept_source_route=1 +sysctl -w net.ipv6.conf.default.accept_source_route=1 + +# Enable acceptance of ICMP redirects +sysctl -w net.ipv4.conf.all.accept_redirects=1 +sysctl -w net.ipv4.conf.default.accept_redirects=1 +sysctl -w net.ipv6.conf.all.accept_redirects=1 +sysctl -w net.ipv6.conf.default.accept_redirects=1 + +# Enable secure ICMP redirects +sysctl -w net.ipv4.conf.all.secure_redirects=1 +sysctl -w net.ipv4.conf.default.secure_redirects=1 + +# Disable martian packet logging +sysctl -w net.ipv4.conf.all.log_martians=0 +sysctl -w net.ipv4.conf.default.log_martians=0 + +# Disable ignoring broadcast ICMP requests +sysctl -w net.ipv4.icmp_ignore_broadcasts=0 + +# Disable ignoring bogus ICMP error responses +sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=0 + +# Disable reverse path filtering +sysctl -w net.ipv4.conf.all.rp_filter=0 +sysctl -w net.ipv4.conf.default.rp_filter=0 + +# Disable SYN cookies +sysctl -w net.ipv4.tcp_syncookies=0 + +# Enable acceptance of router advertisements +sysctl -w net.ipv6.conf.all.accept_ra=1 +sysctl -w net.ipv6.conf.default.accept_ra=1 + +# Persist settings across reboots +cat << EOF > /etc/sysctl.d/undo_hardening.conf +net.ipv4.conf.all.send_redirects=1 +net.ipv4.conf.default.send_redirects=1 +net.ipv4.conf.all.accept_source_route=1 +net.ipv4.conf.default.accept_source_route=1 +net.ipv6.conf.all.accept_source_route=1 +net.ipv6.conf.default.accept_source_route=1 +net.ipv4.conf.all.accept_redirects=1 +net.ipv4.conf.default.accept_redirects=1 +net.ipv6.conf.all.accept_redirects=1 +net.ipv6.conf.default.accept_redirects=1 +net.ipv4.conf.all.secure_redirects=1 +net.ipv4.conf.default.secure_redirects=1 +net.ipv4.conf.all.log_martians=0 +net.ipv4.conf.default.log_martians=0 +net.ipv4.icmp_ignore_broadcasts=0 +net.ipv4.icmp_ignore_bogus_error_responses=0 +net.ipv4.conf.all.rp_filter=0 +net.ipv4.conf.default.rp_filter=0 +net.ipv4.tcp_syncookies=0 +net.ipv6.conf.all.accept_ra=1 +net.ipv6.conf.default.accept_ra=1 +EOF + +# Reload sysctl configuration +sysctl --system + +echo "Security hardening settings undone." \ No newline at end of file diff --git a/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/unsafe_sysctl.sh b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/unsafe_sysctl.sh new file mode 100644 index 00000000..b491b083 --- /dev/null +++ b/OperatingSystem-Services/Platform-Linux/1-Ansible/First-15/unsafe_sysctl.sh @@ -0,0 +1,57 @@ +#!/bin/bash +# Apply sysctl network security settings + +echo "Applying network security sysctl settings..." + +# Set sysctl parameters +sysctl -w net.ipv4.conf.all.send_redirects=0 +sysctl -w net.ipv4.conf.default.send_redirects=0 +sysctl -w net.ipv4.conf.all.accept_source_route=0 +sysctl -w net.ipv4.conf.default.accept_source_route=0 +sysctl -w net.ipv6.conf.all.accept_source_route=0 +sysctl -w net.ipv6.conf.default.accept_source_route=0 +sysctl -w net.ipv4.conf.all.accept_redirects=0 +sysctl -w net.ipv4.conf.default.accept_redirects=0 +sysctl -w net.ipv6.conf.all.accept_redirects=0 +sysctl -w net.ipv6.conf.default.accept_redirects=0 +sysctl -w net.ipv4.conf.all.secure_redirects=0 +sysctl -w net.ipv4.conf.default.secure_redirects=0 +sysctl -w net.ipv4.conf.all.log_martians=1 +sysctl -w net.ipv4.conf.default.log_martians=1 +sysctl -w net.ipv4.icmp_ignore_broadcasts=1 +sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 +sysctl -w net.ipv4.conf.all.rp_filter=1 +sysctl -w net.ipv4.conf.default.rp_filter=1 +sysctl -w net.ipv4.tcp_syncookies=1 +sysctl -w net.ipv6.conf.all.accept_ra=0 +sysctl -w net.ipv6.conf.default.accept_ra=0 + +# Persist settings across reboots +cat << EOF > /etc/sysctl.d/network_security.conf +net.ipv4.conf.all.send_redirects=0 +net.ipv4.conf.default.send_redirects=0 +net.ipv4.conf.all.accept_source_route=0 +net.ipv4.conf.default.accept_source_route=0 +net.ipv6.conf.all.accept_source_route=0 +net.ipv6.conf.default.accept_source_route=0 +net.ipv4.conf.all.accept_redirects=0 +net.ipv4.conf.default.accept_redirects=0 +net.ipv6.conf.all.accept_redirects=0 +net.ipv6.conf.default.accept_redirects=0 +net.ipv4.conf.all.secure_redirects=0 +net.ipv4.conf.default.secure_redirects=0 +net.ipv4.conf.all.log_martians=1 +net.ipv4.conf.default.log_martians=1 +net.ipv4.icmp_ignore_broadcasts=1 +net.ipv4.icmp_ignore_bogus_error_responses=1 +net.ipv4.conf.all.rp_filter=1 +net.ipv4.conf.default.rp_filter=1 +net.ipv4.tcp_syncookies=1 +net.ipv6.conf.all.accept_ra=0 +net.ipv6.conf.default.accept_ra=0 +EOF + +# Reload sysctl settings +sysctl --system + +echo "Network security sysctl settings applied." \ No newline at end of file diff --git a/OperatingSystem-Services/Service-SOC/FALCO ANSIBLE (KUBERNETES).yml b/OperatingSystem-Services/Service-SOC/FALCO ANSIBLE (KUBERNETES).yml new file mode 100644 index 00000000..401c5369 --- /dev/null +++ b/OperatingSystem-Services/Service-SOC/FALCO ANSIBLE (KUBERNETES).yml @@ -0,0 +1,39 @@ +FALCO ANSIBLE (KUBERNETES) +--- +- name: Deploy Falco on Kubernetes Cluster + hosts: kubernetes + become: yes + tasks: + - name: Install Helm (if not installed) + apt: + name: helm + state: present + + - name: Add Falco Helm repository + command: helm repo add falcosecurity https://falcosecurity.github.io/charts + + - name: Update Helm repository + command: helm repo update + + - name: Install Falco using Helm on Kubernetes + command: helm install falco falcosecurity/falco --namespace default + + - name: Configure Falco to send logs to Wazuh (Syslog) + copy: + dest: /etc/falco/falco.yaml + content: | + syslog: + enabled: true + host: "{{ wazuh_manager_ip }}" + port: 514 + + - name: Restart Falco pod + command: kubectl rollout restart daemonset/falco -n default + + - name: Create a ServiceAccount for Falco (if needed) + kubernetes.core.k8s: + api_version: v1 + kind: ServiceAccount + metadata: + name: falco + namespace: default \ No newline at end of file diff --git a/OperatingSystem-Services/Service-SOC/FALCO ANSIBLE (STANDALONE).yml b/OperatingSystem-Services/Service-SOC/FALCO ANSIBLE (STANDALONE).yml new file mode 100644 index 00000000..d1701c1a --- /dev/null +++ b/OperatingSystem-Services/Service-SOC/FALCO ANSIBLE (STANDALONE).yml @@ -0,0 +1,47 @@ +FALCO ANSIBLE (STANDALONE) + +--- +- name: Install and Configure Falco on Standalone Machines + hosts: standalone + become: yes + vars: + wazuh_manager_ip: "192.168.x.x" # Replace with your Wazuh Manager IP + + tasks: + - name: Install Falco + apt: + name: falco + state: present + + - name: Configure Falco to send logs to Wazuh (Syslog) + copy: + dest: /etc/falco/falco.yaml + content: | + syslog: + enabled: true + host: "{{ wazuh_manager_ip }}" + port: 514 + + - name: Restart Falco service + systemd: + name: falco + state: restarted + + - name: Configure Wazuh to read Falco logs + copy: + dest: /var/ossec/etc/ossec.conf + content: | + + + syslog + /var/log/falco_alerts.log + + + notify: + - Restart Wazuh Agent + + handlers: + - name: Restart Wazuh Agent + systemd: + name: wazuh-agent + state: restarted \ No newline at end of file diff --git a/OperatingSystem-Services/Service-SOC/FALCO.md b/OperatingSystem-Services/Service-SOC/FALCO.md new file mode 100644 index 00000000..9fce4ba8 --- /dev/null +++ b/OperatingSystem-Services/Service-SOC/FALCO.md @@ -0,0 +1,42 @@ +FALCO:apt (Debian/Ubuntu) +The following steps are for Debian and Debian-based distributions, such as Ubuntu, which use the apt package manager. +1. Trust the falcosecurity GPG key + 1. curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \ + 2. sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg + +1. Configure the apt repository + 1. echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] https://download.falco.org/packages/deb stable main" | \ + 1. sudo tee -a /etc/apt/sources.list.d/falcosecurity.list
NOTE:*In older releases of Debian (Debian 9 and older ones), you might need to additionally install the package apt-transport-https to allow access to the Falco repository using the https protocol.
