Trying to integrate thirdparty filebeat module snort #9886
Replies: 5 comments 16 replies
-
|
What does your Filebeat config look like? |
Beta Was this translation helpful? Give feedback.
-
|
I have not done any changes to my filebeat.yml I was following the steps mentioned in securityonion document. {%- if grains.role == 'so-heavynode' %} {%- set HOSTNAME = salt'grains.get' %} name: {{ HOSTNAME }} #================================ Logging ====================================== There are four options for the log output: file, stderr, syslog, eventlogThe file output is the default.Sets log level. The default log level is info.Available log levels are: error, warning, info, debuglogging.level: {{ FBLOGGINGLEVEL }} Enable debug output for selected components. To enable all selectors use ["*"]Other available selectors are "beat", "publish", "service"Multiple selectors can be chained.#logging.selectors: [ ] Send all logging output to syslog. The default is false.#logging.to_syslog: false Send all logging output to Windows Event Logs. The default is false.#logging.to_eventlog: false If enabled, filebeat periodically logs its internal metrics that have changedin the last period. For each metric that changed, the delta from the value atthe beginning of the period is logged. Also, the total values forall non-zero internal metrics are logged on shutdown. The default is true.#logging.metrics.enabled: true The period after which to log the internal metrics. The default is 30s.#logging.metrics.period: 30s Logging to rotating files. Set logging.to_files to false to disable logging tofiles.logging.to_files: true Configure the path where the logs are written. The default is the logs directoryunder the home path (the binary location).path: /usr/share/filebeat/logs The name of the files where the logs are written to.name: filebeat.log Configure log file size limit. If limit is reached, log file will beautomatically rotatedrotateeverybytes: 10485760 # = 10MB Rotate on startuprotateonstartup: false Number of rotated log files to keep. Oldest files will be deleted first.keepfiles: 7 The permissions mask to apply when rotating log files. The default value is 0600.Must be a valid Unix-style file permissions mask expressed in octal notation.#permissions: 0600 Set to true to log messages in json format.#logging.json: false #========================== Modules configuration ============================ filebeat.modules: List of prospectors to fetch data.filebeat.inputs:
{%- if grains['role'] in ['so-eval', 'so-standalone', 'so-manager', 'so-managersearch', 'so-import'] %}
{%- if grains['role'] in ['so-eval', 'so-standalone', 'so-sensor', 'so-helix', 'so-heavynode', 'so-import'] %}
{%- if WAZUHENABLED == 1 %}
{%- endif %} {%- if FLEETMANAGER or FLEETNODE %}
{%- endif %} {%- if RITAENABLED %}
{%- if grains['role'] in ['so-eval', 'so-standalone', 'so-manager', 'so-managersearch', 'so-import'] %}
{%- if grains.role == 'so-idh' %}
{%- if INPUTS %} USER PILLAR DEFINED INPUTS{{ INPUTS | yaml(False) }} {% if OUTPUT -%} USER PILLAR DEFINED OUTPUT{%- set types = OUTPUT.keys() | list %} setup.template.enabled: false output.logstash: Boolean flag to enable or disable the output module.enabled: true The Logstash hostshosts: loadbalance: {{ LOGSTASH.loadbalance | lower }} Number of workers per Logstash host.worker: {{ FBLSWORKERS }} Number of records to send to Logstash input at a timebulk_max_size: {{ FBLSBULKMAXSIZE }} Set gzip compression level.#compression_level: 3 Enable SSL support. SSL is automatically enabled, if any SSL setting is set.#ssl.enabled: true Configure SSL verification mode. If
|
Beta Was this translation helpful? Give feedback.
-
|
Looking more for you pillar entry in your |
Beta Was this translation helpful? Give feedback.
-
|
This is the code that I appended in global.sls file filebeat: |
Beta Was this translation helpful? Give feedback.
-
|
How are you planning to read? From a file? |
Beta Was this translation helpful? Give feedback.
-
|
Try this config: Looking at the module in the container, you can see the |
Beta Was this translation helpful? Give feedback.
-
|
Sure I will try it. |
Beta Was this translation helpful? Give feedback.
-
|
When I am adding the below config I am getting an error filebeat: ERROR: I am appending the above config to my global.sls file |
Beta Was this translation helpful? Give feedback.
-
|
Is there an error in the minion log? If you run |
Beta Was this translation helpful? Give feedback.
-
|
No there is no error in minion and when I execute salt-call state.apply filebeat -l info I get following info( I have pasted just a part of info) [INFO ] Loading fresh modules for state activity No error here also |
Beta Was this translation helpful? Give feedback.
-
|
What is the architecture? Is this a standalone node? What are the resources on the server (RAM, CPU, etc.)? |
Beta Was this translation helpful? Give feedback.
-
|
You might want to make sure that path is mounted in the container. Having said that, you might be able to make Snort work on the sensor, but we do not support using Snort, only Suricata. |
Beta Was this translation helpful? Give feedback.
-
|
Will you please elaborate. Should I include the path in init.sls of filebeat? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, if you want to add a volume bind. |
Beta Was this translation helpful? Give feedback.
-
|
I added a volume bind in init.sls file of filebeat, but it is showing the same error. Filebeat is not starting. |
Beta Was this translation helpful? Give feedback.
-
|
I have installed snort3 on sensor node, how to configure filebeat on sensor node to pick the snort logs and send it to logstash on manager node. Give me an idea or a flow. |
Beta Was this translation helpful? Give feedback.
-
|
Going back to my statement above, we support Suricata, not Snort. If Filebeat is not starting, I would look at the logs, both Filebeat and Docker to see why. Also, make sure the module config is correct with the correct YAML formatting. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I am trying to integrate thirdparty filebeat module snort in securityonion manager node and I have followed the steps mentioned here: https://docs.securityonion.net/en/2.3/filebeat.html#modules
but I am getting the following error:
ERROR:
local:
Data failed to compile:
/var/cache/salt/minion/files/base/filebeat/modules.map.jinja(11):
[...]
{% set MODULESENABLED = [] %}
{% for module in MODULESMERGED.modules.keys() %}
{% set ENABLEDFILESETS = {} %}
{% for fileset in MODULESMERGED.modules[module] %}
{% if MODULESMERGED.modules[module][fileset].get('enabled', False) %} <======================
{% do ENABLEDFILESETS.update({'module': module, fileset: MODULESMERGED.modules[module][fileset]}) %}
{% endif %}
{% endfor %}
{% if ENABLEDFILESETS|length > 0 %}
{% do MODULESENABLED.append(ENABLEDFILESETS) %}
[...]
Can anyone help me solve it?
Beta Was this translation helpful? Give feedback.
All reactions