Merge pull request #59 from redBorder/development

Release 2.4.1
redBorder · Sep 4, 2024 · dbccece · dbccece
2 parents cf6df39 + 034df07
commit dbccece
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,11 @@
 cookbook-logstash CHANGELOG
 ===============
 
+## 2.4.1
+
+  - Pablo Pérez
+    - [3ef6f83] Added the incident priority filter
+
 ## 2.4.0
 
   - JuanSheba

diff --git a/resources/metadata.rb b/resources/metadata.rb
@@ -3,4 +3,4 @@
 maintainer_email 'git@redborder.com'
 license          'AGPL-3.0'
 description      'Installs/Configures cookbook-logstash'
-version          '2.4.0'
+version          '2.4.1'
diff --git a/resources/providers/config.rb b/resources/providers/config.rb
@@ -48,6 +48,12 @@
                              hash_function: node['redborder']['rsyslog']['hash_function'] }
     end
 
+    begin
+      incidents_priority_filter = node['redborder']['incidents_priority_filter']
+    rescue
+      incidents_priority_filter = 'high'
+    end
+
     begin
       monitors_dg = data_bag_item('rBglobal', 'monitors')
     rescue
@@ -858,6 +864,7 @@
         mode '0644'
         ignore_failure true
         cookbook 'logstash'
+        variables(incidents_priority_filter: incidents_priority_filter)
         notifies :restart, 'service[logstash]', :delayed
       end
 

diff --git a/resources/templates/default/intrusion_incident_enrichment.conf.erb b/resources/templates/default/intrusion_incident_enrichment.conf.erb
@@ -2,5 +2,6 @@ filter {
   incident_enrichment { 
     incident_fields => ["src","src_port", "dst", "dst_port"]
     source => "redBorder Intrusion"
+    incidents_priority_filter => "<%= @incidents_priority_filter %>"
   }
 }