The following command will install that package on your system: ‘sudo apt-get install apt-transport-https’* + +Install some required dependencies that are needed to build the Kernel Module and the eBPF probe
 NOTE: You don't need to install these dependencies if you want to use the Modern eBPF.

1. sudo apt install -y dkms make linux-headers-$(uname -r) + # If you use falcoctl driver loader to build the eBPF probe locally you need also clang toolchain + sudo apt install -y clang llvm + # You can install also the dialog package if you want it + sudo apt install -y dialog +2. Install the Falco package + 1. sudo apt-get install -y falco + +Upgrade +apt (Debian/Ubuntu) +If you configured the apt repository by having followed the instructions for Falco 0.27.0 or older, you may need to update the repository URL, otherwise, feel free to ignore this message +sed -i 's,https://dl.bintray.com/falcosecurity/deb,https://download.falco.org/packages/deb,' /etc/apt/sources.list.d/falcosecurity.list +apt-get clean +apt-get -y update + +Check in the apt-get update log that https://download.falco.org/packages/deb is present. +If you installed Falco by following the provided instructions: +apt-get --only-upgrade install falco + + +Uninstall +apt (Debian/Ubuntu) +apt-get --purge autoremove falco





Troubleshooting +This section aims to offer further guidance when something doesn't go as expected in the installation of Falco. +Unable to find a prebuilt driver +* ERROR failed: unable to find a prebuilt driver +This error message appears when the falcoctl driver loader tool, which looks for the Falco driver and loads it in memory, is not able to find a pre-built driver, neither as an eBPF probe nor as a kernel module, at the [Falco driver repository] (https://download.falco.org). +You can easily browse and search the supported targets at download.falco.org/driver/site. +This means that there's no prebuilt driver available for the kernel running on the machine where Falco is going to be installed. +However, you can add your kernel release version to the build grid the pipeline refers to building the drivers. Follow this tutorial to contribute the required configuration. +There are a limited set of Linux distributions whose kernels are supported by the current prebuilt driver distribution pipeline. +driverkit is the tool used to build those drivers. Hence, it needs to support the specific Linux distribution. Find whether your Linux distribution is supported here. diff --git a/OperatingSystem-Services/Service-SOC/content-pack-306e2337-e7cb-4298-ba4a-d39dfcadd96d-1.json b/OperatingSystem-Services/Service-SOC/content-pack-306e2337-e7cb-4298-ba4a-d39dfcadd96d-1.json new file mode 100644 index 00000000..7f521bde --- /dev/null +++ b/OperatingSystem-Services/Service-SOC/content-pack-306e2337-e7cb-4298-ba4a-d39dfcadd96d-1.json @@ -0,0 +1,4707 @@ +{ + "v": 1, + "id": "306e2337-e7cb-4298-ba4a-d39dfcadd96d", + "rev": 1, + "name": "TestMonitor1", + "summary": "qwerty", + "description": "qwerty", + "vendor": "qwerty", + "url": "", + "parameters": [], + "entities": [ + { + "v": "1", + "type": { + "name": "sidecar_collector_configuration", + "version": "1" + }, + "id": "ee40d454-a432-44f9-a78e-36e653c195a1", + "data": { + "collector_id": { + "@type": "string", + "@value": "5911de09-9036-41a1-80b7-9fe103ee37c8" + }, + "title": { + "@type": "string", + "@value": "auditbeat-linux-default" + }, + "color": { + "@type": "string", + "@value": "#ffffff" + }, + "template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/auditbeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/auditbeat\"}/log\nfields:\n event_source_product: linux_auditbeat\n\n# You can find the full configuration reference here:\n# https://www.elastic.co/guide/en/beats/auditbeat/index.html\n\n# =========================== Modules configuration ============================\nauditbeat.modules:\n\n# The auditd module collects events from the audit framework in the Linux kernel.\n- module: auditd\n resolve_ids: true\n failure_mode: log\n backlog_limit: 8196\n rate_limit: 0\n include_raw_message: true\n include_warnings: true\n backpressure_strategy: auto\n\n audit_rules: |\n ## Define audit rules here.\n ## Create file watches (-w) or syscall audits (-a or -A).\n\n ## If you are on a 64 bit platform, everything should be running\n ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls\n ## because this might be a sign of someone exploiting a hole in the 32\n ## bit API.\n -a always,exit -F arch=b32 -S all -F key=32bit-abi\n\n ## Executions.\n -a always,exit -F arch=b64 -S execve,execveat -k exec\n\n ## External access (warning: these can be expensive to audit).\n -a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access\n\n ## Identity changes.\n -w /etc/group -p wa -k identity\n -w /etc/passwd -p wa -k identity\n -w /etc/gshadow -p wa -k identity\n -w /etc/shadow -p wa -k identity\n\n ## Unauthorized access attempts.\n -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access\n -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access\n -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access\n -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access\n\n# The file integrity module sends events when files are changed (created, updated, deleted).\n# The events contain file metadata and hashes.\n- module: file_integrity\n paths:\n - /bin\n - /usr/bin\n - /sbin\n - /usr/sbin\n - /etc\n - /etc/graylog/server\n exclude_files:\n - '(?i)\\.sw[nop]$'\n - '~$'\n - '/\\.git($|/)'\n include_files: []\n scan_at_start: true\n scan_rate_per_sec: 50 MiB\n max_file_size: 100 MiB\n hash_types: [sha256]\n recursive: false" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "dashboard", + "version": "2" + }, + "id": "c7716730-bbaf-4a3a-a067-d0a521ec7b1a", + "data": { + "summary": { + "@type": "string", + "@value": "This is a list of all sources that sent in messages to Graylog." + }, + "search": { + "queries": [ + { + "id": "a1647eb6-a064-4fe6-b459-1e4267d3f659", + "timerange": { + "range": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "" + }, + "search_types": [ + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "5e9a9bfe-7a97-4835-86fd-896f40b20531", + "filters": [], + "column_groups": [], + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "848773e8-20ec-4140-ae11-4d14fdec771e", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "streams" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "f1c5d593-3831-42e2-b8f8-5107abc380db", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_node" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 10, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "22249f29-f042-4bd8-b745-252b00a35891", + "filters": [], + "column_groups": [], + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "9333f7ef-11ad-4bd2-967f-29288e1d254b", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_input" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + } + ] + }, + { + "id": "be9fdec2-0d46-4219-9860-b26ba839d2b4", + "timerange": { + "range": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "" + }, + "search_types": [ + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "85e0eb88-577c-45c1-b91d-7edd165a05d5", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "streams" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "4cab9d48-a864-420d-a08a-a59ddc5b0b34", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_input" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 10, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "0892cc6a-0f4e-4886-8835-bc1adf1dc7e9", + "filters": [], + "column_groups": [], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "9a0914fa-c83c-416c-8709-78d5e8cc9657", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_node" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Messages size", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "4e285e1f-5675-4005-9634-0e9d4181dd08", + "filters": [], + "column_groups": [], + "sort": [] + } + ] + } + ], + "parameters": [], + "requires": {}, + "owner": "admin", + "created_at": "2023-06-01T12:37:51.057Z" + }, + "created_at": "2023-06-01T08:43:23.743Z", + "requires": {}, + "state": { + "a1647eb6-a064-4fe6-b459-1e4267d3f659": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "tab": { + "title": "Log Volume by Message Count" + }, + "widget": { + "6c127c5d-be75-4157-b43f-ac0194ac0586": "Selected sources", + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": "Messages per Source", + "00637e63-d728-4b3e-932b-7c8696b4855d": "Messages over time", + "8850cc37-1877-4963-a518-b33e21599ebd": "Messages over time by Streams", + "5de0575e-094c-4234-96b2-042fc4f069ec": "Messages over time by Inputs", + "219f666b-8a98-468f-b1db-5841c89827d3": "Messages