From f498cfdd03102d43f2faf207e0971f4b4551d380 Mon Sep 17 00:00:00 2001 From: david vhk <34706472+davidredborder@users.noreply.github.com> Date: Fri, 8 Nov 2024 15:46:17 +0000 Subject: [PATCH] split intrusion (#74) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Redmine bugfix #19198: Change vault default priority filter * Feature/#18682 add way to split instrusion (#69) * Fix lint * Add check for dst address * Change location of yml file * fix splitting and order of execution * Change template to use Ruby Code instead of cidr plugin --------- Co-authored-by: jsotof * release 3.2.0 --------- Co-authored-by: ptorresred Co-authored-by: Juan Soto <127120525+jsotofernandez@users.noreply.github.com> Co-authored-by: jsotof Co-authored-by: Pablo Pérez --- CHANGELOG.md | 9 +++ resources/metadata.rb | 2 +- resources/providers/config.rb | 22 +++++++- resources/resources/config.rb | 3 +- .../default/intrusion_tagging.conf.erb | 55 +++++++++++++++++++ 5 files changed, 88 insertions(+), 3 deletions(-) create mode 100644 resources/templates/default/intrusion_tagging.conf.erb diff --git a/CHANGELOG.md b/CHANGELOG.md index 33bbeb3..7e3c3a0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,15 @@ cookbook-logstash CHANGELOG =============== +## 3.2.0 + + - Pablo Pérez + - [e92ec9a] Merge pull request #73 from redBorder/bugfix/#19198_vault_priorities_incorrect_values + - Juan Soto + - [e42caa4] Feature/#18682 add way to split instrusion (#69) + - ptorresred + - [3e65dd8] Redmine bugfix #19198: Change vault default priority filter + ## 3.1.0 - Miguel Negrón diff --git a/resources/metadata.rb b/resources/metadata.rb index d672bdd..8f0904f 100644 --- a/resources/metadata.rb +++ b/resources/metadata.rb @@ -3,4 +3,4 @@ maintainer_email 'git@redborder.com' license 'AGPL-3.0' description 'Installs/Configures cookbook-logstash' -version '3.1.0' +version '3.2.0' diff --git a/resources/providers/config.rb b/resources/providers/config.rb index 68deda8..7bf0ac0 100644 --- a/resources/providers/config.rb +++ b/resources/providers/config.rb @@ -18,10 +18,16 @@ mongo_port = new_resource.mongo_port logstash_pipelines = new_resource.logstash_pipelines split_traffic_logstash = new_resource.split_traffic_logstash + split_intrusion_logstash = new_resource.split_intrusion_logstash intrusion_incidents_priority_filter = new_resource.intrusion_incidents_priority_filter vault_incidents_priority_filter = new_resource.vault_incidents_priority_filter is_proxy = is_proxy? is_manager = is_manager? + begin + sensors_data = YAML.load(::File.open('/etc/logstash/sensors_data.yml')) + rescue + sensors_data = { 'sensors' => {} } + end dnf_package 'logstash-rules' do only_if { is_manager } @@ -886,7 +892,21 @@ notifies :restart, 'service[logstash]', :delayed unless node['redborder']['leader_configuring'] end - template "#{pipelines_dir}/intrusion/05_incident_enrichment.conf" do + # This is related with this task + # https://redmine.redborder.lan/issues/18682 + # We should improve it but do not delete it + template "#{pipelines_dir}/intrusion/05_intrusion_tagging.conf" do + source 'intrusion_tagging.conf.erb' + owner user + group user + mode '0644' + ignore_failure true + cookbook 'logstash' + variables(sensors: sensors_data['sensors'], split_intrusion_logstash: split_intrusion_logstash) + notifies :restart, 'service[logstash]', :delayed + end + + template "#{pipelines_dir}/intrusion/06_incident_enrichment.conf" do source 'intrusion_incident_enrichment.conf.erb' owner user group user diff --git a/resources/resources/config.rb b/resources/resources/config.rb index 73d88bc..b4bbe8c 100644 --- a/resources/resources/config.rb +++ b/resources/resources/config.rb @@ -21,5 +21,6 @@ attribute :mongo_port, kind_of: String, default: '27017' attribute :logstash_pipelines, kind_of: Array, default: [] attribute :split_traffic_logstash, kind_of: [TrueClass, FalseClass], default: false +attribute :split_intrusion_logstash, kind_of: [TrueClass, FalseClass], default: false attribute :intrusion_incidents_priority_filter, kind_of: String, default: 'high' -attribute :vault_incidents_priority_filter, kind_of: String, default: 'high' +attribute :vault_incidents_priority_filter, kind_of: String, default: 'error' diff --git a/resources/templates/default/intrusion_tagging.conf.erb b/resources/templates/default/intrusion_tagging.conf.erb new file mode 100644 index 0000000..ae993a8 --- /dev/null +++ b/resources/templates/default/intrusion_tagging.conf.erb @@ -0,0 +1,55 @@ +<% if @split_intrusion_logstash %> +filter { + ruby { + code => " + require 'ipaddr' + + event_ip = event.get('src') + if event_ip && !event.get('organization') + ip_src = IPAddr.new(event_ip) rescue nil + if ip_src + <% @sensors.each do |sensor_name, sensor_data| %> + subnets = [ + <% sensor_data['subnets'].each_with_index do |subnet, index| %> + IPAddr.new('<%= subnet.to_s.encode('UTF-8', invalid: :replace, undef: :replace, replace: '?') %>')<%= ',' unless index == sensor_data['subnets'].length - 1 %> + <% end %> + ] + if subnets.any? { |subnet| subnet.include?(ip_src) } + <% sensor_data['fields'].each do |field_name, field_value| %> + event.set('<%= field_name %>', '<%= field_value.to_s.encode('UTF-8', invalid: :replace, undef: :replace, replace: '?').gsub("'", "\\\\'") %>') + <% end %> + break # If found a match + end + <% end %> + end + end + + # If there is not match in src ip's + if !event.get('organization') + event_ip = event.get('dst') + if event_ip + ip_dst = IPAddr.new(event_ip) rescue nil + if ip_dst + <% @sensors.each do |sensor_name, sensor_data| %> + subnets = [ + <% sensor_data['subnets'].each_with_index do |subnet, index| %> + IPAddr.new('<%= subnet.to_s.encode('UTF-8', invalid: :replace, undef: :replace, replace: '?') %>')<%= ',' unless index == sensor_data['subnets'].length - 1 %> + <% end %> + ] + if subnets.any? { |subnet| subnet.include?(ip_dst) } + <% sensor_data['fields'].each do |field_name, field_value| %> + event.set('<%= field_name %>', '<%= field_value.to_s.encode('UTF-8', invalid: :replace, undef: :replace, replace: '?').gsub("'", "\\\\'") %>') + <% end %> + break # If found a match + end + <% end %> + end + end + end + " + } +} +<% else %> +filter { +} +<% end %>