over time by Nodes" + } + }, + "widgets": [ + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_input" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "5de0575e-094c-4234-96b2-042fc4f069ec", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_node" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "219f666b-8a98-468f-b1db-5841c89827d3", + "filters": [] + }, + { + "config": { + "visualization": "pie", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 10, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 10 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "92d63811-e4dd-47db-bd3b-db03c8a9bd53", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "streams" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "8850cc37-1877-4963-a518-b33e21599ebd", + "filters": [] + }, + { + "config": { + "visualization": "table", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 15, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "6c127c5d-be75-4157-b43f-ac0194ac0586", + "filters": [] + } + ], + "widget_mapping": { + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": [ + "22249f29-f042-4bd8-b745-252b00a35891" + ], + "8850cc37-1877-4963-a518-b33e21599ebd": [ + "848773e8-20ec-4140-ae11-4d14fdec771e" + ], + "6c127c5d-be75-4157-b43f-ac0194ac0586": [ + "5e9a9bfe-7a97-4835-86fd-896f40b20531" + ], + "5de0575e-094c-4234-96b2-042fc4f069ec": [ + "9333f7ef-11ad-4bd2-967f-29288e1d254b" + ], + "219f666b-8a98-468f-b1db-5841c89827d3": [ + "f1c5d593-3831-42e2-b8f8-5107abc380db" + ] + }, + "positions": { + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": { + "col": 7, + "row": 9, + "height": 4, + "width": 6 + }, + "6c127c5d-be75-4157-b43f-ac0194ac0586": { + "col": 1, + "row": 9, + "height": 4, + "width": 6 + }, + "8850cc37-1877-4963-a518-b33e21599ebd": { + "col": 1, + "row": 1, + "height": 4, + "width": "Infinity" + }, + "5de0575e-094c-4234-96b2-042fc4f069ec": { + "col": 1, + "row": 5, + "height": 4, + "width": 6 + }, + "219f666b-8a98-468f-b1db-5841c89827d3": { + "col": 7, + "row": 5, + "height": 4, + "width": 6 + } + }, + "formatting": { + "highlighting": [] + }, + "display_mode_settings": { + "positions": {} + } + }, + "be9fdec2-0d46-4219-9860-b26ba839d2b4": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "tab": { + "title": "Log Volume by Message Size" + }, + "widget": { + "2a5904f0-bffb-433c-9648-163cf925c878": "Selected sources", + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": "Messages per Source", + "undefined": "Messages over time", + "e3016dd4-6586-400c-a214-538a29d5a641": "Messages over time by Streams", + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": "Messages over time by Inputs", + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": "Messages over time by Nodes" + } + }, + "widgets": [ + { + "config": { + "visualization": "table", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 15, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "series": [ + { + "config": { + "name": "Messages size" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": { + "pinned_columns": [] + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "2a5904f0-bffb-433c-9648-163cf925c878", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_input" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "7e6a1cb8-9aac-470d-9f74-19d274703b1d", + "filters": [] + }, + { + "config": { + "visualization": "pie", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 10, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 10 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "d3d3f4dc-ced0-46b0-b65d-981897c5d94b", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "streams" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "e3016dd4-6586-400c-a214-538a29d5a641", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_node" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "2d7970aa-0e35-4ac0-ac35-2f357c82c877", + "filters": [] + } + ], + "widget_mapping": { + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": [ + "0892cc6a-0f4e-4886-8835-bc1adf1dc7e9" + ], + "e3016dd4-6586-400c-a214-538a29d5a641": [ + "85e0eb88-577c-45c1-b91d-7edd165a05d5" + ], + "2a5904f0-bffb-433c-9648-163cf925c878": [ + "4e285e1f-5675-4005-9634-0e9d4181dd08" + ], + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": [ + "4cab9d48-a864-420d-a08a-a59ddc5b0b34" + ], + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": [ + "9a0914fa-c83c-416c-8709-78d5e8cc9657" + ] + }, + "positions": { + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": { + "col": 7, + "row": 9, + "height": 4, + "width": 6 + }, + "2a5904f0-bffb-433c-9648-163cf925c878": { + "col": 1, + "row": 9, + "height": 4, + "width": 6 + }, + "e3016dd4-6586-400c-a214-538a29d5a641": { + "col": 1, + "row": 1, + "height": 4, + "width": "Infinity" + }, + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": { + "col": 1, + "row": 5, + "height": 4, + "width": 6 + }, + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": { + "col": 7, + "row": 5, + "height": 4, + "width": 6 + } + }, + "formatting": { + "highlighting": [] + }, + "display_mode_settings": { + "positions": {} + } + } + }, + "properties": [], + "owner": "admin", + "title": { + "@type": "string", + "@value": "Sources" + }, + "type": "DASHBOARD", + "description": { + "@type": "string", + "@value": "This is a list of all sources that sent in messages to Graylog. You can narrow the timerange by zooming in on the message histogram, or you can increase the time range by specifying a broader one in the controls at the top. You can also specify filters to limit the results you are seeing. You can also add additional widgets to this dashboard, or adapt the appearance of existing widgets to suit your needs." + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "stream", + "version": "1" + }, + "id": "e2f79f63-1c5d-4627-a6f7-137d7c8f7890", + "data": { + "alarm_callbacks": [], + "outputs": [], + "remove_matches": { + "@type": "boolean", + "@value": false + }, + "title": { + "@type": "string", + "@value": "Win Events" + }, + "stream_rules": [ + { + "type": { + "@type": "string", + "@value": "EXACT" + }, + "field": { + "@type": "string", + "@value": "gl2_source_input" + }, + "value": { + "@type": "string", + "@value": "6785f546ae36e14a4d2adccd" + }, + "inverted": { + "@type": "boolean", + "@value": false + }, + "description": { + "@type": "string", + "@value": "" + } + } + ], + "alert_conditions": [], + "matching_type": { + "@type": "string", + "@value": "AND" + }, + "disabled": { + "@type": "boolean", + "@value": false + }, + "description": { + "@type": "string", + "@value": "All Windows eventlog messages" + }, + "default_stream": { + "@type": "boolean", + "@value": false + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "input", + "version": "1" + }, + "id": "1d726251-2623-44ab-b850-a1598c7513e7", + "data": { + "title": { + "@type": "string", + "@value": "syslog-udp" + }, + "configuration": { + "port": { + "@type": "integer", + "@value": 5140 + }, + "recv_buffer_size": { + "@type": "integer", + "@value": 262144 + }, + "force_rdns": { + "@type": "boolean", + "@value": false + }, + "allow_override_date": { + "@type": "boolean", + "@value": true + }, + "bind_address": { + "@type": "string", + "@value": "0.0.0.0" + }, + "expand_structured_data": { + "@type": "boolean", + "@value": false + }, + "store_full_message": { + "@type": "boolean", + "@value": true + }, + "timezone": { + "@type": "string", + "@value": "NotSet" + }, + "charset_name": { + "@type": "string", + "@value": "UTF-8" + }, + "number_worker_threads": { + "@type": "integer", + "@value": 4 + } + }, + "static_fields": {}, + "type": { + "@type": "string", + "@value": "org.graylog2.inputs.syslog.udp.SyslogUDPInput" + }, + "global": { + "@type": "boolean", + "@value": false + }, + "extractors": [] + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector_configuration", + "version": "1" + }, + "id": "7967aa38-3cb3-4aa6-89a0-3bcccd32bf71", + "data": { + "collector_id": { + "@type": "string", + "@value": "6ab02948-040c-4a4d-a138-cb436c3fcf62" + }, + "title": { + "@type": "string", + "@value": "filebeat-freebsd-default" + }, + "color": { + "@type": "string", + "@value": "#ffffff" + }, + "template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/log\n\nfilebeat.inputs:\n\n- type: filestream\n id: snort-filestream\n enabled: true\n paths:\n - /var/log/snort/alert_json.txt\n - /var/log/snort/appid-output.json\n parsers:\n - ndjson:\n target: \"snort3\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: snort3\n\n- type: filestream\n id: zeek-filestream\n enabled: true\n paths:\n - /opt/zeek/logs/current\n parsers:\n - ndjson:\n target: \"zeek\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: zeek\n- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/apache2/access.log\n - /var/log/apache2/error.log\n - /var/log/httpd/access_log\n - /var/log/httpd/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/httpd-access.log\n - /var/log/httpd-error.log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "stream", + "version": "1" + }, + "id": "9a1deaa7-60c4-4afd-a522-525ba8dadcf7", + "data": { + "alarm_callbacks": [], + "outputs": [], + "remove_matches": { + "@type": "boolean", + "@value": false + }, + "title": { + "@type": "string", + "@value": "Linux rsyslog" + }, + "stream_rules": [ + { + "type": { + "@type": "string", + "@value": "EXACT" + }, + "field": { + "@type": "string", + "@value": "gl2_source_input" + }, + "value": { + "@type": "string", + "@value": "67858f5eae36e14a4d2a79b4" + }, + "inverted": { + "@type": "boolean", + "@value": false + }, + "description": { + "@type": "string", + "@value": "" + } + } + ], + "alert_conditions": [], + "matching_type": { + "@type": "string", + "@value": "AND" + }, + "disabled": { + "@type": "boolean", + "@value": false + }, + "description": { + "@type": "string", + "@value": "All Linux rsyslog messages" + }, + "default_stream": { + "@type": "boolean", + "@value": false + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "input", + "version": "1" + }, + "id": "cb3014bf-95c5-494f-9b1b-d824b20924d6", + "data": { + "title": { + "@type": "string", + "@value": "Windows-beats" + }, + "configuration": { + "tls_key_file": { + "@type": "string", + "@value": "" + }, + "port": { + "@type": "integer", + "@value": 5044 + }, + "tls_enable": { + "@type": "boolean", + "@value": false + }, + "recv_buffer_size": { + "@type": "integer", + "@value": 1048576 + }, + "tcp_keepalive": { + "@type": "boolean", + "@value": false + }, + "tls_client_auth_cert_file": { + "@type": "string", + "@value": "" + }, + "bind_address": { + "@type": "string", + "@value": "0.0.0.0" + }, + "no_beats_prefix": { + "@type": "boolean", + "@value": false + }, + "tls_cert_file": { + "@type": "string", + "@value": "" + }, + "tls_client_auth": { + "@type": "string", + "@value": "disabled" + }, + "charset_name": { + "@type": "string", + "@value": "UTF-8" + }, + "number_worker_threads": { + "@type": "integer", + "@value": 4 + }, + "tls_key_password": { + "@type": "string", + "@value": "" + } + }, + "static_fields": {}, + "type": { + "@type": "string", + "@value": "org.graylog.plugins.beats.Beats2Input" + }, + "global": { + "@type": "boolean", + "@value": false + }, + "extractors": [] + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector_configuration", + "version": "1" + }, + "id": "e2584583-27b7-45a6-b641-cb4df5e8550f", + "data": { + "collector_id": { + "@type": "string", + "@value": "8d0aed73-5cc3-4ad5-a458-f24d39bbafee" + }, + "title": { + "@type": "string", + "@value": "filebeat-linux-default" + }, + "color": { + "@type": "string", + "@value": "#ffffff" + }, + "template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/log\n\nfilebeat.inputs:\n\n- type: filestream\n id: snort-filestream\n enabled: true\n paths:\n - /var/log/snort/alert_json.txt\n - /var/log/snort/appid-output.json\n parsers:\n - ndjson:\n target: \"snort3\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: snort3\n\n- type: filestream\n id: zeek-filestream\n enabled: true\n paths:\n - /opt/zeek/logs/current\n parsers:\n - ndjson:\n target: \"zeek\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: zeek\n- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/apache2/access.log\n - /var/log/apache2/error.log\n - /var/log/httpd/access_log\n - /var/log/httpd/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "dashboard", + "version": "2" + }, + "id": "669824ca-aa2f-43be-927e-3e77c341afc4", + "data": { + "summary": { + "@type": "string", + "@value": "" + }, + "search": { + "queries": [ + { + "id": "b08415e6-b88a-4242-a74b-0bad11d37e46", + "timerange": { + "from": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "" + }, + "search_types": [ + { + "query": { + "type": "elasticsearch", + "query_string": "application_name:useradd" + }, + "name": "chart", + "timerange": { + "from": 432000, + "type": "relative" + }, + "column_limit": null, + "streams": [ + "9a1deaa7-60c4-4afd-a522-525ba8dadcf7" + ], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Added_User", + "field": "application_name" + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "4f9f88c2-990a-450f-ba11-eec05755d4b9", + "filters": [], + "column_groups": [], + "sort": [] + } + ] + } + ], + "parameters": [], + "requires": {}, + "owner": "admin", + "created_at": "2025-01-15T19:18:37.798Z" + }, + "created_at": "2025-01-15T18:46:04.868Z", + "requires": {}, + "state": { + "b08415e6-b88a-4242-a74b-0bad11d37e46": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "widget": { + "409c696f-77b9-4f15-be44-1e530020e008": "linnewuser" + } + }, + "widgets": [ + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 15, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "series": [ + { + "config": { + "name": "Added_User" + }, + "function": "count(application_name)" + } + ], + "rollup": false, + "column_pivots": [], + "visualization_config": { + "barmode": "group", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": { + "type": "elasticsearch", + "query_string": "application_name:useradd" + }, + "timerange": { + "from": 432000, + "type": "relative" + }, + "streams": [ + "9a1deaa7-60c4-4afd-a522-525ba8dadcf7" + ], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "409c696f-77b9-4f15-be44-1e530020e008", + "filters": [] + } + ], + "widget_mapping": { + "409c696f-77b9-4f15-be44-1e530020e008": [ + "4f9f88c2-990a-450f-ba11-eec05755d4b9" + ] + }, + "positions": { + "409c696f-77b9-4f15-be44-1e530020e008": { + "col": 1, + "row": 1, + "height": 4, + "width": 4 + } + }, + "formatting": { + "highlighting": [] + }, + "display_mode_settings": { + "positions": {} + } + } + }, + "properties": [], + "owner": "admin", + "title": { + "@type": "string", + "@value": "FirstTestDash" + }, + "type": "DASHBOARD", + "description": { + "@type": "string", + "@value": "" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "search", + "version": "1" + }, + "id": "01fff020-dd47-4795-abfc-564fad03f361", + "data": { + "summary": { + "@type": "string", + "@value": "" + }, + "search": { + "queries": [ + { + "id": "d8fd08e5-9d56-4cf8-af76-ae14634d9a69", + "timerange": { + "from": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "application_name:useradd" + }, + "search_types": [ + { + "query": null, + "name": "chart", + "timerange": null, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "count()", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "e8b78fe1-2fe4-4add-86b2-2951f2709d7c", + "filters": [], + "column_groups": [], + "sort": [] + }, + { + "query": null, + "name": null, + "timerange": null, + "offset": 0, + "streams": [], + "filter": null, + "decorators": [], + "type": "messages", + "stream_categories": [], + "id": "23afe3e6-3cd7-4f84-9909-b2dd5a2144aa", + "limit": 150, + "filters": [] + } + ] + } + ], + "parameters": [], + "requires": {}, + "owner": "admin", + "created_at": "2025-01-15T18:15:12.906Z" + }, + "created_at": "2025-01-15T18:13:02.094Z", + "requires": {}, + "state": { + "d8fd08e5-9d56-4cf8-af76-ae14634d9a69": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "widget": { + "615e2092-e844-4fb2-a471-fbdf7bcf922e": "Message Count", + "14e11127-b04f-4949-aa59-5e0427ed850a": "All Messages" + } + }, + "widgets": [ + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": null + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": null, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "615e2092-e844-4fb2-a471-fbdf7bcf922e", + "filters": [] + }, + { + "config": { + "fields": [ + "timestamp", + "source" + ], + "units": {}, + "show_message_row": true, + "show_summary": true, + "decorators": [], + "sort": [ + { + "type": "pivot", + "field": "timestamp", + "direction": "Descending" + } + ] + }, + "query": null, + "timerange": null, + "streams": [], + "filter": null, + "type": "messages", + "stream_categories": [], + "id": "14e11127-b04f-4949-aa59-5e0427ed850a", + "filters": [] + } + ], + "widget_mapping": { + "615e2092-e844-4fb2-a471-fbdf7bcf922e": [ + "e8b78fe1-2fe4-4add-86b2-2951f2709d7c" + ], + "14e11127-b04f-4949-aa59-5e0427ed850a": [ + "23afe3e6-3cd7-4f84-9909-b2dd5a2144aa" + ] + }, + "positions": { + "615e2092-e844-4fb2-a471-fbdf7bcf922e": { + "col": 1, + "row": 1, + "height": 2, + "width": "Infinity" + }, + "14e11127-b04f-4949-aa59-5e0427ed850a": { + "col": 1, + "row": 3, + "height": 6, + "width": "Infinity" + } + }, + "formatting": null, + "display_mode_settings": { + "positions": {} + } + } + }, + "properties": [], + "owner": "admin", + "title": { + "@type": "string", + "@value": "LinNewUser" + }, + "type": "SEARCH", + "description": { + "@type": "string", + "@value": "" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector_configuration", + "version": "1" + }, + "id": "94ac68f0-7e05-4ad3-ab5b-1cbbda407dfa", + "data": { + "collector_id": { + "@type": "string", + "@value": "50736091-9072-4776-9eb5-5b451254cecb" + }, + "title": { + "@type": "string", + "@value": "filebeat-darwin-default" + }, + "color": { + "@type": "string", + "@value": "#ffffff" + }, + "template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/log\n\nfilebeat.inputs:\n\n- type: filestream\n id: snort-filestream\n enabled: true\n paths:\n - /var/log/snort/alert_json.txt\n - /var/log/snort/appid-output.json\n parsers:\n - ndjson:\n target: \"snort3\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: snort3\n\n- type: filestream\n id: zeek-filestream\n enabled: true\n paths:\n - /opt/zeek/logs/current\n parsers:\n - ndjson:\n target: \"zeek\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: zeek\n- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/apache2/access.log\n - /var/log/apache2/error.log\n - /var/log/httpd/access_log\n - /var/log/httpd/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/httpd-access.log\n - /var/log/httpd-error.log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /etc/httpd/log/access_log\n - /etc/httpd/log/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "dashboard", + "version": "2" + }, + "id": "eabad4e9-b110-4846-a6c1-b323b0b38d63", + "data": { + "summary": { + "@type": "string", + "@value": "This is a list of all sources that sent in messages to Graylog." + }, + "search": { + "queries": [ + { + "id": "a1647eb6-a064-4fe6-b459-1e4267d3f659", + "timerange": { + "range": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "" + }, + "search_types": [ + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "478ece89-6df1-4398-907e-e13b7c98faca", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_input" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "509dc7b9-62c1-4169-9b98-9b7f3aedc77a", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_node" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "00de4fc5-918f-47f8-8880-b07ee681cb36", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "streams" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "7ce513a5-3899-4a64-86e1-6caca58edd64", + "filters": [], + "column_groups": [], + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 10, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "041eb487-ce79-4df3-8151-62228848527d", + "filters": [], + "column_groups": [], + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + } + ] + }, + { + "id": "be9fdec2-0d46-4219-9860-b26ba839d2b4", + "timerange": { + "range": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "" + }, + "search_types": [ + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "4131825e-707b-4194-bf80-a0746d0878a8", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "streams" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 10, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "ca31b4b4-b4bb-4f56-a202-8ae91788fe7d", + "filters": [], + "column_groups": [], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "d413513e-1f2b-43f9-88ce-54193e996819", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_node" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source", + "message" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "74468795-295c-4367-ad86-bcd16ccc4e27", + "filters": [], + "column_groups": [], + "sort": [ + { + "type": "pivot", + "field": "message", + "direction": "Ascending" + } + ] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "0afdfe7f-f7aa-4ef0-8a70-3d1f898f0725", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_input" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + } + ] + } + ], + "parameters": [], + "requires": {}, + "owner": "admin", + "created_at": "2025-01-10T02:58:19.883Z" + }, + "created_at": "2023-06-01T08:43:23.743Z", + "requires": {}, + "state": { + "a1647eb6-a064-4fe6-b459-1e4267d3f659": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "tab": { + "title": "Log Volume by Message Count" + }, + "widget": { + "6c127c5d-be75-4157-b43f-ac0194ac0586": "Selected sources", + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": "Messages per Source", + "00637e63-d728-4b3e-932b-7c8696b4855d": "Messages over time", + "8850cc37-1877-4963-a518-b33e21599ebd": "Messages over time by Streams", + "5de0575e-094c-4234-96b2-042fc4f069ec": "Messages over time by Inputs", + "219f666b-8a98-468f-b1db-5841c89827d3": "Messages over time by Nodes" + } + }, + "widgets": [ + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_node" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "219f666b-8a98-468f-b1db-5841c89827d3", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_input" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "5de0575e-094c-4234-96b2-042fc4f069ec", + "filters": [] + }, + { + "config": { + "visualization": "pie", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 10, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 10 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "92d63811-e4dd-47db-bd3b-db03c8a9bd53", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "streams" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "8850cc37-1877-4963-a518-b33e21599ebd", + "filters": [] + }, + { + "config": { + "visualization": "table", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 15, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "6c127c5d-be75-4157-b43f-ac0194ac0586", + "filters": [] + } + ], + "widget_mapping": { + "219f666b-8a98-468f-b1db-5841c89827d3": [ + "509dc7b9-62c1-4169-9b98-9b7f3aedc77a" + ], + "5de0575e-094c-4234-96b2-042fc4f069ec": [ + "478ece89-6df1-4398-907e-e13b7c98faca" + ], + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": [ + "041eb487-ce79-4df3-8151-62228848527d" + ], + "8850cc37-1877-4963-a518-b33e21599ebd": [ + "00de4fc5-918f-47f8-8880-b07ee681cb36" + ], + "6c127c5d-be75-4157-b43f-ac0194ac0586": [ + "7ce513a5-3899-4a64-86e1-6caca58edd64" + ] + }, + "positions": { + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": { + "col": 7, + "row": 9, + "height": 4, + "width": 6 + }, + "6c127c5d-be75-4157-b43f-ac0194ac0586": { + "col": 1, + "row": 9, + "height": 4, + "width": 6 + }, + "8850cc37-1877-4963-a518-b33e21599ebd": { + "col": 1, + "row": 1, + "height": 4, + "width": "Infinity" + }, + "5de0575e-094c-4234-96b2-042fc4f069ec": { + "col": 1, + "row": 5, + "height": 4, + "width": 6 + }, + "219f666b-8a98-468f-b1db-5841c89827d3": { + "col": 7, + "row": 5, + "height": 4, + "width": 6 + } + }, + "formatting": { + "highlighting": [] + }, + "display_mode_settings": { + "positions": {} + } + }, + "be9fdec2-0d46-4219-9860-b26ba839d2b4": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "tab": { + "title": "Log Volume by Message Size" + }, + "widget": { + "2a5904f0-bffb-433c-9648-163cf925c878": "Selected sources", + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": "Messages per Source", + "undefined": "Messages over time", + "e3016dd4-6586-400c-a214-538a29d5a641": "Messages over time by Streams", + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": "Messages over time by Inputs", + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": "Messages over time by Nodes" + } + }, + "widgets": [ + { + "config": { + "visualization": "table", + "units": { + "gl2_accounted_message_size": { + "unit_type": "size", + "abbrev": "b" + } + }, + "column_limit": null, + "event_annotation": false, + "row_limit": 15, + "row_pivots": [ + { + "fields": [ + "source", + "message" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "series": [], + "rollup": true, + "column_pivots": [], + "visualization_config": { + "pinned_columns": [ + "source" + ] + }, + "formatting_settings": null, + "sort": [ + { + "type": "pivot", + "field": "message", + "direction": "Ascending" + } + ] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "2a5904f0-bffb-433c-9648-163cf925c878", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_input" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "7e6a1cb8-9aac-470d-9f74-19d274703b1d", + "filters": [] + }, + { + "config": { + "visualization": "pie", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 10, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 10 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "d3d3f4dc-ced0-46b0-b65d-981897c5d94b", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "streams" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "e3016dd4-6586-400c-a214-538a29d5a641", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_node" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "2d7970aa-0e35-4ac0-ac35-2f357c82c877", + "filters": [] + } + ], + "widget_mapping": { + "2a5904f0-bffb-433c-9648-163cf925c878": [ + "74468795-295c-4367-ad86-bcd16ccc4e27" + ], + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": [ + "0afdfe7f-f7aa-4ef0-8a70-3d1f898f0725" + ], + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": [ + "ca31b4b4-b4bb-4f56-a202-8ae91788fe7d" + ], + "e3016dd4-6586-400c-a214-538a29d5a641": [ + "4131825e-707b-4194-bf80-a0746d0878a8" + ], + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": [ + "d413513e-1f2b-43f9-88ce-54193e996819" + ] + }, + "positions": { + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": { + "col": 7, + "row": 9, + "height": 4, + "width": 6 + }, + "2a5904f0-bffb-433c-9648-163cf925c878": { + "col": 1, + "row": 9, + "height": 4, + "width": 6 + }, + "e3016dd4-6586-400c-a214-538a29d5a641": { + "col": 1, + "row": 1, + "height": 4, + "width": "Infinity" + }, + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": { + "col": 1, + "row": 5, + "height": 4, + "width": 6 + }, + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": { + "col": 7, + "row": 5, + "height": 4, + "width": 6 + } + }, + "formatting": { + "highlighting": [] + }, + "display_mode_settings": { + "positions": {} + } + } + }, + "properties": [], + "owner": "admin", + "title": { + "@type": "string", + "@value": "Sources" + }, + "type": "DASHBOARD", + "description": { + "@type": "string", + "@value": "This is a list of all sources that sent in messages to Graylog. You can narrow the timerange by zooming in on the message histogram, or you can increase the time range by specifying a broader one in the controls at the top. You can also specify filters to limit the results you are seeing. You can also add additional widgets to this dashboard, or adapt the appearance of existing widgets to suit your needs." + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector_configuration", + "version": "1" + }, + "id": "b81b478d-0627-434f-b4e0-a2e6ca7fe71f", + "data": { + "collector_id": { + "@type": "string", + "@value": "89dc69d2-65ef-4ea8-938e-806ff2624d4b" + }, + "title": { + "@type": "string", + "@value": "winlogbeat-default" + }, + "color": { + "@type": "string", + "@value": "#ffffff" + }, + "template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\\\\cache\\\\winlogbeat\"}\\data\n logs: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\"}\\logs\ntags:\n - windows\nwinlogbeat:\n event_logs:\n - name: Application\n ignore_older: 96h\n - name: System\n ignore_older: 96h\n - name: Security\n ignore_older: 96h\n - name: Setup\n ignore_older: 96h\n - name: ForwardedEvents\n forwarded: true\n ignore_older: 96h\n - name: Microsoft-Windows-Windows Defender/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-Sysmon/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-PowerShell/Operational\n ignore_older: 96h\n - name: windows PowerShell\n ignore_older: 96h" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "dashboard", + "version": "2" + }, + "id": "34602eb1-eec3-4620-afab-d9eb675b2d61", + "data": { + "summary": { + "@type": "string", + "@value": "This is a list of all sources that sent in messages to Graylog." + }, + "search": { + "queries": [ + { + "id": "a1647eb6-a064-4fe6-b459-1e4267d3f659", + "timerange": { + "range": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "" + }, + "search_types": [ + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "5e9a9bfe-7a97-4835-86fd-896f40b20531", + "filters": [], + "column_groups": [], + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "848773e8-20ec-4140-ae11-4d14fdec771e", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "streams" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "f1c5d593-3831-42e2-b8f8-5107abc380db", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_node" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 10, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "22249f29-f042-4bd8-b745-252b00a35891", + "filters": [], + "column_groups": [], + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "9333f7ef-11ad-4bd2-967f-29288e1d254b", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_input" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + } + ] + }, + { + "id": "be9fdec2-0d46-4219-9860-b26ba839d2b4", + "timerange": { + "range": 300, + "type": "relative" + }, + "filters": [], + "query": { + "type": "elasticsearch", + "query_string": "" + }, + "search_types": [ + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "85e0eb88-577c-45c1-b91d-7edd165a05d5", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "streams" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "4cab9d48-a864-420d-a08a-a59ddc5b0b34", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_input" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "count", + "id": "Message count", + "field": null + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 10, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "0892cc6a-0f4e-4886-8835-bc1adf1dc7e9", + "filters": [], + "column_groups": [], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Message count", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": false, + "row_groups": [ + { + "type": "time", + "fields": [ + "timestamp" + ], + "interval": { + "type": "auto", + "scaling": 1 + } + } + ], + "type": "pivot", + "stream_categories": [], + "id": "9a0914fa-c83c-416c-8709-78d5e8cc9657", + "filters": [], + "column_groups": [ + { + "type": "values", + "fields": [ + "gl2_source_node" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "sort": [] + }, + { + "query": null, + "name": "chart", + "timerange": { + "range": 300, + "type": "relative" + }, + "column_limit": null, + "streams": [], + "row_limit": null, + "series": [ + { + "type": "sum", + "id": "Messages size", + "field": "gl2_accounted_message_size" + } + ], + "filter": null, + "rollup": true, + "row_groups": [ + { + "type": "values", + "fields": [ + "source" + ], + "limit": 15, + "skip_empty_values": false + } + ], + "type": "pivot", + "stream_categories": [], + "id": "4e285e1f-5675-4005-9634-0e9d4181dd08", + "filters": [], + "column_groups": [], + "sort": [] + } + ] + } + ], + "parameters": [], + "requires": {}, + "owner": "admin", + "created_at": "2023-06-01T12:37:51.057Z" + }, + "created_at": "2023-06-01T08:43:23.743Z", + "requires": {}, + "state": { + "a1647eb6-a064-4fe6-b459-1e4267d3f659": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "tab": { + "title": "Log Volume by Message Count" + }, + "widget": { + "6c127c5d-be75-4157-b43f-ac0194ac0586": "Selected sources", + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": "Messages per Source", + "00637e63-d728-4b3e-932b-7c8696b4855d": "Messages over time", + "8850cc37-1877-4963-a518-b33e21599ebd": "Messages over time by Streams", + "5de0575e-094c-4234-96b2-042fc4f069ec": "Messages over time by Inputs", + "219f666b-8a98-468f-b1db-5841c89827d3": "Messages over time by Nodes" + } + }, + "widgets": [ + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_node" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "219f666b-8a98-468f-b1db-5841c89827d3", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_input" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "5de0575e-094c-4234-96b2-042fc4f069ec", + "filters": [] + }, + { + "config": { + "visualization": "pie", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 10, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 10 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "92d63811-e4dd-47db-bd3b-db03c8a9bd53", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "streams" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "8850cc37-1877-4963-a518-b33e21599ebd", + "filters": [] + }, + { + "config": { + "visualization": "table", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 15, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [ + { + "type": "series", + "field": "count()", + "direction": "Descending" + } + ] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "6c127c5d-be75-4157-b43f-ac0194ac0586", + "filters": [] + } + ], + "widget_mapping": { + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": [ + "22249f29-f042-4bd8-b745-252b00a35891" + ], + "8850cc37-1877-4963-a518-b33e21599ebd": [ + "848773e8-20ec-4140-ae11-4d14fdec771e" + ], + "6c127c5d-be75-4157-b43f-ac0194ac0586": [ + "5e9a9bfe-7a97-4835-86fd-896f40b20531" + ], + "5de0575e-094c-4234-96b2-042fc4f069ec": [ + "9333f7ef-11ad-4bd2-967f-29288e1d254b" + ], + "219f666b-8a98-468f-b1db-5841c89827d3": [ + "f1c5d593-3831-42e2-b8f8-5107abc380db" + ] + }, + "positions": { + "92d63811-e4dd-47db-bd3b-db03c8a9bd53": { + "col": 7, + "row": 9, + "height": 4, + "width": 6 + }, + "6c127c5d-be75-4157-b43f-ac0194ac0586": { + "col": 1, + "row": 9, + "height": 4, + "width": 6 + }, + "8850cc37-1877-4963-a518-b33e21599ebd": { + "col": 1, + "row": 1, + "height": 4, + "width": "Infinity" + }, + "5de0575e-094c-4234-96b2-042fc4f069ec": { + "col": 1, + "row": 5, + "height": 4, + "width": 6 + }, + "219f666b-8a98-468f-b1db-5841c89827d3": { + "col": 7, + "row": 5, + "height": 4, + "width": 6 + } + }, + "formatting": { + "highlighting": [] + }, + "display_mode_settings": { + "positions": {} + } + }, + "be9fdec2-0d46-4219-9860-b26ba839d2b4": { + "selected_fields": null, + "static_message_list_id": null, + "titles": { + "tab": { + "title": "Log Volume by Message Size" + }, + "widget": { + "2a5904f0-bffb-433c-9648-163cf925c878": "Selected sources", + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": "Messages per Source", + "undefined": "Messages over time", + "e3016dd4-6586-400c-a214-538a29d5a641": "Messages over time by Streams", + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": "Messages over time by Inputs", + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": "Messages over time by Nodes" + } + }, + "widgets": [ + { + "config": { + "visualization": "table", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 15, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "series": [ + { + "config": { + "name": "Messages size" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": { + "pinned_columns": [] + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "2a5904f0-bffb-433c-9648-163cf925c878", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_input" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "7e6a1cb8-9aac-470d-9f74-19d274703b1d", + "filters": [] + }, + { + "config": { + "visualization": "pie", + "units": {}, + "column_limit": null, + "event_annotation": false, + "row_limit": 10, + "row_pivots": [ + { + "fields": [ + "source" + ], + "type": "values", + "config": { + "limit": 10 + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "count()" + } + ], + "rollup": true, + "column_pivots": [], + "visualization_config": null, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "d3d3f4dc-ced0-46b0-b65d-981897c5d94b", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 0.25 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "streams" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "e3016dd4-6586-400c-a214-538a29d5a641", + "filters": [] + }, + { + "config": { + "visualization": "bar", + "units": {}, + "column_limit": 15, + "event_annotation": false, + "row_limit": null, + "row_pivots": [ + { + "fields": [ + "timestamp" + ], + "type": "time", + "config": { + "interval": { + "type": "auto", + "scaling": 1 + } + } + } + ], + "series": [ + { + "config": { + "name": "Message count" + }, + "function": "sum(gl2_accounted_message_size)" + } + ], + "rollup": false, + "column_pivots": [ + { + "fields": [ + "gl2_source_node" + ], + "type": "values", + "config": { + "limit": 15 + } + } + ], + "visualization_config": { + "barmode": "stack", + "axis_type": "linear" + }, + "formatting_settings": null, + "sort": [] + }, + "query": null, + "timerange": { + "range": 300, + "type": "relative" + }, + "streams": [], + "filter": null, + "type": "aggregation", + "stream_categories": [], + "id": "2d7970aa-0e35-4ac0-ac35-2f357c82c877", + "filters": [] + } + ], + "widget_mapping": { + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": [ + "0892cc6a-0f4e-4886-8835-bc1adf1dc7e9" + ], + "e3016dd4-6586-400c-a214-538a29d5a641": [ + "85e0eb88-577c-45c1-b91d-7edd165a05d5" + ], + "2a5904f0-bffb-433c-9648-163cf925c878": [ + "4e285e1f-5675-4005-9634-0e9d4181dd08" + ], + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": [ + "4cab9d48-a864-420d-a08a-a59ddc5b0b34" + ], + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": [ + "9a0914fa-c83c-416c-8709-78d5e8cc9657" + ] + }, + "positions": { + "d3d3f4dc-ced0-46b0-b65d-981897c5d94b": { + "col": 7, + "row": 9, + "height": 4, + "width": 6 + }, + "2a5904f0-bffb-433c-9648-163cf925c878": { + "col": 1, + "row": 9, + "height": 4, + "width": 6 + }, + "e3016dd4-6586-400c-a214-538a29d5a641": { + "col": 1, + "row": 1, + "height": 4, + "width": "Infinity" + }, + "7e6a1cb8-9aac-470d-9f74-19d274703b1d": { + "col": 1, + "row": 5, + "height": 4, + "width": 6 + }, + "2d7970aa-0e35-4ac0-ac35-2f357c82c877": { + "col": 7, + "row": 5, + "height": 4, + "width": 6 + } + }, + "formatting": { + "highlighting": [] + }, + "display_mode_settings": { + "positions": {} + } + } + }, + "properties": [], + "owner": "admin", + "title": { + "@type": "string", + "@value": "Sources" + }, + "type": "DASHBOARD", + "description": { + "@type": "string", + "@value": "This is a list of all sources that sent in messages to Graylog. You can narrow the timerange by zooming in on the message histogram, or you can increase the time range by specifying a broader one in the controls at the top. You can also specify filters to limit the results you are seeing. You can also add additional widgets to this dashboard, or adapt the appearance of existing widgets to suit your needs." + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector", + "version": "1" + }, + "id": "5911de09-9036-41a1-80b7-9fe103ee37c8", + "data": { + "name": { + "@type": "string", + "@value": "auditbeat" + }, + "service_type": { + "@type": "string", + "@value": "exec" + }, + "node_operating_system": { + "@type": "string", + "@value": "linux" + }, + "executable_path": { + "@type": "string", + "@value": "/usr/lib/graylog-sidecar/auditbeat" + }, + "execute_parameters": { + "@type": "string", + "@value": "-c %s" + }, + "validation_parameters": { + "@type": "string", + "@value": "test config -c %s" + }, + "default_template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/auditbeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/auditbeat\"}/log\nfields:\n event_source_product: linux_auditbeat\n\n# You can find the full configuration reference here:\n# https://www.elastic.co/guide/en/beats/auditbeat/index.html\n\n# =========================== Modules configuration ============================\nauditbeat.modules:\n\n# The auditd module collects events from the audit framework in the Linux kernel.\n- module: auditd\n resolve_ids: true\n failure_mode: log\n backlog_limit: 8196\n rate_limit: 0\n include_raw_message: true\n include_warnings: true\n backpressure_strategy: auto\n\n audit_rules: |\n ## Define audit rules here.\n ## Create file watches (-w) or syscall audits (-a or -A).\n\n ## If you are on a 64 bit platform, everything should be running\n ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls\n ## because this might be a sign of someone exploiting a hole in the 32\n ## bit API.\n -a always,exit -F arch=b32 -S all -F key=32bit-abi\n\n ## Executions.\n -a always,exit -F arch=b64 -S execve,execveat -k exec\n\n ## External access (warning: these can be expensive to audit).\n -a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access\n\n ## Identity changes.\n -w /etc/group -p wa -k identity\n -w /etc/passwd -p wa -k identity\n -w /etc/gshadow -p wa -k identity\n -w /etc/shadow -p wa -k identity\n\n ## Unauthorized access attempts.\n -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access\n -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access\n -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access\n -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access\n\n# The file integrity module sends events when files are changed (created, updated, deleted).\n# The events contain file metadata and hashes.\n- module: file_integrity\n paths:\n - /bin\n - /usr/bin\n - /sbin\n - /usr/sbin\n - /etc\n - /etc/graylog/server\n exclude_files:\n - '(?i)\\.sw[nop]$'\n - '~$'\n - '/\\.git($|/)'\n include_files: []\n scan_at_start: true\n scan_rate_per_sec: 50 MiB\n max_file_size: 100 MiB\n hash_types: [sha256]\n recursive: false" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector", + "version": "1" + }, + "id": "6ab02948-040c-4a4d-a138-cb436c3fcf62", + "data": { + "name": { + "@type": "string", + "@value": "filebeat" + }, + "service_type": { + "@type": "string", + "@value": "exec" + }, + "node_operating_system": { + "@type": "string", + "@value": "freebsd" + }, + "executable_path": { + "@type": "string", + "@value": "/usr/share/filebeat/bin/filebeat" + }, + "execute_parameters": { + "@type": "string", + "@value": "-c %s" + }, + "validation_parameters": { + "@type": "string", + "@value": "test config -c %s" + }, + "default_template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/log\n\nfilebeat.inputs:\n\n- type: filestream\n id: snort-filestream\n enabled: true\n paths:\n - /var/log/snort/alert_json.txt\n - /var/log/snort/appid-output.json\n parsers:\n - ndjson:\n target: \"snort3\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: snort3\n\n- type: filestream\n id: zeek-filestream\n enabled: true\n paths:\n - /opt/zeek/logs/current\n parsers:\n - ndjson:\n target: \"zeek\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: zeek\n- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/apache2/access.log\n - /var/log/apache2/error.log\n - /var/log/httpd/access_log\n - /var/log/httpd/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/httpd-access.log\n - /var/log/httpd-error.log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector", + "version": "1" + }, + "id": "8d0aed73-5cc3-4ad5-a458-f24d39bbafee", + "data": { + "name": { + "@type": "string", + "@value": "filebeat" + }, + "service_type": { + "@type": "string", + "@value": "exec" + }, + "node_operating_system": { + "@type": "string", + "@value": "linux" + }, + "executable_path": { + "@type": "string", + "@value": "/usr/lib/graylog-sidecar/filebeat" + }, + "execute_parameters": { + "@type": "string", + "@value": "-c %s" + }, + "validation_parameters": { + "@type": "string", + "@value": "test config -c %s" + }, + "default_template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/log\n\nfilebeat.inputs:\n\n- type: filestream\n id: snort-filestream\n enabled: true\n paths:\n - /var/log/snort/alert_json.txt\n - /var/log/snort/appid-output.json\n parsers:\n - ndjson:\n target: \"snort3\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: snort3\n\n- type: filestream\n id: zeek-filestream\n enabled: true\n paths:\n - /opt/zeek/logs/current\n parsers:\n - ndjson:\n target: \"zeek\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: zeek\n- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/apache2/access.log\n - /var/log/apache2/error.log\n - /var/log/httpd/access_log\n - /var/log/httpd/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector", + "version": "1" + }, + "id": "50736091-9072-4776-9eb5-5b451254cecb", + "data": { + "name": { + "@type": "string", + "@value": "filebeat" + }, + "service_type": { + "@type": "string", + "@value": "exec" + }, + "node_operating_system": { + "@type": "string", + "@value": "darwin" + }, + "executable_path": { + "@type": "string", + "@value": "/usr/share/filebeat/bin/filebeat" + }, + "execute_parameters": { + "@type": "string", + "@value": "-c %s" + }, + "validation_parameters": { + "@type": "string", + "@value": "test config -c %s" + }, + "default_template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/data\n logs: ${sidecar.spoolDir!\"/var/lib/graylog-sidecar/collectors/filebeat\"}/log\n\nfilebeat.inputs:\n\n- type: filestream\n id: snort-filestream\n enabled: true\n paths:\n - /var/log/snort/alert_json.txt\n - /var/log/snort/appid-output.json\n parsers:\n - ndjson:\n target: \"snort3\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: snort3\n\n- type: filestream\n id: zeek-filestream\n enabled: true\n paths:\n - /opt/zeek/logs/current\n parsers:\n - ndjson:\n target: \"zeek\"\n add_error_key: true\n overwrite_keys: true\n fields:\n event_source_product: zeek\n- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/apache2/access.log\n - /var/log/apache2/error.log\n - /var/log/httpd/access_log\n - /var/log/httpd/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /var/log/httpd-access.log\n - /var/log/httpd-error.log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd- type: filestream\n id: apache-filestream\n enabled: true\n paths:\n - /etc/httpd/log/access_log\n - /etc/httpd/log/error_log\n\n fields_under_root: true\n fields:\n event_source_product: apache_httpd" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + }, + { + "v": "1", + "type": { + "name": "sidecar_collector", + "version": "1" + }, + "id": "89dc69d2-65ef-4ea8-938e-806ff2624d4b", + "data": { + "name": { + "@type": "string", + "@value": "winlogbeat" + }, + "service_type": { + "@type": "string", + "@value": "svc" + }, + "node_operating_system": { + "@type": "string", + "@value": "windows" + }, + "executable_path": { + "@type": "string", + "@value": "C:\\Program Files\\Graylog\\sidecar\\winlogbeat.exe" + }, + "execute_parameters": { + "@type": "string", + "@value": "-c \"%s\"" + }, + "validation_parameters": { + "@type": "string", + "@value": "test config -c \"%s\"" + }, + "default_template": { + "@type": "string", + "@value": "# Needed for Graylog\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\\\\cache\\\\winlogbeat\"}\\data\n logs: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\"}\\logs\ntags:\n - windows\nwinlogbeat:\n event_logs:\n - name: Application\n ignore_older: 96h\n - name: System\n ignore_older: 96h\n - name: Security\n ignore_older: 96h\n - name: Setup\n ignore_older: 96h\n - name: ForwardedEvents\n forwarded: true\n ignore_older: 96h\n - name: Microsoft-Windows-Windows Defender/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-Sysmon/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-PowerShell/Operational\n ignore_older: 96h\n - name: windows PowerShell\n ignore_older: 96h" + } + }, + "constraints": [ + { + "type": "server-version", + "version": ">=6.1.4+7528370" + } + ] + } + ] +} \ No newline at end of file diff --git a/OperatingSystem-Services/Service-SOC/graylog upgrade.sh b/OperatingSystem-Services/Service-SOC/graylog upgrade.sh new file mode 100644 index 00000000..79ebf290 --- /dev/null +++ b/OperatingSystem-Services/Service-SOC/graylog upgrade.sh @@ -0,0 +1,109 @@ +#!/bin/bash + +# Set variables for version and backup paths +GRAYLOG_CONFIG="/etc/graylog/server/server.conf" +BACKUP_DIR="/backup" +CONFIG_BACKUP_PATH="$BACKUP_DIR/graylog_config_$(date +%Y%m%d_%H%M%S)" +MONGO_VERSION="7.0" + +# Function to log messages +log() { + echo "$(date +%Y-%m-%d_%H:%M:%S) - $1" +} + +# Backup Graylog configuration +backup_graylog_config() { + log "Backing up Graylog configuration..." + mkdir -p "$CONFIG_BACKUP_PATH" + cp "$GRAYLOG_CONFIG" "$CONFIG_BACKUP_PATH" + log "Graylog configuration backed up to $CONFIG_BACKUP_PATH." +} + +# Extract HTTP settings, root password SHA2, and password secret +extract_graylog_config() { + log "Extracting important Graylog settings from server.conf..." + + HTTP_SETTINGS=$(awk '/###############/,/#http_external_uri/' "$GRAYLOG_CONFIG") + ROOT_PASSWORD_SHA2=$(grep "^root_password_sha2" "$GRAYLOG_CONFIG") + PASSWORD_SECRET=$(grep "^password_secret" "$GRAYLOG_CONFIG") + + # Save extracted settings to a file + echo "$HTTP_SETTINGS" > "$CONFIG_BACKUP_PATH/extracted_settings.conf" + echo "$ROOT_PASSWORD_SHA2" >> "$CONFIG_BACKUP_PATH/extracted_settings.conf" + echo "$PASSWORD_SECRET" >> "$CONFIG_BACKUP_PATH/extracted_settings.conf" + + log "HTTP settings, root_password_sha2, and password_secret extracted and saved." +} + +# MongoDB Upgrade +upgrade_mongodb() { + log "Upgrading MongoDB to version $MONGO_VERSION..." + + # Wait for any existing apt processes to finish + while sudo fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do + log "Waiting for lock on /var/lib/dpkg/lock-frontend..." + sleep 5 + done + + sudo apt update && sudo apt install -y mongodb-org + if [[ $? -ne 0 ]]; then + log "Error during MongoDB upgrade. Aborting!" + exit 1 + fi +} + +# Elasticsearch Upgrade +upgrade_elasticsearch() { + log "Upgrading Elasticsearch OSS to version 7.10.2..." + # Remove existing Elasticsearch package to avoid conflicts + sudo apt-get remove -y elasticsearch-oss + # Install the required Elasticsearch OSS version + wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-7.10.2-amd64.deb + sudo dpkg -i elasticsearch-oss-7.10.2-amd64.deb + sudo apt-get update + sudo apt-get install -y elasticsearch-oss + log "Elasticsearch OSS upgrade completed successfully!" +} + +# Graylog Upgrade +upgrade_graylog() { + log "Upgrading Graylog to version 6.1.0..." + + # Download and install the latest Graylog repository + wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb + sudo dpkg -i graylog-6.1-repository_latest.deb + sudo apt-get update + sudo apt-get install -y graylog-server + log "Graylog upgrade completed successfully!" +} + +# Stop services before backup and upgrade +stop_services() { + log "Stopping Graylog service..." + sudo systemctl stop graylog-server + log "Stopping Elasticsearch service..." + sudo systemctl stop elasticsearch + log "Stopping MongoDB service..." + sudo systemctl stop mongod +} + +# Main upgrade process +log "Starting system upgrade process..." + +stop_services + +backup_graylog_config +extract_graylog_config + +upgrade_mongodb +upgrade_elasticsearch +upgrade_graylog + +log "Upgrade completed successfully. Restarting services..." + +# Restart services +sudo systemctl start elasticsearch +sudo systemctl start mongod +sudo systemctl start graylog-server + +log "All services restarted successfully." \ No newline at end of file